qakbot | 6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af

General

Target

6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
Size

1.8MB
MD5

6b2ec3d016e1af6251de01aea64fa06e
SHA1

eaf200e511f149be10df8b9297195cdb67e7aa86
SHA256

6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af
SHA512

7d275458fed368cb3200744c7c1af8bfa392730a8c0fc1fa5e9b3d02a886f60605b4f9db82f5b501cb9e5818f612e3b77d1a47f1d5b2fecb1bb209aa952a0770

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1044 regsvr32.exe

pid	process
1044	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3224 schtasks.exe

pid	process
3224	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\3a4f6827 = ea6e9922171f594aec2e3342780210	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\7099d79f = 8b06af47e14cde12902b61cc204119d186422f84d7751d3549d63426196540503b791b387758fe2e3366020cbb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\fd0b869 = e3aaf5d0dd16db88a4119b40e36c8029e57a70645b49d81aef39a9729c73e3159c192e4eb3a5bdb33106bdf065d14cde4e08370b22090ef7f8bcd4ee5c30c83294318613fb0ba0702ae47b654c428bcfcefa6ca3c098cf0bc397065a0a57dbd4a50a590f14a4219547cc6d7252bc5b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\d919815 = bdf360f6893a4bb3ee53601b4dfefbf05555354b648ed6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\b52dff70 = 37c74181552399ea32d39e329cdc5cd85fa6d2eb8ef4e993720786514f930f718dd46d76e05b89858a6f543daf988bfc4729c2300ea22b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\c825b0fa = 75b4a502551980593d001dfafac993b36000e325af3eaf7c7a03bf7ca602f59bd431be2f22f0208378d83132	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\b76cdf0c = 89da101637442f4daffb86c2bf6c34d7ab023d8b1624941df542d5e408e621e9b0e9549d011546e42d007b1ede50194f18223954279650e58e39a0bfe64682a537a139e745fe9359d15a0728f4ad10466490c2ed721275923712d257f8ad8e69f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\450607d1 = d70bc6118266c4d1e8b4dba2d8973204e477e5437f462e3fd04e095e076fee0b7979	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Brlacqli\3a4f6827 = ea6e8e22171f6c685bce92b9b49c18025661a3b67b9ed71420e0e1cc360697147dd0625c	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

860 regsvr32.exe
860 regsvr32.exe
1044 regsvr32.exe
1044 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

860 regsvr32.exe
1044 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe
1044	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 552 wrote to memory of 860	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 860	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 860	552	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1216	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1216	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1216	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1216	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1216	860	regsvr32.exe	explorer.exe
PID 1216 wrote to memory of 3224	1216	explorer.exe	schtasks.exe
PID 1216 wrote to memory of 3224	1216	explorer.exe	schtasks.exe
PID 1216 wrote to memory of 3224	1216	explorer.exe	schtasks.exe
PID 684 wrote to memory of 1044	684	regsvr32.exe	regsvr32.exe
PID 684 wrote to memory of 1044	684	regsvr32.exe	regsvr32.exe
PID 684 wrote to memory of 1044	684	regsvr32.exe	regsvr32.exe
PID 1044 wrote to memory of 856	1044	regsvr32.exe	explorer.exe
PID 1044 wrote to memory of 856	1044	regsvr32.exe	explorer.exe
PID 1044 wrote to memory of 856	1044	regsvr32.exe	explorer.exe
PID 1044 wrote to memory of 856	1044	regsvr32.exe	explorer.exe
PID 1044 wrote to memory of 856	1044	regsvr32.exe	explorer.exe
PID 856 wrote to memory of 1220	856	explorer.exe	reg.exe
PID 856 wrote to memory of 1220	856	explorer.exe	reg.exe
PID 856 wrote to memory of 4092	856	explorer.exe	reg.exe
PID 856 wrote to memory of 4092	856	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fbyxwhql /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:3224

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mznmexxp" /d "0"
4⤵
PID:1220

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Rdwwioajf" /d "0"
4⤵
PID:4092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
MD5
6b2ec3d016e1af6251de01aea64fa06e

SHA1
eaf200e511f149be10df8b9297195cdb67e7aa86

SHA256
6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af

SHA512
7d275458fed368cb3200744c7c1af8bfa392730a8c0fc1fa5e9b3d02a886f60605b4f9db82f5b501cb9e5818f612e3b77d1a47f1d5b2fecb1bb209aa952a0770

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
606d20fbfa3374525041c2dd2c65f097

SHA1
e0f457250a8559c53cb822c717c14d9d5a1dc4e4

SHA256
07523db0aaa52328d3fd9e84fc7a0a8a4ba17ffc944040cdfb94ba6ae05db399

SHA512
bccaf7c59f17f8b1fe04c92e20fed4bb4b4a82b2a3738ce48757ba3e4a8ecd0569f2c598232e2dd87c1242fc06231ba09d15530bfe099523baace1947a2eb3a7

Download Submit
\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
MD5
6b2ec3d016e1af6251de01aea64fa06e

SHA1
eaf200e511f149be10df8b9297195cdb67e7aa86

SHA256
6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af

SHA512
7d275458fed368cb3200744c7c1af8bfa392730a8c0fc1fa5e9b3d02a886f60605b4f9db82f5b501cb9e5818f612e3b77d1a47f1d5b2fecb1bb209aa952a0770

Download Submit
memory/856-127-0x0000000000000000-mapping.dmp

Download
memory/856-132-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/856-130-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/856-131-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/860-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/860-115-0x0000000000000000-mapping.dmp

Download
memory/860-116-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1044-124-0x0000000000000000-mapping.dmp

Download
memory/1216-122-0x00000000030F0000-0x0000000003111000-memory.dmp

Filesize
132KB

Download
memory/1216-118-0x0000000000000000-mapping.dmp

Download
memory/1216-121-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/1216-120-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/1220-128-0x0000000000000000-mapping.dmp

Download
memory/3224-119-0x0000000000000000-mapping.dmp

Download
memory/4092-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads