qakbot | 5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e

General

Target

5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
Size

1.8MB
MD5

16c5222cd684458d6406fb412f03f3a3
SHA1

4e5da5b59abecb6da67387a21087f14e104838de
SHA256

5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e
SHA512

5548c12b9a6778e0c3e9b8d70e4e3309e9e8cc0559feb68034a4682455dca63a5d4896b02d5f6924567131292dfa90531baa4a43b12ecaf9f49816bd89c06922

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1476 regsvr32.exe

pid	process
1476	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1256 schtasks.exe

pid	process
1256	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\ad0195d8 = 5ccb7f1ff4f629ddef0585e108ad6f778cb6e336bbbbafbdbf98560851a97b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\af40b5a4 = 8a307b836d1426f8f4b5735d78591c62d2abf70d907b95862f87632da5092b4865e111ff4b8103cd69da639badf39b8469707746ee9fbf6cdaa58a1763f87f4498fabd35332905c0e7c5af8314f658e5d2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\5d2a6d79 = 5c5cedab6c9721face0909070f6c3cd83254bc77f55314da51b82d7b91a5fcb9c105ec930f1b9934965676affa39af680cf942bd94aed1ca6066b2e075	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\2263028f = abd78dbd1127b55ec3d3f0d0078baab9d7d4c5226c0ace69fc8983059a01580c1cf758377f493f2a23a1db483bd4994accd0f7fdf0e21b3d6a86d19d68e30c95c251bfbc550bec319911dd26650a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\17fcd2c1 = 40cdf06c716fa9e48a8313cadb6d1968b287fc8aeb6ac85ba7d0e4a9c1bbdf972d103d3d0032d5feaedff44738047fc8ba354c2b910338ca37be937f458ec077bcf05f625838ede3f21825428e112314c122538377d16dce68889b229779764111b057c1bbf9640e7de3fa7d4c633b97b57685d5d3dbf7e825a0b7bc61fa7db3c8b7c62e5b955537fc570af696135d74fc93ce201bb149d1483f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\15bdf2bd = b4db9e9961098724cba4ad3c9f68eef8d74b9f355fb303d3f2d4220c67c28c5f17398e74d9240a566ee51e901009bb5a8b735ed98557b7c76cc5290a78cfc42bf3925e447f49840e68063e6b01f11cfe146971c7c62897c24150a5b1515305616668d9bba8567c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\d009da52 = d250dae16b549591ea4103749679f54b1693a952128097a9660318850a67c92f70bf520fe5ffb53fc1c652623510903d6fd10a84b4b71eb796d18af75e3af5a5c188772e027a45820dd5455445760055ccd8385ae232af889d07969b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\68b5bd37 = 607c4985c0ee0b96a48d6c8dec9bb6ab3d1ee01e87f6e2504b2a258062dddc38277e57c9175341a96003c348e853b7d9f76b781daa5acaabcbb781db2658	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Okzxzvr	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Okzxzvr\2263028f = abd79abd112780247a163ee08f61a8e27326a08a246630831bd682c34fb3d7027d259de3d7da2aefffec9ec4573911082fa1f6c177850d87a2	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1088 regsvr32.exe
1476 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1088 regsvr32.exe
1476 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe
1088	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1892 wrote to memory of 1088	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 1088	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 1088	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 1088	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 1088	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 1088	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 1088	1892	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 700	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 700	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 700	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 700	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 700	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 700	1088	regsvr32.exe	explorer.exe
PID 700 wrote to memory of 1256	700	explorer.exe	schtasks.exe
PID 700 wrote to memory of 1256	700	explorer.exe	schtasks.exe
PID 700 wrote to memory of 1256	700	explorer.exe	schtasks.exe
PID 700 wrote to memory of 1256	700	explorer.exe	schtasks.exe
PID 844 wrote to memory of 860	844	taskeng.exe	regsvr32.exe
PID 844 wrote to memory of 860	844	taskeng.exe	regsvr32.exe
PID 844 wrote to memory of 860	844	taskeng.exe	regsvr32.exe
PID 844 wrote to memory of 860	844	taskeng.exe	regsvr32.exe
PID 844 wrote to memory of 860	844	taskeng.exe	regsvr32.exe
PID 860 wrote to memory of 1476	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1476	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1476	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1476	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1476	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1476	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1476	860	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 1404	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 1404	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 1404	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 1404	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 1404	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 1404	1476	regsvr32.exe	explorer.exe
PID 1404 wrote to memory of 1904	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1904	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1904	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1904	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1292	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1292	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1292	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1292	1404	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xzwubhw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll\"" /SC ONCE /Z /ST 12:02 /ET 12:14
4⤵
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\taskeng.exe
taskeng.exe {69A9E8F4-1556-401E-BCBD-EC0C8DE8D677} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yexuuohcbww" /d "0"
5⤵
PID:1904

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ehuomglekd" /d "0"
5⤵
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
MD5
16c5222cd684458d6406fb412f03f3a3

SHA1
4e5da5b59abecb6da67387a21087f14e104838de

SHA256
5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e

SHA512
5548c12b9a6778e0c3e9b8d70e4e3309e9e8cc0559feb68034a4682455dca63a5d4896b02d5f6924567131292dfa90531baa4a43b12ecaf9f49816bd89c06922

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
bfdb3233f72f76e69378536f3697f475

SHA1
8a1c05bd43f1507c423164c0639c99731ea29c6c

SHA256
07cea812df0b57b06aaab8ba04cd4c58c57f5580b1064e5be34efd1f3e2b0beb

SHA512
245ae9961932666bf8d21695bb81332450d3f76aa85d63ac143996f407a67b716247b31e7cfcb1e79c845a687a31a66e198f632f716f1c58529d0d13de272bb5

Download Submit
\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
MD5
16c5222cd684458d6406fb412f03f3a3

SHA1
4e5da5b59abecb6da67387a21087f14e104838de

SHA256
5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e

SHA512
5548c12b9a6778e0c3e9b8d70e4e3309e9e8cc0559feb68034a4682455dca63a5d4896b02d5f6924567131292dfa90531baa4a43b12ecaf9f49816bd89c06922

Download Submit
memory/700-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/700-60-0x0000000000000000-mapping.dmp

Download
memory/700-62-0x0000000073F91000-0x0000000073F93000-memory.dmp

Filesize
8KB

Download
memory/700-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/860-65-0x0000000000000000-mapping.dmp

Download
memory/1088-55-0x0000000000000000-mapping.dmp

Download
memory/1088-56-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download
memory/1088-57-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1088-58-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/1256-63-0x0000000000000000-mapping.dmp

Download
memory/1292-77-0x0000000000000000-mapping.dmp

Download
memory/1404-73-0x0000000000000000-mapping.dmp

Download
memory/1404-78-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1476-68-0x0000000000000000-mapping.dmp

Download
memory/1892-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download
memory/1904-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads