qakbot | 5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e

General

Target

5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
Size

1.8MB
MD5

16c5222cd684458d6406fb412f03f3a3
SHA1

4e5da5b59abecb6da67387a21087f14e104838de
SHA256

5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e
SHA512

5548c12b9a6778e0c3e9b8d70e4e3309e9e8cc0559feb68034a4682455dca63a5d4896b02d5f6924567131292dfa90531baa4a43b12ecaf9f49816bd89c06922

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

424 regsvr32.exe

pid	process
424	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3500 schtasks.exe

pid	process
3500	schtasks.exe

Modifies data under HKEY_USERS 7 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xilvuidcliqlh\20523e70 = 5e4b95faf96709145f9b6533a6ed12e4b318d609e93c58e04a22f9001e37f4efe8444c5ff76c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xilvuidcliqlh	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xilvuidcliqlh\6a8481c8 = 85a4aa582a3d0d00e869540001	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xilvuidcliqlh\5f1b5186 = 5cbf34424598c2e8dd61f448205c704d8a2b3ce585f5c1187563d5ab55a4e3a197e0174ad754c061ab151d7565be2f13983fa1808a6179f697a067ee266d16d6b64c6261725c109280c019f0565cf5f6a4926aeb0a3567837a112c2f7c9c6913fc8a72e1b8d819d660cd7a28754844ca7a114bc58b60334ce3232e83a0ffc2412836ce4e5e75e6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xilvuidcliqlh\5d5a71fa = 098b26c6797371e24deec3b010dd23718cf06109e22da43017ea33a8f45661ff27014f605c7d819f96429f386795500d75e5d599b252e147de12799327baa1bcbf861fced065760dd685dffa669d68bbe2a78c1ae6358cbde25c28d66d393df5c6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xilvuidcliqlh\e5e6169f = b5a1a37684c0d0be05bd8447a1cbd7354a6f0cee286e4b6905a1336bcec409b2a632cb55b9847903e4c407fb6b8d3d6a79fff6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xilvuidcliqlh\98ee5915 = 6eaaf3a70d18711c8dd732a7f0db83cb55fdca4e65a63eacbbb3254b0818704b9c23fb0cf3d3d8ee72d64cd82262e03dbb9af747bf825b588144371580	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3668 regsvr32.exe
3668 regsvr32.exe
424 regsvr32.exe
424 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3668 regsvr32.exe
424 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe
424	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe
3668	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3652 wrote to memory of 3668	3652	regsvr32.exe	regsvr32.exe
PID 3652 wrote to memory of 3668	3652	regsvr32.exe	regsvr32.exe
PID 3652 wrote to memory of 3668	3652	regsvr32.exe	regsvr32.exe
PID 3668 wrote to memory of 3184	3668	regsvr32.exe	explorer.exe
PID 3668 wrote to memory of 3184	3668	regsvr32.exe	explorer.exe
PID 3668 wrote to memory of 3184	3668	regsvr32.exe	explorer.exe
PID 3668 wrote to memory of 3184	3668	regsvr32.exe	explorer.exe
PID 3668 wrote to memory of 3184	3668	regsvr32.exe	explorer.exe
PID 3184 wrote to memory of 3500	3184	explorer.exe	schtasks.exe
PID 3184 wrote to memory of 3500	3184	explorer.exe	schtasks.exe
PID 3184 wrote to memory of 3500	3184	explorer.exe	schtasks.exe
PID 4472 wrote to memory of 424	4472	regsvr32.exe	regsvr32.exe
PID 4472 wrote to memory of 424	4472	regsvr32.exe	regsvr32.exe
PID 4472 wrote to memory of 424	4472	regsvr32.exe	regsvr32.exe
PID 424 wrote to memory of 860	424	regsvr32.exe	explorer.exe
PID 424 wrote to memory of 860	424	regsvr32.exe	explorer.exe
PID 424 wrote to memory of 860	424	regsvr32.exe	explorer.exe
PID 424 wrote to memory of 860	424	regsvr32.exe	explorer.exe
PID 424 wrote to memory of 860	424	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 864	860	explorer.exe	reg.exe
PID 860 wrote to memory of 864	860	explorer.exe	reg.exe
PID 860 wrote to memory of 1164	860	explorer.exe	reg.exe
PID 860 wrote to memory of 1164	860	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mmmbzsbgv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:3500

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Awaoyjizpie" /d "0"
4⤵
PID:864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yscuvroz" /d "0"
4⤵
PID:1164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
MD5
16c5222cd684458d6406fb412f03f3a3

SHA1
4e5da5b59abecb6da67387a21087f14e104838de

SHA256
5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e

SHA512
5548c12b9a6778e0c3e9b8d70e4e3309e9e8cc0559feb68034a4682455dca63a5d4896b02d5f6924567131292dfa90531baa4a43b12ecaf9f49816bd89c06922

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
1e0af6d6cc69fdb38da92e7eefc7f4ca

SHA1
1af413857c5a263ade5edbdfb38b95d514acb2d8

SHA256
66419555343fae6e9b8d49424db598c16fb57a49ccc52d9053a37ae3d4e47860

SHA512
ac96ea67d01c220b3e887c59a771666ee21721b814b2e1e79418d31df77c8a04775ae73b15f3aedc1439e0b5abbd7ab340de52b63c5a00b2b2dbb46b751de0c6

Download Submit
\Users\Admin\AppData\Local\Temp\5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e.dll
MD5
16c5222cd684458d6406fb412f03f3a3

SHA1
4e5da5b59abecb6da67387a21087f14e104838de

SHA256
5265cdf1086b7b1fe418ef6ad6518ddcf070adfaf78a4c2ab44c56920eede48e

SHA512
5548c12b9a6778e0c3e9b8d70e4e3309e9e8cc0559feb68034a4682455dca63a5d4896b02d5f6924567131292dfa90531baa4a43b12ecaf9f49816bd89c06922

Download Submit
memory/424-127-0x0000000003160000-0x00000000032AA000-memory.dmp

Filesize
1.3MB

Download
memory/424-124-0x0000000000000000-mapping.dmp

Download
memory/860-128-0x0000000000000000-mapping.dmp

Download
memory/864-129-0x0000000000000000-mapping.dmp

Download
memory/1164-130-0x0000000000000000-mapping.dmp

Download
memory/3184-120-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3184-121-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3184-122-0x0000000002760000-0x0000000002781000-memory.dmp

Filesize
132KB

Download
memory/3184-118-0x0000000000000000-mapping.dmp

Download
memory/3500-119-0x0000000000000000-mapping.dmp

Download
memory/3668-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/3668-116-0x00000000004A0000-0x000000000054E000-memory.dmp

Filesize
696KB

Download
memory/3668-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads