qakbot | 263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b

General

Target

tmp/263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b.exe.dll
Size

120KB
MD5

8de802e64b88d3c81e880b0fbbf8f0bd
SHA1

6749b6d049923060ee76e402c1cf5e9f25803956
SHA256

263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b
SHA512

c56343dfefa4d5661f6c7bfa4768ccc0540b095236e58720e8227c6c0cdbd08b2868410a5de721b88cdd802dae35a53023c3d2fdbec1d6ce42ea54e9f6efd0e1

Score

10^/10

qakbot cullinan 1640170781 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1384 1784 WerFault.exe explorer.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

952 regsvr32.exe
1384 WerFault.exe
1384 WerFault.exe
1384 WerFault.exe
1384 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1384 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

952 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1384 WerFault.exe

pid	pid_target	process	target process
1384	1784	WerFault.exe	explorer.exe

pid	process
952	regsvr32.exe
1384	WerFault.exe
1384	WerFault.exe
1384	WerFault.exe
1384	WerFault.exe

pid	process
1384	WerFault.exe

pid	process
952	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	1384	WerFault.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 968 wrote to memory of 952	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 952	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 952	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 952	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 952	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 952	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 952	968	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 1784	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 1784	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 1784	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 1784	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 1784	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 1784	952	regsvr32.exe	explorer.exe
PID 1784 wrote to memory of 1384	1784	explorer.exe	WerFault.exe
PID 1784 wrote to memory of 1384	1784	explorer.exe	WerFault.exe
PID 1784 wrote to memory of 1384	1784	explorer.exe	WerFault.exe
PID 1784 wrote to memory of 1384	1784	explorer.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmp\263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\tmp\263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b.exe.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 372
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1384

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-56-0x0000000000000000-mapping.dmp

Download
memory/952-57-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/968-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/1384-62-0x0000000000000000-mapping.dmp

Download
memory/1384-64-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1784-58-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1784-59-0x0000000000000000-mapping.dmp

Download
memory/1784-61-0x0000000073FE1000-0x0000000073FE3000-memory.dmp

Filesize
8KB

Download
memory/1784-63-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing