qakbot | 670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4

General

Target

tmp/670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll
Size

120KB
MD5

51083dbdc8f7d9bb9d1a600849c6895a
SHA1

9c63e4caac2f4e94cb013609a02018a1a2315114
SHA256

670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4
SHA512

23f1b02aea88eb1f1836f126d85eff071e0c14567703bc26dbcb6f35456dfeb74161b6f45f9541cb1dc7257a96594c22804d3505ec4f891c10578f3afe78c918

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

764 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3536 schtasks.exe

pid	process
764	regsvr32.exe

pid	process
3536	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\e8418c2f = 1b688d3bd4d2f0a0390d954ab7cd0b2c059898a5e25896a77f28637f7d76dc67d5ef8a41	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\a2973397 = 98edcdf103b1262209e9fc7798e7b036fca10a2f2539be2724ae29cb002732a982a5236f895a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\a2973397 = 98eddaf103b1136b12d8f6759ca5280d16	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\9549c3a5 = fa2dd05fd587c66ec972cbb2c5452b3d3e0aa1eec868e9175b27d57a1bc762cb94684ac525cf7b0d6367c564d0259c4e83442925910c493b4ed04b0599fe5dce688017dc4b403f89206efbc62235884109ddce9f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\50fdeb4a = 4104ad07b256cc896b2bc1a48d817bbd19cdd0ee282fb207e62f7ce52b0791b4cbae76ba26e173c3e9fc24c8d4f0840c8ab39ea08f6dd16361d44b6ff88764d77020bc381a390dab4b5a40bae75c9329d4811361ec01310d52afdea3d80f2c04a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\2fb484bc = c80a855de9949e8ec78118945696c47162b85bf5b9934cd8d575799a6f28a4a8da2d49fac4a03b2e4f9211e39c270bf3cd5d31da22af190d5f6500e158646fbb4a4ae88d7f907566fd6816cce5df3cf726a8ac3779aaead3f62cd3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\ddde5c61 = 1b3c93a9c37a47d14d82b30dfbc517be1059e55a642926d1618e09e6ea65848a75b4f2e7df5ee70ca0a5764f572e88fb6c740613e5	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\9708e3d9 = a287553ccf79621cb8902c9f1fc71391f0ca94a585478607769def4145309268363fadf75aa8133070daa6812f1311e365af31a17681dab1f22e275999b9612a3e07eb6a821a998274c315dc22eae297f70bb56195407486f774c15085ee79dae86b223e38e270c084e56b080a4171f9b6d55416e5f4484a7a38e079dfb1bb98e5cae2da0ae151c7a27cf5a984dfd61adab19ade3c580a672795d01b581fdc0c8b0a3758b2986a474ee6e4b510cbe658598d580984c15965d63959a39a292cd2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ledzwwhu\2df5a4c0 = e93eeb954e6432af6503c5cacd9d8ee4387a6ec53c8d4ab450855bb0d6b6f9709160c80cbaf0e8d695baf4696f721a988bafa4	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3772 regsvr32.exe
3772 regsvr32.exe
764 regsvr32.exe
764 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3772 regsvr32.exe
764 regsvr32.exe

pid	process
3772	regsvr32.exe
3772	regsvr32.exe
764	regsvr32.exe
764	regsvr32.exe

pid	process
3772	regsvr32.exe
764	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3788 wrote to memory of 3772	3788	regsvr32.exe	regsvr32.exe
PID 3788 wrote to memory of 3772	3788	regsvr32.exe	regsvr32.exe
PID 3788 wrote to memory of 3772	3788	regsvr32.exe	regsvr32.exe
PID 3772 wrote to memory of 3500	3772	regsvr32.exe	explorer.exe
PID 3772 wrote to memory of 3500	3772	regsvr32.exe	explorer.exe
PID 3772 wrote to memory of 3500	3772	regsvr32.exe	explorer.exe
PID 3772 wrote to memory of 3500	3772	regsvr32.exe	explorer.exe
PID 3772 wrote to memory of 3500	3772	regsvr32.exe	explorer.exe
PID 3500 wrote to memory of 3536	3500	explorer.exe	schtasks.exe
PID 3500 wrote to memory of 3536	3500	explorer.exe	schtasks.exe
PID 3500 wrote to memory of 3536	3500	explorer.exe	schtasks.exe
PID 736 wrote to memory of 764	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 764	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 764	736	regsvr32.exe	regsvr32.exe
PID 764 wrote to memory of 1120	764	regsvr32.exe	explorer.exe
PID 764 wrote to memory of 1120	764	regsvr32.exe	explorer.exe
PID 764 wrote to memory of 1120	764	regsvr32.exe	explorer.exe
PID 764 wrote to memory of 1120	764	regsvr32.exe	explorer.exe
PID 764 wrote to memory of 1120	764	regsvr32.exe	explorer.exe
PID 1120 wrote to memory of 4092	1120	explorer.exe	reg.exe
PID 1120 wrote to memory of 4092	1120	explorer.exe	reg.exe
PID 1120 wrote to memory of 2924	1120	explorer.exe	reg.exe
PID 1120 wrote to memory of 2924	1120	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmp\670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\tmp\670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wtxvreun /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\tmp\670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll\"" /SC ONCE /Z /ST 03:27 /ET 03:39
4⤵
- Creates scheduled task(s)
PID:3536

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\tmp\670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\tmp\670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ivngqjvdwp" /d "0"
4⤵
PID:4092

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aqnznvw" /d "0"
4⤵
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp\670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll
MD5
51083dbdc8f7d9bb9d1a600849c6895a

SHA1
9c63e4caac2f4e94cb013609a02018a1a2315114

SHA256
670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4

SHA512
23f1b02aea88eb1f1836f126d85eff071e0c14567703bc26dbcb6f35456dfeb74161b6f45f9541cb1dc7257a96594c22804d3505ec4f891c10578f3afe78c918

Download Submit
\Users\Admin\AppData\Local\Temp\tmp\670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4.exe.dll
MD5
51083dbdc8f7d9bb9d1a600849c6895a

SHA1
9c63e4caac2f4e94cb013609a02018a1a2315114

SHA256
670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4

SHA512
23f1b02aea88eb1f1836f126d85eff071e0c14567703bc26dbcb6f35456dfeb74161b6f45f9541cb1dc7257a96594c22804d3505ec4f891c10578f3afe78c918

Download Submit
memory/764-122-0x0000000000000000-mapping.dmp

Download
memory/1120-124-0x0000000000000000-mapping.dmp

Download
memory/1120-127-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/1120-128-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/1120-129-0x0000000003410000-0x0000000003431000-memory.dmp

Filesize
132KB

Download
memory/2924-126-0x0000000000000000-mapping.dmp

Download
memory/3500-119-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3500-120-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3500-117-0x0000000003410000-0x0000000003431000-memory.dmp

Filesize
132KB

Download
memory/3500-116-0x0000000000000000-mapping.dmp

Download
memory/3536-118-0x0000000000000000-mapping.dmp

Download
memory/3772-115-0x0000000000000000-mapping.dmp

Download
memory/4092-125-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads