qakbot | 2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5

General

Target

2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll
Size

631KB
MD5

8d5c6e4740c3d5bfd4af757183c6d4eb
SHA1

c9a71d57e1a35b09710753bed9e487d62b37e853
SHA256

2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5
SHA512

3285875126af8c441a2a7d97d62cb128ff827aae313d4b652ef06632e6b6961e6aba71d4d870e27d7995c030ae5d295f802dae28b250550d195bfb0531d23cfa

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

608 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

708 schtasks.exe

pid	process
608	regsvr32.exe

pid	process
708	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\609fe9c0 = 2eb58564192c50397e9a44883d493a491036378d38f00976bb6f4ccf5dd2cb3c08a00b1aaf1da08eb79c5a18d15cfa6b78067ceff9259a690b3babfdf433e055bcdd6c3e0d511c27812b449efd68f5def91dafcf6d805a8b354e787aee3f86	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\d8238ea5 = 54e95d6b588d85daa44f5f8e3c8b3b84682febb6af3f1881b7735e1d951401a146c03ba3b4eb3d5d5ea02c460ddf85e5d4c0e04c9ac222ce9dc34fe6354ca94fd828b4e43798f2d6c98434d4fcc00a2e4ab2d4cd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\1fd68636 = 57a5e5ff0eeb27d354b5b26d79079eb8dac4ce72676be6d585d2e78a9cca3bad875823b7bc5fcbdaa08091b521d5beb59afffc1a28e8fe5decad6dac1891f25694ad21841446cdb7b02d339472a2027a9aaddd43778f73b004b18dfc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\a52bc12f = d26a1e557e3b6079d4d555c6665ccd94bd6e3e2d56cd0bbab05d310d0dc8f438b57518d3a9c64729c6ca6aed9cf4c6908e649b4d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\1d97a64a = bee7839c905c6495cfb24dd8e975b6f6445a4934c3d0e78da8464637e281eeb854d2e664701bc81d5f4212047b0c993388ee256f37fbf95b8761ed6c8792237cc3adbe44dc902ba807	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\a76ae153 = ed06b9456b094675f113fe59d362e8ff148b38234af1fb05bf79952e7b519b521ada0a65c43f3888339e7dbadc73db3c7f41b6d49effefad642acac954aca80b22eb472e45379fb052eb8d802c441c917a8d55f44121d649d925abb70630c48501f3da2350806f5a78b1ab8772d6bc0d6c23dcc62b6fd3117270aa51dac62acff74de2781d1583d273134a4a9f531a48dacd55d5c4e87b6e9829546b6862536339b91f8fea87b5063b6a5947852a39a1b0c995c7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\edbc5eeb = ab1564ea6e337e5bdb91f005f8e172933d8e7513c13ada68	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\92f5311d = 7f7701b0716aeeab9c4707108ed14a7df431cc1d290f40f14cc3f15ef6f109e7ae4f7cfa2507da5cc9672911387966388db57e33bce47e5ffc7bd7e3d0521e28f8f3c41978b4434e69622a725055658262422e1c4fea7d88	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Scsgpdbcsqu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Scsgpdbcsqu\92f5311d = 7f7716b0716adb26183cc59fb07e980d4ba9140c1a3d967166ed828493f531b411ec39414d9ad6778b96eae50af27c7632715d5021e99f72dfd679190b31b90ed5223c	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1584 rundll32.exe
608 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1584 rundll32.exe
608 regsvr32.exe

pid	process
1584	rundll32.exe
608	regsvr32.exe

pid	process
1584	rundll32.exe
608	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1560 wrote to memory of 1584	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 1584	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 1584	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 1584	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 1584	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 1584	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 1584	1560	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 468	1584	rundll32.exe	explorer.exe
PID 1584 wrote to memory of 468	1584	rundll32.exe	explorer.exe
PID 1584 wrote to memory of 468	1584	rundll32.exe	explorer.exe
PID 1584 wrote to memory of 468	1584	rundll32.exe	explorer.exe
PID 1584 wrote to memory of 468	1584	rundll32.exe	explorer.exe
PID 1584 wrote to memory of 468	1584	rundll32.exe	explorer.exe
PID 468 wrote to memory of 708	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 708	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 708	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 708	468	explorer.exe	schtasks.exe
PID 1536 wrote to memory of 1480	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1480	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1480	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1480	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1480	1536	taskeng.exe	regsvr32.exe
PID 1480 wrote to memory of 608	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 608	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 608	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 608	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 608	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 608	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 608	1480	regsvr32.exe	regsvr32.exe
PID 608 wrote to memory of 1144	608	regsvr32.exe	explorer.exe
PID 608 wrote to memory of 1144	608	regsvr32.exe	explorer.exe
PID 608 wrote to memory of 1144	608	regsvr32.exe	explorer.exe
PID 608 wrote to memory of 1144	608	regsvr32.exe	explorer.exe
PID 608 wrote to memory of 1144	608	regsvr32.exe	explorer.exe
PID 608 wrote to memory of 1144	608	regsvr32.exe	explorer.exe
PID 1144 wrote to memory of 1744	1144	explorer.exe	reg.exe
PID 1144 wrote to memory of 1744	1144	explorer.exe	reg.exe
PID 1144 wrote to memory of 1744	1144	explorer.exe	reg.exe
PID 1144 wrote to memory of 1744	1144	explorer.exe	reg.exe
PID 1144 wrote to memory of 544	1144	explorer.exe	reg.exe
PID 1144 wrote to memory of 544	1144	explorer.exe	reg.exe
PID 1144 wrote to memory of 544	1144	explorer.exe	reg.exe
PID 1144 wrote to memory of 544	1144	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn viqxreu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll\"" /SC ONCE /Z /ST 22:51 /ET 23:03
4⤵
- Creates scheduled task(s)
PID:708

C:\Windows\system32\taskeng.exe
taskeng.exe {8C95DDD8-E341-4DE5-8196-2A60725B7AF4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Gormmeymj" /d "0"
5⤵
PID:1744

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cxuouwidm" /d "0"
5⤵
PID:544

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll
MD5
8d5c6e4740c3d5bfd4af757183c6d4eb

SHA1
c9a71d57e1a35b09710753bed9e487d62b37e853

SHA256
2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5

SHA512
3285875126af8c441a2a7d97d62cb128ff827aae313d4b652ef06632e6b6961e6aba71d4d870e27d7995c030ae5d295f802dae28b250550d195bfb0531d23cfa

Download Submit
\Users\Admin\AppData\Local\Temp\2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5.dll
MD5
8d5c6e4740c3d5bfd4af757183c6d4eb

SHA1
c9a71d57e1a35b09710753bed9e487d62b37e853

SHA256
2ce9e4d223ed50fae1e7ebffca322223d0a790c741cf7a420c4bd7ce396942d5

SHA512
3285875126af8c441a2a7d97d62cb128ff827aae313d4b652ef06632e6b6961e6aba71d4d870e27d7995c030ae5d295f802dae28b250550d195bfb0531d23cfa

Download Submit
memory/468-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/468-65-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/468-64-0x0000000074AE1000-0x0000000074AE3000-memory.dmp

Filesize
8KB

Download
memory/608-72-0x0000000000950000-0x0000000000971000-memory.dmp

Filesize
132KB

Download
memory/608-73-0x0000000000950000-0x0000000000971000-memory.dmp

Filesize
132KB

Download
memory/608-78-0x0000000000900000-0x0000000000943000-memory.dmp

Filesize
268KB

Download
memory/608-79-0x0000000000950000-0x0000000000971000-memory.dmp

Filesize
132KB

Download
memory/608-74-0x0000000000950000-0x0000000000971000-memory.dmp

Filesize
132KB

Download
memory/608-71-0x0000000000950000-0x0000000000971000-memory.dmp

Filesize
132KB

Download
memory/608-70-0x0000000000990000-0x0000000000A30000-memory.dmp

Filesize
640KB

Download
memory/1144-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1480-66-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download
memory/1584-56-0x0000000001DA0000-0x0000000001DE3000-memory.dmp

Filesize
268KB

Download
memory/1584-55-0x00000000006F0000-0x0000000000790000-memory.dmp

Filesize
640KB

Download
memory/1584-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1584-58-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1584-57-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1584-59-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1584-60-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1584-61-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads