qakbot | f9bcbed5761445d15ca43d77479b137c0df27fd4a97afb56a676424fd0b5827e

General

Target

dexd.ocx.dll
Size

647KB
MD5

646c64211ce83eec01832b5c8bd12cab
SHA1

e4213cf1d523a05eccd1f9b788120c9ee0e81bdf
SHA256

f9bcbed5761445d15ca43d77479b137c0df27fd4a97afb56a676424fd0b5827e
SHA512

ebf5a042620a3ba0bab0c535fc13dfe6a5dd8c1858a09870bcdec4f9225e23314460f9bec307f6b7ab707b4020ae47f44e40a6852c11424199264dc798eba1bb

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1564 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1480 schtasks.exe

pid	process
1564	regsvr32.exe

pid	process
1480	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\39198708 = 189912ab6e39aed2ebaaa4827bad1148424ad5fd6aff7014f48e59fb15996d8b83bca71589d926c1f4816ee87a87027d93a86e4bf8855b27bf058f71ce715f1f98b304331a5850ac2c485fe00df6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\4411c882 = 64d1c025cab9ff3c62059c3ea222b8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\83e4c011 = 69296f68c47800fd5aa996aecac36f8e7067662c0bdc12f1c7b941c0bf941c66e6ee18950dc2e293228a512adfd91f104f525b2617785871fdb6592148ca233b1a89e7c2550f121986d0f0f1eec46e1f8f72aacef64a729d36d67e3945baeb7cf4880bd7120d68a798ef87eb339daf69d9499b072b67a10f9778f01c8d43d283d32329354434b755d6634d3d21c206eeef266d98c0ff10891a344f402600639fd3d35dbb67b70efa3563c6035246eb16c7e2eeafd065d06ed8aec5ad1401454c237f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\b67b105f = 220f2d74a360caa11996d2998adc4e19a8eaf4f8add8abf6a8741bcec7ed0496d6abeedcd7a21558772c41c25d09bd7b3c925f57256cc8aea97a5fd8afe385c1f23d7c264b7ddd45a9bc690347e686c69aa544bf06858fab2112e86854b1f03c37fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\81a5e06d = dc8d0bfb4b45dc853bcc2ecba72016	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\fcadafe7 = 324f881006cc37c28fffec9e3bfc91b99252affb8167ba9f98f768035354791e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\3b58a774 = e0ceac4e3ebe1767d363f8ccdf5eafd5ae75df57dbf8bd7bbed502336499e24cc607c3162189c4598cb05019b1e52d68d52a28aa73844d87e8f2cbea83a1f228e196359572a9728fdc96a74ac1e166df88534fef	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\c9327fa9 = c7fa5624e4445b708d0e317566b658cb240b9264dca0cce473331f09015011f02c175f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol\b67b105f = 220f3a74a360ffc8c9d81d3edcb83f2af23d9cbeefc1555991f9a97a1cbe9b63f3ab290e93c51115344d6f055ce33119f6f1259031cf549743abc050eccc694fb23913b20d4513ca7e5f66ee0ce24605abfdde2c803cd1cc867131430c46a0ae05d28c343efed7f34fb833f02d0550e7cb2a3b2b1f5be5	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mblwfsol	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1680 rundll32.exe
1564 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1680 rundll32.exe
1564 regsvr32.exe

pid	process
1680	rundll32.exe
1564	regsvr32.exe

pid	process
1680	rundll32.exe
1564	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1652 wrote to memory of 1680	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1680	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1680	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1680	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1680	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1680	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1680	1652	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 752	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 752	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 752	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 752	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 752	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 752	1680	rundll32.exe	explorer.exe
PID 752 wrote to memory of 1480	752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 1480	752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 1480	752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 1480	752	explorer.exe	schtasks.exe
PID 1876 wrote to memory of 1516	1876	taskeng.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	taskeng.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	taskeng.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	taskeng.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	taskeng.exe	regsvr32.exe
PID 1516 wrote to memory of 1564	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1564	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1564	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1564	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1564	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1564	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1564	1516	regsvr32.exe	regsvr32.exe
PID 1564 wrote to memory of 1880	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 1880	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 1880	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 1880	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 1880	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 1880	1564	regsvr32.exe	explorer.exe
PID 1880 wrote to memory of 1772	1880	explorer.exe	reg.exe
PID 1880 wrote to memory of 1772	1880	explorer.exe	reg.exe
PID 1880 wrote to memory of 1772	1880	explorer.exe	reg.exe
PID 1880 wrote to memory of 1772	1880	explorer.exe	reg.exe
PID 1880 wrote to memory of 1936	1880	explorer.exe	reg.exe
PID 1880 wrote to memory of 1936	1880	explorer.exe	reg.exe
PID 1880 wrote to memory of 1936	1880	explorer.exe	reg.exe
PID 1880 wrote to memory of 1936	1880	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dexd.ocx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dexd.ocx.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lxzrcgdgg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dexd.ocx.dll\"" /SC ONCE /Z /ST 12:57 /ET 13:09
4⤵
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\taskeng.exe
taskeng.exe {62921CE7-7EC0-4D38-8C36-2064C3FD3A5C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dexd.ocx.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\dexd.ocx.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Etxiecyrflf" /d "0"
5⤵
PID:1772

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Sdxdjxlofeyo" /d "0"
5⤵
PID:1936

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dexd.ocx.dll
MD5
646c64211ce83eec01832b5c8bd12cab

SHA1
e4213cf1d523a05eccd1f9b788120c9ee0e81bdf

SHA256
f9bcbed5761445d15ca43d77479b137c0df27fd4a97afb56a676424fd0b5827e

SHA512
ebf5a042620a3ba0bab0c535fc13dfe6a5dd8c1858a09870bcdec4f9225e23314460f9bec307f6b7ab707b4020ae47f44e40a6852c11424199264dc798eba1bb

Download Submit
\Users\Admin\AppData\Local\Temp\dexd.ocx.dll
MD5
646c64211ce83eec01832b5c8bd12cab

SHA1
e4213cf1d523a05eccd1f9b788120c9ee0e81bdf

SHA256
f9bcbed5761445d15ca43d77479b137c0df27fd4a97afb56a676424fd0b5827e

SHA512
ebf5a042620a3ba0bab0c535fc13dfe6a5dd8c1858a09870bcdec4f9225e23314460f9bec307f6b7ab707b4020ae47f44e40a6852c11424199264dc798eba1bb

Download Submit
memory/752-63-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/752-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/752-65-0x00000000747B1000-0x00000000747B3000-memory.dmp

Filesize
8KB

Download
memory/1516-67-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/1564-73-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1564-71-0x0000000000A00000-0x0000000000AA0000-memory.dmp

Filesize
640KB

Download
memory/1564-79-0x0000000000440000-0x0000000000483000-memory.dmp

Filesize
268KB

Download
memory/1564-80-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1564-74-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1564-75-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1564-72-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1680-60-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1680-56-0x0000000000490000-0x0000000000530000-memory.dmp

Filesize
640KB

Download
memory/1680-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download
memory/1680-58-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1680-57-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1680-62-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1680-59-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1680-61-0x00000000002C0000-0x0000000000303000-memory.dmp

Filesize
268KB

Download
memory/1880-81-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads