qakbot | bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213

General

Target

bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll
Size

630KB
MD5

40c4c9f214b47e21fd9632c4f1d35900
SHA1

7c8ac3aa2e4312a7d6323f46cbe6f619fc61124d
SHA256

bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213
SHA512

cb68a118692cd6f8b9875b8d83c600b705438d729550e99c6c3791b017e3e19b08cc66bedcaaa8db58b6af062ef7a7a05da9427906d24d9db685329c5ff369fe

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1580 created 1216 1580 WerFault.exe rundll32.exe
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1348 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3464 1216 WerFault.exe rundll32.exe

description	pid	process	target process
PID 1580 created 1216	1580	WerFault.exe	rundll32.exe

pid	process
1348	regsvr32.exe

pid	pid_target	process	target process
3464	1216	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3676 schtasks.exe

pid	process
3676	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\26042b01 = 603d536659c4055af660f7fdb5076e5778abe8f26ebf04c87ec14351834a055e238228	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\139bfb4f = 1b2ad4cb8f48aca72ba0f12416cd24397d05461d8fee1540b3a66b3d9282269d8cd4aa80de260bf6d8a06612e44ddaf06869576e84a8de723aa99e38c1dbe122e40b315e3487c06f8d21738a3ce9bbd19b73368057036a178a4437c331974aff35afff594f5dd53b044d13f72c03ce5c08a568ae093246481102c96ba611512a8bdbf599b86cb581	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\d46ef3dc = 0570be9871e81f86c5f39ac54d0fc8c884db5ee880ce4c740352b29f8a151b5e3fc71a5ee8ab3e99f466bdc487023e8a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\ab279c2a = 4eaa05b5b57e027a477e73a1a0a0d944e93db0f57b00195fc3a649724b3c8daf0c9dd63bdb5023f58a1cac1e8c7968ccc78f30ac43cb008d38e31c4d33a2d0f2227d41ce18cbcc81cfc634f0b4bf1d16c8f5b9b6d458624247477ddd0a3a6a31de38d91d52ffdd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\26042b01 = 603d446659c430e39285b68a3ce34b79371b2a712cead433920aa8c1e8a32f3f51ff092b39795c187b4178930641cc9fd751d787fd39b5c5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\11dadb33 = ac4a329fec523f3a5ac4377b943b8048a218742c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\a966bc56 = 39e3723c36902c0328eaf7e4778c8812b94fdce67bec30ac8b7376952cc615a3d22444bb8300c7cad1709edba3738ea19b2216c4234bbf3e7877ddd2aa5ec87652d684a9336a65801ee4ef8e509ad7ee6fbf951110889643ab0f31ba97731970ddc33669a89e2666e95cde1d04fe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\6cd294b9 = cfff01f092381589b8ff04748e9d35c0c60e116137bb1c5e9300a52b7496aa7d72a022d18a7829c90a4f5e2f6fe9e63c368911de23f5129a337065ab6362b4c0f54059605b14d4f2d1a7a993c73a79fe73cd7f13111e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Itsyuygiecssd\594d44f7 = 2c66389f95323f757a67c6368f94c9066c648b25cbdd0f2922698bd5f5807b1cb2f7d80bc6c9ca5085ed	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exeWerFault.exeregsvr32.exe

pid process

1216 rundll32.exe
1216 rundll32.exe
3464 WerFault.exe
3464 WerFault.exe
1348 regsvr32.exe
1348 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1216 rundll32.exe
1348 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3464 WerFault.exe
Token: SeBackupPrivilege 3464 WerFault.exe

pid	process
1216	rundll32.exe
1216	rundll32.exe
3464	WerFault.exe
3464	WerFault.exe
1348	regsvr32.exe
1348	regsvr32.exe

pid	process
1216	rundll32.exe
1348	regsvr32.exe

description	pid	process
Token: SeRestorePrivilege	3464	WerFault.exe
Token: SeBackupPrivilege	3464	WerFault.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

rundll32.exeWerFault.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 748 wrote to memory of 1216	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1216	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1216	748	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1216	1580	WerFault.exe	rundll32.exe
PID 1580 wrote to memory of 1216	1580	WerFault.exe	rundll32.exe
PID 1216 wrote to memory of 3288	1216	rundll32.exe	explorer.exe
PID 1216 wrote to memory of 3288	1216	rundll32.exe	explorer.exe
PID 1216 wrote to memory of 3288	1216	rundll32.exe	explorer.exe
PID 1216 wrote to memory of 3288	1216	rundll32.exe	explorer.exe
PID 1216 wrote to memory of 3288	1216	rundll32.exe	explorer.exe
PID 3288 wrote to memory of 3676	3288	explorer.exe	schtasks.exe
PID 3288 wrote to memory of 3676	3288	explorer.exe	schtasks.exe
PID 3288 wrote to memory of 3676	3288	explorer.exe	schtasks.exe
PID 412 wrote to memory of 1348	412	regsvr32.exe	regsvr32.exe
PID 412 wrote to memory of 1348	412	regsvr32.exe	regsvr32.exe
PID 412 wrote to memory of 1348	412	regsvr32.exe	regsvr32.exe
PID 1348 wrote to memory of 1552	1348	regsvr32.exe	explorer.exe
PID 1348 wrote to memory of 1552	1348	regsvr32.exe	explorer.exe
PID 1348 wrote to memory of 1552	1348	regsvr32.exe	explorer.exe
PID 1348 wrote to memory of 1552	1348	regsvr32.exe	explorer.exe
PID 1348 wrote to memory of 1552	1348	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 4092	1552	explorer.exe	reg.exe
PID 1552 wrote to memory of 4092	1552	explorer.exe	reg.exe
PID 1552 wrote to memory of 2076	1552	explorer.exe	reg.exe
PID 1552 wrote to memory of 2076	1552	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 624
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bmpkfic /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll\"" /SC ONCE /Z /ST 22:13 /ET 22:25
4⤵
- Creates scheduled task(s)
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1216 -ip 1216
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Odaxtru" /d "0"
4⤵
PID:4092

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Djary" /d "0"
4⤵
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll
MD5
40c4c9f214b47e21fd9632c4f1d35900

SHA1
7c8ac3aa2e4312a7d6323f46cbe6f619fc61124d

SHA256
bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213

SHA512
cb68a118692cd6f8b9875b8d83c600b705438d729550e99c6c3791b017e3e19b08cc66bedcaaa8db58b6af062ef7a7a05da9427906d24d9db685329c5ff369fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213.dll
MD5
40c4c9f214b47e21fd9632c4f1d35900

SHA1
7c8ac3aa2e4312a7d6323f46cbe6f619fc61124d

SHA256
bd3511db489e06a09cbe3f91ef7ef8f5ada5e39b0ade781f744896dd46bef213

SHA512
cb68a118692cd6f8b9875b8d83c600b705438d729550e99c6c3791b017e3e19b08cc66bedcaaa8db58b6af062ef7a7a05da9427906d24d9db685329c5ff369fe

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1216-131-0x0000000004D30000-0x0000000004D51000-memory.dmp

Filesize
132KB

Download
memory/1216-130-0x0000000004D30000-0x0000000004D51000-memory.dmp

Filesize
132KB

Download
memory/1216-132-0x0000000004CA0000-0x0000000004CE3000-memory.dmp

Filesize
268KB

Download
memory/1216-133-0x0000000004D30000-0x0000000004D51000-memory.dmp

Filesize
132KB

Download
memory/1348-139-0x0000000003720000-0x0000000003741000-memory.dmp

Filesize
132KB

Download
memory/1348-140-0x0000000003720000-0x0000000003741000-memory.dmp

Filesize
132KB

Download
memory/1348-141-0x0000000003720000-0x0000000003741000-memory.dmp

Filesize
132KB

Download
memory/1552-144-0x0000000003260000-0x0000000003281000-memory.dmp

Filesize
132KB

Download
memory/3288-134-0x0000000002F80000-0x0000000002FA1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads