qakbot | bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32

General

Target

bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll
Size

628KB
MD5

3900c75c8ade09e4be828cb946a5d46e
SHA1

2518175a7f2016d7c8790d19a0950ec928482065
SHA256

bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32
SHA512

d5134e4c43343d7fb4beff466dac4c58e2d3316b6cc22ad0cdaf203fb5d81d92020609915be2d1e74c877b496b437e035dcc3c18f20c696b468f347b06f5d533

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1196 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1368 schtasks.exe

pid	process
1196	regsvr32.exe

pid	process
1368	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\65d289c9 = 1e01500c59c60488f3232df6151c1dfe0359382079e5bf8722c92c4c0754ce7b13171e6e3fa0aa00fe429f00895853cbf8c42fc0074a73887db01711f0d87d05	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\dd6eeeac = 9ad9bd29d38f60c75ba42dff9b5c96ea9cdb6f83b36467ffd46002592fa8a0e7ca51b17da253ace87b51dece492f60b279a08b2daab319f104f40dca95a8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\a066a126 = c537c9a2b88cb9da283a381ba04aa17960196d14dab63d7b93b1c8fa8d83fdda5abc20d2803b1290982c74e9bfdb22b75f8787ac55e7a7c19a3d20e18b7614d75d65fad9d5b61d6143e15ae78e60cb7f75bd843fa94d8f292ff1cc9f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\18dac643 = db16bf54791220b7ce221f9347cbf1e71ddc1b6a2228a90a34b7bd9aa49687acb2fa82de228ccb74ebdb974944a4d97efb2c487b4efc56669423a951afe2c79ec04b0da5555626b3b45d4d8e3257c2987eec8e4093f2726bb4ce07a2d50f055bb64c8b4c5c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\2d45160d = 3c9ede0617273d12f5dd1508edc3b4d12d7b2929b44e872c5f6fb1a405e2c307938c63593a17e986708a325dfe84ad7a2e661a0cea0a9cb99ed7e325cf890bc44bd1560efd26	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\520c79fb = a6c655e1cb5f8c44ee62b313de44616427448bd395e3948d5f2306221f1a2c033d9c5fb27e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\520c79fb = a6c642e1cb5fb908bc89cff8c6f09507	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\6793a9b5 = f758cd260ea39c590f6904442559a437e117c91f17fff53ccfac88bcb397f3fa68b4b1d2f5e2735818234a2c91c962bae43ba1cbbe371ebd21132296cb6f2a8e6390a763835cb0f16c271fdd4fae27679885728c9306ede0e7143906977f306699d294665b4bbc3520e9e44cd9572a5e658cf40e4c72379bf7afe7f9c50b1d0e66ee4f452f03e96e527d9e51e44b4be621c1b117bcdf70cd3aa04dd5	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yiaohucbfx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yiaohucbfx\df2fced0 = 1f8fc54ba4436ad562d9bb5ac8a99f1c20362efe3d10c7a017b281dd1cbf7bb2c37701	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1860 rundll32.exe
1196 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1860 rundll32.exe
1196 regsvr32.exe

pid	process
1860	rundll32.exe
1196	regsvr32.exe

pid	process
1860	rundll32.exe
1196	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1540 wrote to memory of 1860	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1860	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1860	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1860	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1860	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1860	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1860	1540	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 760	1860	rundll32.exe	explorer.exe
PID 1860 wrote to memory of 760	1860	rundll32.exe	explorer.exe
PID 1860 wrote to memory of 760	1860	rundll32.exe	explorer.exe
PID 1860 wrote to memory of 760	1860	rundll32.exe	explorer.exe
PID 1860 wrote to memory of 760	1860	rundll32.exe	explorer.exe
PID 1860 wrote to memory of 760	1860	rundll32.exe	explorer.exe
PID 760 wrote to memory of 1368	760	explorer.exe	schtasks.exe
PID 760 wrote to memory of 1368	760	explorer.exe	schtasks.exe
PID 760 wrote to memory of 1368	760	explorer.exe	schtasks.exe
PID 760 wrote to memory of 1368	760	explorer.exe	schtasks.exe
PID 1736 wrote to memory of 1744	1736	taskeng.exe	regsvr32.exe
PID 1736 wrote to memory of 1744	1736	taskeng.exe	regsvr32.exe
PID 1736 wrote to memory of 1744	1736	taskeng.exe	regsvr32.exe
PID 1736 wrote to memory of 1744	1736	taskeng.exe	regsvr32.exe
PID 1736 wrote to memory of 1744	1736	taskeng.exe	regsvr32.exe
PID 1744 wrote to memory of 1196	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1196	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1196	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1196	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1196	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1196	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1196	1744	regsvr32.exe	regsvr32.exe
PID 1196 wrote to memory of 1820	1196	regsvr32.exe	explorer.exe
PID 1196 wrote to memory of 1820	1196	regsvr32.exe	explorer.exe
PID 1196 wrote to memory of 1820	1196	regsvr32.exe	explorer.exe
PID 1196 wrote to memory of 1820	1196	regsvr32.exe	explorer.exe
PID 1196 wrote to memory of 1820	1196	regsvr32.exe	explorer.exe
PID 1196 wrote to memory of 1820	1196	regsvr32.exe	explorer.exe
PID 1820 wrote to memory of 1560	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 1560	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 1560	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 1560	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 580	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 580	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 580	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 580	1820	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dfszkbn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll\"" /SC ONCE /Z /ST 01:02 /ET 01:14
4⤵
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\taskeng.exe
taskeng.exe {464865E1-346A-4A33-8EA3-28F1D2B62226} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Vopatczmrce" /d "0"
5⤵
PID:1560

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aauxpdekljhi" /d "0"
5⤵
PID:580

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll
MD5
3900c75c8ade09e4be828cb946a5d46e

SHA1
2518175a7f2016d7c8790d19a0950ec928482065

SHA256
bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32

SHA512
d5134e4c43343d7fb4beff466dac4c58e2d3316b6cc22ad0cdaf203fb5d81d92020609915be2d1e74c877b496b437e035dcc3c18f20c696b468f347b06f5d533

Download Submit
\Users\Admin\AppData\Local\Temp\bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32.dll
MD5
3900c75c8ade09e4be828cb946a5d46e

SHA1
2518175a7f2016d7c8790d19a0950ec928482065

SHA256
bb5474144a8e3471ff7df9a3ba8bc69c13ef0c2356fdc569f426720c192e2e32

SHA512
d5134e4c43343d7fb4beff466dac4c58e2d3316b6cc22ad0cdaf203fb5d81d92020609915be2d1e74c877b496b437e035dcc3c18f20c696b468f347b06f5d533

Download Submit
memory/760-62-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/760-65-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/760-64-0x0000000074B61000-0x0000000074B63000-memory.dmp

Filesize
8KB

Download
memory/1196-71-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Filesize
132KB

Download
memory/1196-70-0x0000000000910000-0x00000000009B0000-memory.dmp

Filesize
640KB

Download
memory/1196-75-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Filesize
132KB

Download
memory/1196-74-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Filesize
132KB

Download
memory/1196-73-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Filesize
132KB

Download
memory/1196-72-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Filesize
132KB

Download
memory/1744-66-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Filesize
8KB

Download
memory/1820-79-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1860-56-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1860-55-0x00000000001B0000-0x0000000000250000-memory.dmp

Filesize
640KB

Download
memory/1860-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1860-60-0x00000000005B0000-0x00000000005F3000-memory.dmp

Filesize
268KB

Download
memory/1860-57-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1860-58-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1860-59-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1860-61-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads