qakbot | 9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6

General

Target

9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll
Size

628KB
MD5

1a12c2f532fc10f7ccbfac3cc235d194
SHA1

0fbd241ef0b044059b18d2a898fd0b86ebc3e783
SHA256

9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6
SHA512

b87bc4d7737cae8dbd6295855f8e8e71ce1cf0a085231cbce984a324ce21c20adbd7f99a6feb137ddf3d955b0d3f8d4d7e153d428d5705e941b3f3a1b904dd78

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

988 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1544 schtasks.exe

pid	process
988	regsvr32.exe

pid	process
1544	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\ae19ee11 = 92d888d46f2e85b090c63b3cb5c5200d0998e133602670660fb2a6d2e4eba6d668dd71798c09d84ac12b8f2a2c66d09807432d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\233a593a = 8ec4333dcf8e4906a79924bf64c82965d4ac0d44ee8deb2214088e803de9b48824417aa1a6fc40f22cdb3970bd523dd89727d78721355daee59d374a32d5e5852b5d0c8cabc2e31be050a8c8d1c6df59411924a5652735c3bdb3facc86a065	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\5c7336cc = 10ab5d693c65b2b676c93af3681d642eeea8a75b6b5f21f5dc1d6caf4569eb9d49f8353857e6242f74deba70499c9073852ccd5d573c1ca70bfb1d85afc4df41f586dfc9d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\e4cf51a9 = 0b66fef1a77520314e361eff9c9a8dc8d306013c3de503dacc2bc7807f29a50883ee24d66b4035ba113bc44e27f84b9127d5e561d12a37d0ee90b60d9c02300aa56f94264a68618297af833d24c45b410d2f907bd20c4af9026d853d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\d15081e7 = 9be8f862b2fec87b0e034eeb83e17e48d533cba87f14	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\ae19ee11 = 92d89fd46f2eb04d286bcfd218ea8f918dd1cd72c9b23dc20f4bff5bf142f41ca6dd1a26e667125e0e6c2bc2ca04039d33cce88716cfbab394ebc741329548258dadc9641250c3f6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xmuogyiluly	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\9b863e5f = ad42b694ad1584cd852c70dfb47ffb20071e5bf86270e8eeb1da2c3e892be645f88c543fa997c9d8c6085522220d921471de7169809c31052e133143287da4bb2cd2dd66e48d522a6492713c6d923cbfe3fa2e34138dbe54f852f0d211cc102922bca04a325c35a06abc85b84782c3ca4bd4ae61034770edaf3e68cb22e70a655bad0b9c707f029eec673a53495b8cedcf83c1a9c3b0080e2eda9a9beb324b21c972ec4c78bb5670be949a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\99c71e23 = 659fdb1ab80f2d1f57bd5677ef6966a8856437d48902bda23023b23aa04cf13cdbc4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xmuogyiluly\217b7946 = 1470efb917f3477aeb06b8aedbac63998758f06b	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1340 rundll32.exe
988 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1340 rundll32.exe
988 regsvr32.exe

pid	process
1340	rundll32.exe
988	regsvr32.exe

pid	process
1340	rundll32.exe
988	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1620 wrote to memory of 1340	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1340	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1340	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1340	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1340	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1340	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1340	1620	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 332	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 332	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 332	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 332	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 332	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 332	1340	rundll32.exe	explorer.exe
PID 332 wrote to memory of 1544	332	explorer.exe	schtasks.exe
PID 332 wrote to memory of 1544	332	explorer.exe	schtasks.exe
PID 332 wrote to memory of 1544	332	explorer.exe	schtasks.exe
PID 332 wrote to memory of 1544	332	explorer.exe	schtasks.exe
PID 1460 wrote to memory of 1208	1460	taskeng.exe	regsvr32.exe
PID 1460 wrote to memory of 1208	1460	taskeng.exe	regsvr32.exe
PID 1460 wrote to memory of 1208	1460	taskeng.exe	regsvr32.exe
PID 1460 wrote to memory of 1208	1460	taskeng.exe	regsvr32.exe
PID 1460 wrote to memory of 1208	1460	taskeng.exe	regsvr32.exe
PID 1208 wrote to memory of 988	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 988	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 988	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 988	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 988	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 988	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 988	1208	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 1732	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1732	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1732	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1732	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1732	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1732	988	regsvr32.exe	explorer.exe
PID 1732 wrote to memory of 1716	1732	explorer.exe	reg.exe
PID 1732 wrote to memory of 1716	1732	explorer.exe	reg.exe
PID 1732 wrote to memory of 1716	1732	explorer.exe	reg.exe
PID 1732 wrote to memory of 1716	1732	explorer.exe	reg.exe
PID 1732 wrote to memory of 1904	1732	explorer.exe	reg.exe
PID 1732 wrote to memory of 1904	1732	explorer.exe	reg.exe
PID 1732 wrote to memory of 1904	1732	explorer.exe	reg.exe
PID 1732 wrote to memory of 1904	1732	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn anzvebrikx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll\"" /SC ONCE /Z /ST 07:02 /ET 07:14
4⤵
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\taskeng.exe
taskeng.exe {24F35D03-0D15-4863-836F-9462E40B0BE4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Itofpykwiebd" /d "0"
5⤵
PID:1716

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ceqemaaaict" /d "0"
5⤵
PID:1904

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll
MD5
1a12c2f532fc10f7ccbfac3cc235d194

SHA1
0fbd241ef0b044059b18d2a898fd0b86ebc3e783

SHA256
9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6

SHA512
b87bc4d7737cae8dbd6295855f8e8e71ce1cf0a085231cbce984a324ce21c20adbd7f99a6feb137ddf3d955b0d3f8d4d7e153d428d5705e941b3f3a1b904dd78

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll
MD5
1a12c2f532fc10f7ccbfac3cc235d194

SHA1
0fbd241ef0b044059b18d2a898fd0b86ebc3e783

SHA256
9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6

SHA512
b87bc4d7737cae8dbd6295855f8e8e71ce1cf0a085231cbce984a324ce21c20adbd7f99a6feb137ddf3d955b0d3f8d4d7e153d428d5705e941b3f3a1b904dd78

Download Submit
memory/332-62-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/332-65-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/332-64-0x00000000748E1000-0x00000000748E3000-memory.dmp

Filesize
8KB

Download
memory/988-72-0x00000000001D0000-0x00000000001F1000-memory.dmp

Filesize
132KB

Download
memory/988-70-0x00000000007C0000-0x0000000000860000-memory.dmp

Filesize
640KB

Download
memory/988-80-0x00000000001D0000-0x00000000001F1000-memory.dmp

Filesize
132KB

Download
memory/988-79-0x0000000000B20000-0x0000000000B63000-memory.dmp

Filesize
268KB

Download
memory/988-74-0x00000000001D0000-0x00000000001F1000-memory.dmp

Filesize
132KB

Download
memory/988-73-0x00000000001D0000-0x00000000001F1000-memory.dmp

Filesize
132KB

Download
memory/988-71-0x00000000001D0000-0x00000000001F1000-memory.dmp

Filesize
132KB

Download
memory/1208-66-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp

Filesize
8KB

Download
memory/1340-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1340-61-0x00000000003F0000-0x0000000000411000-memory.dmp

Filesize
132KB

Download
memory/1340-56-0x00000000003F0000-0x0000000000411000-memory.dmp

Filesize
132KB

Download
memory/1340-57-0x00000000003F0000-0x0000000000411000-memory.dmp

Filesize
132KB

Download
memory/1340-58-0x00000000003F0000-0x0000000000411000-memory.dmp

Filesize
132KB

Download
memory/1340-55-0x0000000000300000-0x00000000003A0000-memory.dmp

Filesize
640KB

Download
memory/1340-59-0x00000000003F0000-0x0000000000411000-memory.dmp

Filesize
132KB

Download
memory/1340-60-0x00000000003A0000-0x00000000003E3000-memory.dmp

Filesize
268KB

Download
memory/1732-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads