qakbot | 9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6

General

Target

9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll
Size

628KB
MD5

1a12c2f532fc10f7ccbfac3cc235d194
SHA1

0fbd241ef0b044059b18d2a898fd0b86ebc3e783
SHA256

9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6
SHA512

b87bc4d7737cae8dbd6295855f8e8e71ce1cf0a085231cbce984a324ce21c20adbd7f99a6feb137ddf3d955b0d3f8d4d7e153d428d5705e941b3f3a1b904dd78

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1264 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1140 schtasks.exe

pid	process
1264	regsvr32.exe

pid	process
1140	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omcazgkiro	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\d7290247 = 3b2309af3aad91366bfb69722dcec6f2b95afa55cf50820c39bcc75ce6db263d8602eeb4e7fd3e4b5d71d8abba8cd746c413f9db6f593cd9518776c132a2cde9d8b6bc6e04d6e4849cff15e4ba3b3188bdcef2233685acbf2bcf8221b7e1ef6e446ee61556bfbe3504952fd2bc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\6f956522 = c4ea5711cf1c376ebaa174cda194bc503429384904aebf6a73dc1a9c58a3172acfca90482cbd52133164dff5f542e1ebb147f1d4fd53fec715d6f3544e1ed3cb1a9632db76114392b3d6386674f2d6ac11ae05669bec1621d9e9ae4fd5077ecd610d8a5e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\6dd4455e = 4c4b9d5a09520ec20042f2e9494dcdcb09ac1e8b760faab2f901b60d0f93bc5f5d435d5def	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\e0f7f275 = 2ab59375b353175a133396e4969c518a9600c45c1a791b54152688481cc9bc73364c20b2bdfc252929d246f1945f882cddaefb450131ffe6ea7156eb9d587892a596c65967742020a96ec8dcc61afc38181edb55ea0003850295a1a32dca	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\d568223b = 34fa99be8c9db6283574d5f18f72f4ad5bff84595ddbe28370c52bba656af23977ce7972d6bf23026a92bee8b771464b6d08180e6c6bba74ad87caf8f09d88612f28877f57739c3c2b966c5d342bcf52fad3819f3ad55078dbaf7c924684fcf58111d9a8924e5ab85b39f7012209bc67d6433d5d5e70a79b10a5ce1bf8b8589a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\129d2aa8 = bd973355de359fe7b09ba181de694887f9844857e694d0922c5fcfb4189c475b305957273d9d52be4cb41193577395ac4ccf4f4347fef85b651b4d895eac4bad1dcb2b39dba2dea80b9c01ae4a23e9cb95df525579fb70bea7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\aa214dcd = d24a05b8a4a834869465352dd3d3126fd432d2b0a8a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\9fbe9d83 = 641be6a40024774f49b89bba61f30c024a9c640ea69583c38ede3dc9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Omcazgkiro\e0f7f275 = 2ab58475b353227d8b413adc05e124685842ade8e7098c4bc9692fa3fd710ebf98fd6db9fe3970c9bc874381553b07e731891876b9c4a9cb558164d7e1f599f3206985bc9fae73a690cb0006bec874d6316a713f17121bebbc6c3c676b8e4c9edd6bb2d48e0ca587cfdeda867fd537904250a0	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1072 rundll32.exe
1264 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1072 rundll32.exe
1264 regsvr32.exe

pid	process
1072	rundll32.exe
1264	regsvr32.exe

pid	process
1072	rundll32.exe
1264	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1876 wrote to memory of 1072	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1072	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1072	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1072	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1072	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1072	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1072	1876	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 520	1072	rundll32.exe	explorer.exe
PID 1072 wrote to memory of 520	1072	rundll32.exe	explorer.exe
PID 1072 wrote to memory of 520	1072	rundll32.exe	explorer.exe
PID 1072 wrote to memory of 520	1072	rundll32.exe	explorer.exe
PID 1072 wrote to memory of 520	1072	rundll32.exe	explorer.exe
PID 1072 wrote to memory of 520	1072	rundll32.exe	explorer.exe
PID 520 wrote to memory of 1140	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1140	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1140	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1140	520	explorer.exe	schtasks.exe
PID 1644 wrote to memory of 1676	1644	taskeng.exe	regsvr32.exe
PID 1644 wrote to memory of 1676	1644	taskeng.exe	regsvr32.exe
PID 1644 wrote to memory of 1676	1644	taskeng.exe	regsvr32.exe
PID 1644 wrote to memory of 1676	1644	taskeng.exe	regsvr32.exe
PID 1644 wrote to memory of 1676	1644	taskeng.exe	regsvr32.exe
PID 1676 wrote to memory of 1264	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1264	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1264	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1264	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1264	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1264	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1264	1676	regsvr32.exe	regsvr32.exe
PID 1264 wrote to memory of 1268	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 1268	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 1268	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 1268	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 1268	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 1268	1264	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1752	1268	explorer.exe	reg.exe
PID 1268 wrote to memory of 1752	1268	explorer.exe	reg.exe
PID 1268 wrote to memory of 1752	1268	explorer.exe	reg.exe
PID 1268 wrote to memory of 1752	1268	explorer.exe	reg.exe
PID 1268 wrote to memory of 1636	1268	explorer.exe	reg.exe
PID 1268 wrote to memory of 1636	1268	explorer.exe	reg.exe
PID 1268 wrote to memory of 1636	1268	explorer.exe	reg.exe
PID 1268 wrote to memory of 1636	1268	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rfhzweqhb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll\"" /SC ONCE /Z /ST 15:21 /ET 15:33
4⤵
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\taskeng.exe
taskeng.exe {0E7E7B8D-DCFC-4D10-A585-177DF09E2F27} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Prydvlsubyt" /d "0"
5⤵
PID:1752

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mxitytxzw" /d "0"
5⤵
PID:1636

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll
MD5
1a12c2f532fc10f7ccbfac3cc235d194

SHA1
0fbd241ef0b044059b18d2a898fd0b86ebc3e783

SHA256
9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6

SHA512
b87bc4d7737cae8dbd6295855f8e8e71ce1cf0a085231cbce984a324ce21c20adbd7f99a6feb137ddf3d955b0d3f8d4d7e153d428d5705e941b3f3a1b904dd78

Download Submit
\Users\Admin\AppData\Local\Temp\9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6.dll
MD5
1a12c2f532fc10f7ccbfac3cc235d194

SHA1
0fbd241ef0b044059b18d2a898fd0b86ebc3e783

SHA256
9f07b4d361df4a1b71c08e3686c45af62069c776d652f8d055bd05c9eebd82f6

SHA512
b87bc4d7737cae8dbd6295855f8e8e71ce1cf0a085231cbce984a324ce21c20adbd7f99a6feb137ddf3d955b0d3f8d4d7e153d428d5705e941b3f3a1b904dd78

Download Submit
memory/520-63-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/520-66-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download
memory/520-65-0x0000000074C41000-0x0000000074C43000-memory.dmp

Filesize
8KB

Download
memory/1072-59-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1072-58-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1072-62-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1072-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/1072-60-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1072-57-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1072-56-0x00000000002C0000-0x0000000000360000-memory.dmp

Filesize
640KB

Download
memory/1072-61-0x00000000007C0000-0x0000000000803000-memory.dmp

Filesize
268KB

Download
memory/1264-71-0x0000000000A00000-0x0000000000AA0000-memory.dmp

Filesize
640KB

Download
memory/1264-73-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1264-72-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1264-74-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1264-75-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1264-76-0x0000000000480000-0x00000000004A1000-memory.dmp

Filesize
132KB

Download
memory/1268-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1676-67-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads