qakbot | 7a135b83e19c249e519fc4217600f9c515c8d25291ac1642f02d0d9e433e9a7a

General

Target

0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll
Size

644KB
MD5

cbf3694b6463be1ba38cfd2722901803
SHA1

0f32e75173201a30baf9f95a08c7dbb1a57b4fc3
SHA256

7a135b83e19c249e519fc4217600f9c515c8d25291ac1642f02d0d9e433e9a7a
SHA512

eb0910196bdcdb8469f02e1578d0f14b37404f0277801fb591d2733e54cd08fe9901240b7709b1a76e83082d9e1d7b37f15e73b1d66ef77a441e0bc8cec299a7

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1524 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

564 schtasks.exe

pid	process
1524	regsvr32.exe

pid	process
564	schtasks.exe

Modifies data under HKEY_USERS 11 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\788bc17f = 373953841fc2a78d1fadef34210aafd62576662f8c9df90d7319ee606c266ab79614e99697180624b630b3ab6ad4a003fb7de82ae1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\4d141131 = 867aa6f5b6f27f1bfdfe7f227ee00145b3aaef842088e0c990f2eb3bec738756308121789c9503d8dbefd55be3ee77b94d29987647cde4536a61febbc6713eabb76b341c46bbd752a5f52143a85f327501f91e8e4b959b9bcf7e19c7c677f21aec5621449eec2ed750732405cb7d9d7184a0acf57136e022f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\4f55314d = aa9e596687ef90c9c9c427b3ecce9d9b8c98c558cf86e4bbe195da11f6c4f5b4eef9c421510de64d76150493510fd9e7729448d111c76e95a645bd500602416d14774ff784bf9166446d1b0a35a7323bf32e1fedd7764e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\788bc17f = 373944841fc2921eedb82e806aed63c346ce9b7d1bc7fdc81ee0a4052b06da3324804e47a0a4daacabd01da459c84288733b48a1a55b6f5d68946bc48e0afbe29a8a1bc1e7b383b9d074	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\788bc17f = 373944841fc2921eedb82e806aed63c346ce9b7d1bc7fdc818e3a2052b06da3324804e47a0a4daacabd01da459c84288733b48a1a55b6f5d68946bc48e0afbe29a8a1bc1e7b383b9d074	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\7c2ae89 = b5922a97907bf4980ef535d444b97aa3be499d7e1cb1471b370ff02f2b7c52de69bf3adb02	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\f7e95628 = 3c0dcad3f007174d8f669c9b08bf8fef8e4ab74901e1266d90ea1aacaa039986b2e8d3b3acb6d7ec88ea490cd5ff4fa85bbddd2c639f333b637fa315de8c16fcec94c7bf43b3c9fbc55e2e5b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\8ae119a2 = 833cfbb8162016d0726c720131c8da6da07442977cc97e4f6666e72ec589882b1ad13d877886adacba29d7ae7fd99b5b2b7a09cee56f0255bfaf1e02c51dbd1a9348e3d9110ba193ccd057cc3ede52138b75c7888b977c01491e537df5937b1469510604b31392b92e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\325d7ec7 = e14043da401418e848264a40fd78d5a337db71a78324daf23006689fda37d88e8fa1cadc970521d53f94b14d7121c819ae009a2c5693bed612437ff8b214547f3fe4713ccaaff8170045de74293a8528113397450caffd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iojvbmkoohnor\f5a87654 = 92b48de26f86b3303bc7bd2e581f2a68f8f3ad4832938cf0720e3d5e6ba30a7ddc126bf4707644589dfdab6508bbe6ac74f0ac0891	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

944 rundll32.exe
1524 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

944 rundll32.exe
1524 regsvr32.exe

pid	process
944	rundll32.exe
1524	regsvr32.exe

pid	process
944	rundll32.exe
1524	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1768 wrote to memory of 944	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 944	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 944	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 944	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 944	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 944	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 944	1768	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1356	944	rundll32.exe	explorer.exe
PID 944 wrote to memory of 1356	944	rundll32.exe	explorer.exe
PID 944 wrote to memory of 1356	944	rundll32.exe	explorer.exe
PID 944 wrote to memory of 1356	944	rundll32.exe	explorer.exe
PID 944 wrote to memory of 1356	944	rundll32.exe	explorer.exe
PID 944 wrote to memory of 1356	944	rundll32.exe	explorer.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1028 wrote to memory of 1744	1028	taskeng.exe	regsvr32.exe
PID 1028 wrote to memory of 1744	1028	taskeng.exe	regsvr32.exe
PID 1028 wrote to memory of 1744	1028	taskeng.exe	regsvr32.exe
PID 1028 wrote to memory of 1744	1028	taskeng.exe	regsvr32.exe
PID 1028 wrote to memory of 1744	1028	taskeng.exe	regsvr32.exe
PID 1744 wrote to memory of 1524	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1524	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1524	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1524	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1524	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1524	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1524	1744	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 1256	1524	regsvr32.exe	explorer.exe
PID 1524 wrote to memory of 1256	1524	regsvr32.exe	explorer.exe
PID 1524 wrote to memory of 1256	1524	regsvr32.exe	explorer.exe
PID 1524 wrote to memory of 1256	1524	regsvr32.exe	explorer.exe
PID 1524 wrote to memory of 1256	1524	regsvr32.exe	explorer.exe
PID 1524 wrote to memory of 1256	1524	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 1492	1256	explorer.exe	reg.exe
PID 1256 wrote to memory of 1492	1256	explorer.exe	reg.exe
PID 1256 wrote to memory of 1492	1256	explorer.exe	reg.exe
PID 1256 wrote to memory of 1492	1256	explorer.exe	reg.exe
PID 1256 wrote to memory of 1888	1256	explorer.exe	reg.exe
PID 1256 wrote to memory of 1888	1256	explorer.exe	reg.exe
PID 1256 wrote to memory of 1888	1256	explorer.exe	reg.exe
PID 1256 wrote to memory of 1888	1256	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pbadgmpmrw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll\"" /SC ONCE /Z /ST 16:56 /ET 17:08
4⤵
- Creates scheduled task(s)
PID:564

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1980

C:\Windows\system32\taskeng.exe
taskeng.exe {E70B9244-198F-4595-82F3-FE112202FD00} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Abaydqgoq" /d "0"
5⤵
PID:1492

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nroatk" /d "0"
5⤵
PID:1888

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll
MD5
cbf3694b6463be1ba38cfd2722901803

SHA1
0f32e75173201a30baf9f95a08c7dbb1a57b4fc3

SHA256
7a135b83e19c249e519fc4217600f9c515c8d25291ac1642f02d0d9e433e9a7a

SHA512
eb0910196bdcdb8469f02e1578d0f14b37404f0277801fb591d2733e54cd08fe9901240b7709b1a76e83082d9e1d7b37f15e73b1d66ef77a441e0bc8cec299a7

Download Submit
\Users\Admin\AppData\Local\Temp\0f32e75173201a30baf9f95a08c7dbb1a57b4fc3.dll
MD5
cbf3694b6463be1ba38cfd2722901803

SHA1
0f32e75173201a30baf9f95a08c7dbb1a57b4fc3

SHA256
7a135b83e19c249e519fc4217600f9c515c8d25291ac1642f02d0d9e433e9a7a

SHA512
eb0910196bdcdb8469f02e1578d0f14b37404f0277801fb591d2733e54cd08fe9901240b7709b1a76e83082d9e1d7b37f15e73b1d66ef77a441e0bc8cec299a7

Download Submit
memory/944-59-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/944-57-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/944-54-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/944-58-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/944-60-0x0000000000370000-0x00000000003B3000-memory.dmp

Filesize
268KB

Download
memory/944-61-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/944-55-0x00000000001A0000-0x0000000000240000-memory.dmp

Filesize
640KB

Download
memory/944-56-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/1256-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1356-65-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1356-64-0x0000000074901000-0x0000000074903000-memory.dmp

Filesize
8KB

Download
memory/1356-62-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1524-71-0x0000000000270000-0x0000000000310000-memory.dmp

Filesize
640KB

Download
memory/1524-76-0x0000000000520000-0x0000000000541000-memory.dmp

Filesize
132KB

Download
memory/1980-66-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads