qakbot | 35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609

General

Target

35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll
Size

628KB
MD5

1f30c07b56800bc5e058ee277f43aaa6
SHA1

cab55efefe63f1179127dddc62bd35cedcdf1dd2
SHA256

35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609
SHA512

945f0b0755dc995222fe864164536795c0e5068c14cc2ad78b851e6447378b2cc1695e0e953faeed5b5ebccf6a9a9840c36beb48808d6aae2a8ab90c043b293a

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1164 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1408 schtasks.exe

pid	process
1164	regsvr32.exe

pid	process
1408	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\e5a6e88f = f6c11d31f1d78c59a70fd2875bcb797b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\d03938c1 = e3df88596135758f1cff36dcf4d19abee97b83f34446ee62a00a7c784dc5ec356aec6b8edaa3f43a3ffb2bbce3bf0848cc710d29306886e7620201d6fece04551ce5b1930d6d6d11ec7036ba702c1cef1288bbb06251ea4f2d991600549aca05bf0608ef2166e84d3a6400e35ce7ace83dfebd5c5a02dbf10e49666de21a9e98681eeb03d96751e5a7f0f59c27103fcbaca3c0ded757a1642b4a20e53bdb9a72a5a6749609d007fdb35502812311fa47bdee3c179ca24d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\6ac47fd8 = 3383d785f3c2dc3798ae29b0486810871b64a04fbb03a6e9f6befe19ea5ba14411cf1938c0e95ef6ecf1db58f6e5e61c288a5ad699323f89192f88c1ba446724c8fa95444822a3c2f629fa5ac027ab5eb233c096436f886bcef73e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\af705737 = 0c5c27125870136c994a62b8d6efd09c785c18c609d65cfba18335d8e41d2dba8ab0c646adb26c64f34a6cab8a296fe7abdcd4525be5e57778f4ec30e6d697ff92422d57331e7e588b7fe5d335de9bb9e62f40b0a8b6d9134ea6066662ac2183d3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\9aef8779 = dba78cf4146f1dc9ab40316162f20cd5990894029dccfe991e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vhkeoekcm	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\17cc3052 = 46d2e826a70c0fe30e6020aa64497fa291b68eccca6578c9ed595bf7b33cc486b607f2ebb0d653b7f20f4582eb4b3eddf586e298069f4505eb3c7182e31e723ab3b95409d9233ef88454bec5568b12eefa250559b8db6ded8057a655ff67f95faa48bce9785f38a00c57e890647f3b371c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\68855fa4 = 68da5ab916e5365ecbb4789a5f12b087eab81ed5a59566d90be8a7386da931b60974729855b773ee45830700f29c8bd418d2b5d1bcfb273649ccacf0f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\e5a6e88f = f6c10a31f1d7b9d0324844395d35cbb9bc4564f4a22141ef9dcae1e8bea6a1c5f630edc498	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vhkeoekcm\d27818bd = 8f9447259c258bac0d02b6230fddd14a859de6dc9f34a6b1be24982d75e6bcbc6fe22fb55e3f08887d653fb905bc5943b91e0b8236fdd44759556b7ab427ac25bcc373a2794e166ad4bca3a224378213441af0edfbdc598f565ffe923f1a68427335347a2a625ae5f57cf540cdb7930b1c	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

748 rundll32.exe
1164 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

748 rundll32.exe
1164 regsvr32.exe

pid	process
748	rundll32.exe
1164	regsvr32.exe

pid	process
748	rundll32.exe
1164	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1572 wrote to memory of 748	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 748	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 748	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 748	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 748	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 748	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 748	1572	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 768	748	rundll32.exe	explorer.exe
PID 748 wrote to memory of 768	748	rundll32.exe	explorer.exe
PID 748 wrote to memory of 768	748	rundll32.exe	explorer.exe
PID 748 wrote to memory of 768	748	rundll32.exe	explorer.exe
PID 748 wrote to memory of 768	748	rundll32.exe	explorer.exe
PID 748 wrote to memory of 768	748	rundll32.exe	explorer.exe
PID 768 wrote to memory of 1408	768	explorer.exe	schtasks.exe
PID 768 wrote to memory of 1408	768	explorer.exe	schtasks.exe
PID 768 wrote to memory of 1408	768	explorer.exe	schtasks.exe
PID 768 wrote to memory of 1408	768	explorer.exe	schtasks.exe
PID 1612 wrote to memory of 1508	1612	taskeng.exe	regsvr32.exe
PID 1612 wrote to memory of 1508	1612	taskeng.exe	regsvr32.exe
PID 1612 wrote to memory of 1508	1612	taskeng.exe	regsvr32.exe
PID 1612 wrote to memory of 1508	1612	taskeng.exe	regsvr32.exe
PID 1612 wrote to memory of 1508	1612	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 1164	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1164	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1164	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1164	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1164	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1164	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1164	1508	regsvr32.exe	regsvr32.exe
PID 1164 wrote to memory of 1440	1164	regsvr32.exe	explorer.exe
PID 1164 wrote to memory of 1440	1164	regsvr32.exe	explorer.exe
PID 1164 wrote to memory of 1440	1164	regsvr32.exe	explorer.exe
PID 1164 wrote to memory of 1440	1164	regsvr32.exe	explorer.exe
PID 1164 wrote to memory of 1440	1164	regsvr32.exe	explorer.exe
PID 1164 wrote to memory of 1440	1164	regsvr32.exe	explorer.exe
PID 1440 wrote to memory of 1464	1440	explorer.exe	reg.exe
PID 1440 wrote to memory of 1464	1440	explorer.exe	reg.exe
PID 1440 wrote to memory of 1464	1440	explorer.exe	reg.exe
PID 1440 wrote to memory of 1464	1440	explorer.exe	reg.exe
PID 1440 wrote to memory of 688	1440	explorer.exe	reg.exe
PID 1440 wrote to memory of 688	1440	explorer.exe	reg.exe
PID 1440 wrote to memory of 688	1440	explorer.exe	reg.exe
PID 1440 wrote to memory of 688	1440	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zlhevnbgmv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll\"" /SC ONCE /Z /ST 01:02 /ET 01:14
4⤵
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\taskeng.exe
taskeng.exe {9A6C8413-BF51-471E-89D3-E3CC286B1A90} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kgghdl" /d "0"
5⤵
PID:1464

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Oeippe" /d "0"
5⤵
PID:688

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll
MD5
1f30c07b56800bc5e058ee277f43aaa6

SHA1
cab55efefe63f1179127dddc62bd35cedcdf1dd2

SHA256
35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609

SHA512
945f0b0755dc995222fe864164536795c0e5068c14cc2ad78b851e6447378b2cc1695e0e953faeed5b5ebccf6a9a9840c36beb48808d6aae2a8ab90c043b293a

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609.dll
MD5
1f30c07b56800bc5e058ee277f43aaa6

SHA1
cab55efefe63f1179127dddc62bd35cedcdf1dd2

SHA256
35c75094eea47858d37e8b0b757875fdfd4cae348819a9fd3bcf82650e88b609

SHA512
945f0b0755dc995222fe864164536795c0e5068c14cc2ad78b851e6447378b2cc1695e0e953faeed5b5ebccf6a9a9840c36beb48808d6aae2a8ab90c043b293a

Download Submit
memory/748-55-0x00000000002C0000-0x0000000000360000-memory.dmp

Filesize
640KB

Download
memory/748-56-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/748-57-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/748-58-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/748-59-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/748-60-0x0000000000210000-0x0000000000253000-memory.dmp

Filesize
268KB

Download
memory/748-61-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/748-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/768-65-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/768-64-0x00000000744B1000-0x00000000744B3000-memory.dmp

Filesize
8KB

Download
memory/768-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1164-70-0x00000000003A0000-0x0000000000440000-memory.dmp

Filesize
640KB

Download
memory/1164-72-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/1164-71-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/1164-73-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/1164-74-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/1164-75-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/1440-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1508-66-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads