qakbot | 2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607

General

Target

2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll
Size

628KB
MD5

51009756e0e3c09f93434f0a2ac60d42
SHA1

d25a86e5e5ca97bcb8cda78d877fc0daa4fec482
SHA256

2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607
SHA512

668cc6bfed18ef601b138017af783035db625bb448076bbcb2227850bbb3cd7c6a1e72652d600286e5b85170ef063ec77f804a34d143fb4d5d6edf0e42d3b0b1

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1952 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1488 schtasks.exe

pid	process
1952	regsvr32.exe

pid	process
1488	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\4919edc3 = cb6f1b092e09922bc9361c1b27b762490a41ebadbabb69926362f9a0edb0c36303df54caf6dc8d2e75bc29d2b244b937282b90894ba498921cb8ff63debb93a1ac7f760628e9f24402c5a94cc922f4866777fda1ee7ba40d6a25e82ce3b565b611b87fca9f5a5dac7b3dd2262bf5d753bfe146f2a9fa45652820dab46d914645514683178db788af5981a19c017c41a607952d00146a1e6e1ded1860cbca4924a8e1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\f3e4aada = 93aded88050a71e0082697a277a366f10141a2a0e79134fc4a84a6d4384a734c7eda4607fbb665cbd16c189529f1138be70cc35f4fb004bcb7db5316a7a8feec4e7feb45f894a141d0021d198bfabd615e7a643be822f4c6971e357c25f6a6d33b05810cf791343bf4ca147e9303cc6f10e3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\8eece550 = 008d9ac4384259d8631f30a7fc97197c8c0cfd7442dcd9e9fc2c79c45eb7a4a8503c01c2f6e933a934da72b4936d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\3cf527b = 1adeb9f3a63b9b546f457ad2f82e8516f270f08b6d6c79b816cd629cb8fb394ce7f75fd2e25716e369b4c0b239bba28b0db3756fb6f7e32b0f7bc91dbea1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeomheyr	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\7c863d8d = 64538abf4d64bf36717e848ee8030716cd4b5060543568b92b7f76a5abb0ba4aedb72e90dc9f8287df948c222927bf9c9b7db7860587fc75ade2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\4b58cdbf = 64905c710ac5992a5e632078c2a7d270c727c416db8ce73be0771f613f2c9c59dde731	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\36508235 = 9d88c7f4f1fa0406fb2a456e7ae1fd66b7795d7a69840e2b4fab556ed3b56f90c23f1bb6435549a2b168e49dfa8cf7e6dfe13cb2a665f28e9b39e81912cae57cfdfbd0c5aaf064	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\f1a58aa6 = 10d590802313cd5eff0d02bbd7641cbcd4609806bf1591	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeomheyr\7c863d8d = 64539dbf4d648a861f9c7b8bd470835d9a73257a9aa54bccd5750293efc01af46e844923048ce40e1a21a64afb0b3ec7c3a6bd85cffcdf6c394dda1dcc272647f48b4278772d6984cbcb71ee988d36	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1820 rundll32.exe
1952 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1820 rundll32.exe
1952 regsvr32.exe

pid	process
1820	rundll32.exe
1952	regsvr32.exe

pid	process
1820	rundll32.exe
1952	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1760 wrote to memory of 1820	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1820	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1820	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1820	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1820	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1820	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1820	1760	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 320	1820	rundll32.exe	explorer.exe
PID 1820 wrote to memory of 320	1820	rundll32.exe	explorer.exe
PID 1820 wrote to memory of 320	1820	rundll32.exe	explorer.exe
PID 1820 wrote to memory of 320	1820	rundll32.exe	explorer.exe
PID 1820 wrote to memory of 320	1820	rundll32.exe	explorer.exe
PID 1820 wrote to memory of 320	1820	rundll32.exe	explorer.exe
PID 320 wrote to memory of 1488	320	explorer.exe	schtasks.exe
PID 320 wrote to memory of 1488	320	explorer.exe	schtasks.exe
PID 320 wrote to memory of 1488	320	explorer.exe	schtasks.exe
PID 320 wrote to memory of 1488	320	explorer.exe	schtasks.exe
PID 1884 wrote to memory of 1916	1884	taskeng.exe	regsvr32.exe
PID 1884 wrote to memory of 1916	1884	taskeng.exe	regsvr32.exe
PID 1884 wrote to memory of 1916	1884	taskeng.exe	regsvr32.exe
PID 1884 wrote to memory of 1916	1884	taskeng.exe	regsvr32.exe
PID 1884 wrote to memory of 1916	1884	taskeng.exe	regsvr32.exe
PID 1916 wrote to memory of 1952	1916	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 1952	1916	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 1952	1916	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 1952	1916	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 1952	1916	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 1952	1916	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 1952	1916	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1336	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1336	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1336	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1336	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1336	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1336	1952	regsvr32.exe	explorer.exe
PID 1336 wrote to memory of 1740	1336	explorer.exe	reg.exe
PID 1336 wrote to memory of 1740	1336	explorer.exe	reg.exe
PID 1336 wrote to memory of 1740	1336	explorer.exe	reg.exe
PID 1336 wrote to memory of 1740	1336	explorer.exe	reg.exe
PID 1336 wrote to memory of 1776	1336	explorer.exe	reg.exe
PID 1336 wrote to memory of 1776	1336	explorer.exe	reg.exe
PID 1336 wrote to memory of 1776	1336	explorer.exe	reg.exe
PID 1336 wrote to memory of 1776	1336	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hitnpbk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll\"" /SC ONCE /Z /ST 01:02 /ET 01:14
4⤵
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\taskeng.exe
taskeng.exe {399311FA-EBEB-4DAB-AD2A-5ED44787E2AD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fubfu" /d "0"
5⤵
PID:1740

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Flxuavwdougc" /d "0"
5⤵
PID:1776

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll
MD5
51009756e0e3c09f93434f0a2ac60d42

SHA1
d25a86e5e5ca97bcb8cda78d877fc0daa4fec482

SHA256
2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607

SHA512
668cc6bfed18ef601b138017af783035db625bb448076bbcb2227850bbb3cd7c6a1e72652d600286e5b85170ef063ec77f804a34d143fb4d5d6edf0e42d3b0b1

Download Submit
\Users\Admin\AppData\Local\Temp\2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607.dll
MD5
51009756e0e3c09f93434f0a2ac60d42

SHA1
d25a86e5e5ca97bcb8cda78d877fc0daa4fec482

SHA256
2697e4f0730945c0ad4c70807ca9f186af2001922c2350554720a006cee54607

SHA512
668cc6bfed18ef601b138017af783035db625bb448076bbcb2227850bbb3cd7c6a1e72652d600286e5b85170ef063ec77f804a34d143fb4d5d6edf0e42d3b0b1

Download Submit
memory/320-61-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/320-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/320-63-0x00000000747A1000-0x00000000747A3000-memory.dmp

Filesize
8KB

Download
memory/1336-78-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1820-58-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/1820-60-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/1820-59-0x00000000002E0000-0x0000000000323000-memory.dmp

Filesize
268KB

Download
memory/1820-57-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/1820-54-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/1820-56-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/1820-55-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/1916-65-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmp

Filesize
8KB

Download
memory/1952-71-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1952-70-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1952-73-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1952-72-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1952-74-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1952-69-0x00000000009E0000-0x0000000000A80000-memory.dmp

Filesize
640KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads