qakbot | acb339909ab1431c2275c5c53b2554b2020e235cfe28ecb5352589397bc8a3f1

General

Target

8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll
Size

628KB
MD5

2a1f3fdc3e33d35c6ec52194fc02c084
SHA1

d6d56c94bd7e81acddfa39250a8a351d08c8cad2
SHA256

8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa
SHA512

c8d8829be19ca10a8d8b21708d644d2e635dd08464132b83f0dbb83b3d70305eaf0c1c75fe7f2a96dd97291155c03692311d675abad7a46b8006edc2ef62f55b

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1416 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1696 schtasks.exe

pid	process
1416	regsvr32.exe

pid	process
1696	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\88849493 = 7a325923204901c361ef335ef97bcc064b5753354c621b5f17e38fc5a456ec441b24b319be515966093804c84ba6ecce6ffaabfa07d999dcc5178eee5e105648921694ad68125cd368eee7af75849e743081a501f848e893f4eb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\7aee4c4e = 5882bf254f5e9d85b1bcd0332909c686028c2262c8b639d843749ae53da49e2e63fc76c4b201b64ca948c523279081f26fee81eee9f60fa021648df101e9101fd7825b0048507c5e6a1f7448db5501	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kltuyboay	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\5a723b8 = 10cfeb0236d6d231ebb78a3918577efbefd7f7c69534bb4aa0510680209e6ad5cf612adcb2e9b610debfcb7bf77d830f6a58b11650b96825ed8fe146e97fd1045dd325bc2c9aa08c97926ed19926047bf6b11427c8209987124b1eed7dab3f09231454	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\3038f3f6 = 5c94ba3840f44fc2e40e9b6bd4272363db2ece2134cef9f04def01d0bbaa70e13695ac96fd610ab67714bf4069a18ce65cae3f6065052b7b4105ca401aa90f92dcee638ade4b12edc6bd2856e124c88ce347f39ee29b768831baf4078c70945feee29930db5eeed8505dbaa2a50a7b34	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\3279d38a = 03d19719b613d7d1a039ef258d3ce38da1ec13ebcee5b00d9762dbc6520f03b6765aeaad185ac5ddca26b0332d138d906be600a2d59d6fd9123d60fa18e29c316c9e4d14dfd68b0e4015e1d0e8943a7ffbb3d0aa3d83d0e99a045f2063571e105f5af8c0f6460710	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\f7cdfb65 = 9bdce72e65c517f36e6cb8af78794e64ad610aa07986905df0b2e35a5f9750b9cde412d78d27af942eba131a4281a03f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\4f719c00 = b59c0da366784b94ee98895b25d4cb05	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\5a723b8 = 10cffc0236d6e7015f9efb1f33c656a7d687aa4840daec81efa4cb6b06983f7a62c1df05f6c80d91bd8e545296e9b5907915077ab920ec27e241f6a753b93ceed93ad1f6d48347e721d75e02a5066517abb80b12ba36db1c837c545835251df6ae10b6ae86695ff6088c58c4b09b6a60e05bd30d1692eea4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kltuyboay\8ac5b4ef = 838d6807da4abc4171aa7529f2d9576d35a06ca8e791612682b786aabeb9ce5b852831d95204ca784732de828ee8d5b07721fe4a6c39cc160824f1f369781d04b4778a7f88d7c07fa8d022eb359ebf78ca46c2d3eeed87	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1064 rundll32.exe
1416 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1064 rundll32.exe
1416 regsvr32.exe

pid	process
1064	rundll32.exe
1416	regsvr32.exe

pid	process
1064	rundll32.exe
1416	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1888 wrote to memory of 1064	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1064	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1064	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1064	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1064	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1064	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1064	1888	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1500	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1500	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1500	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1500	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1500	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1500	1064	rundll32.exe	explorer.exe
PID 1500 wrote to memory of 1696	1500	explorer.exe	schtasks.exe
PID 1500 wrote to memory of 1696	1500	explorer.exe	schtasks.exe
PID 1500 wrote to memory of 1696	1500	explorer.exe	schtasks.exe
PID 1500 wrote to memory of 1696	1500	explorer.exe	schtasks.exe
PID 984 wrote to memory of 1776	984	taskeng.exe	regsvr32.exe
PID 984 wrote to memory of 1776	984	taskeng.exe	regsvr32.exe
PID 984 wrote to memory of 1776	984	taskeng.exe	regsvr32.exe
PID 984 wrote to memory of 1776	984	taskeng.exe	regsvr32.exe
PID 984 wrote to memory of 1776	984	taskeng.exe	regsvr32.exe
PID 1776 wrote to memory of 1416	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1416	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1416	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1416	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1416	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1416	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1416	1776	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 1572	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1572	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1572	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1572	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1572	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1572	1416	regsvr32.exe	explorer.exe
PID 1572 wrote to memory of 1376	1572	explorer.exe	reg.exe
PID 1572 wrote to memory of 1376	1572	explorer.exe	reg.exe
PID 1572 wrote to memory of 1376	1572	explorer.exe	reg.exe
PID 1572 wrote to memory of 1376	1572	explorer.exe	reg.exe
PID 1572 wrote to memory of 864	1572	explorer.exe	reg.exe
PID 1572 wrote to memory of 864	1572	explorer.exe	reg.exe
PID 1572 wrote to memory of 864	1572	explorer.exe	reg.exe
PID 1572 wrote to memory of 864	1572	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fkfnnlbcau /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll\"" /SC ONCE /Z /ST 14:20 /ET 14:32
4⤵
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\taskeng.exe
taskeng.exe {D3D51229-CB73-4117-9468-38091787190D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hiiiuhoif" /d "0"
5⤵
PID:1376

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ilajm" /d "0"
5⤵
PID:864

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll
MD5
2a1f3fdc3e33d35c6ec52194fc02c084

SHA1
d6d56c94bd7e81acddfa39250a8a351d08c8cad2

SHA256
8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa

SHA512
c8d8829be19ca10a8d8b21708d644d2e635dd08464132b83f0dbb83b3d70305eaf0c1c75fe7f2a96dd97291155c03692311d675abad7a46b8006edc2ef62f55b

Download Submit
\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll
MD5
2a1f3fdc3e33d35c6ec52194fc02c084

SHA1
d6d56c94bd7e81acddfa39250a8a351d08c8cad2

SHA256
8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa

SHA512
c8d8829be19ca10a8d8b21708d644d2e635dd08464132b83f0dbb83b3d70305eaf0c1c75fe7f2a96dd97291155c03692311d675abad7a46b8006edc2ef62f55b

Download Submit
memory/1064-55-0x0000000000800000-0x00000000008A0000-memory.dmp

Filesize
640KB

Download
memory/1064-56-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1064-57-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1064-58-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1064-59-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1064-60-0x00000000001E0000-0x0000000000223000-memory.dmp

Filesize
268KB

Download
memory/1064-61-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1064-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/1416-72-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1416-70-0x0000000000A20000-0x0000000000AC0000-memory.dmp

Filesize
640KB

Download
memory/1416-71-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1416-74-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1416-73-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1416-79-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1416-78-0x00000000002D0000-0x0000000000313000-memory.dmp

Filesize
268KB

Download
memory/1500-65-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1500-64-0x0000000074271000-0x0000000074273000-memory.dmp

Filesize
8KB

Download
memory/1500-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1572-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1776-66-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads