qakbot | 1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd

General

Target

1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll
Size

1.8MB
MD5

18395aac0377ac8ce575344f6717bcb9
SHA1

f5af9d161d5369fb0270a671d5505805a3140204
SHA256

1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd
SHA512

ac3a524b37a396b878ee131704213e32cf14044892ab49cae9ce8a4721dfb28e590787d03e5b93bd1b0706d762e95557c48827c29521b130ed2983d540a31868

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1828 regsvr32.exe

pid	process
1828	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1456 schtasks.exe

pid	process
1456	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\95737339 = 9dea42001c7bfdfc76f095296b6e9a1fb56d27d67ed389934823f09991ed742f1c43a3fe3a57c5119c979ad3b1c203acfa2a59f159b6a9cdedd1c1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\a2ad830b = 2a4f4fbc6c593d67298c7fef1c16026b42d5b3e18b1cc6e7860d6feb9e54bdbe97f73ae98e4be3c07f69e794c1c1c1472ff7b6ccf9a66b7969d08b1e7a7d94710689fb42f2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\dfa5cc81 = 0ff40d225f2319afdb8a38a005f69be57af7765522419a4272351c887630cfac08af082751eaa40f47b7e27be6b96cc41b864103d9ba633f4ac0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\ea3a1ccf = 4f0e8800b6c42ee1e2734b21534f7b3491d70809435a7a3924dc0292dc3e0426908bf175c98e99dcc48db1ab5d1b0fbaa32bc45654a1288c70d01fa741	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\1850c412 = 1c6ff50554fc4a81c8c23344f206fa6e089ddf5675eaa59ab898626e5b429bb7cc15c14cdd5d4cd1e7afbf8c5f22c34aa1d26c10d37295b1156c904cb492f2fff414e160130cb8f6171386a531277ddba88c9c33	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\95737339 = 9dea55001c7bc80ed983ae7ce0d00e5f5c79ffc11e0dc4964aa37a2483937d4642a03fb7a717	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\a0eca377 = eeb89c0a8d6ea66341546875def83f34604f04ddb8547eef2b3d6296bddbbdcd0573b679e1f004218fd2422a36a32307b2dc7c4cee232f531cdf65042120a70d04371a1d70636b0cf6fa284517311eaa85185662cf4ee31d32d74cbd63550a6438bff81f0de3caacae37	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\1a11e46e = a3c746e27a37db7aba351572020218a9dd8a5e25fb2da8c624cd328ff92a9d6ba9400ec7985e56856c97f40067a46586969a9e31d7e70461d018cb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwjbakvouye\6719abe4 = 1c8645f7899d49dec429435c7dd5e61684258c73ecec59c472681f1319e228833d8d49c0db5e61a7cb9754d2ffab1e5e9e4170922cc863cac8cbfcd6	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1580 regsvr32.exe
1828 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1580 regsvr32.exe
1828 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe
1580	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 968 wrote to memory of 1580	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1580	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1580	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1580	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1580	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1580	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1580	968	regsvr32.exe	regsvr32.exe
PID 1580 wrote to memory of 572	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 572	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 572	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 572	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 572	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 572	1580	regsvr32.exe	explorer.exe
PID 572 wrote to memory of 1456	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1456	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1456	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1456	572	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 1448	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 1448	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 1448	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 1448	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 1448	1508	taskeng.exe	regsvr32.exe
PID 1448 wrote to memory of 1828	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1828	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1828	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1828	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1828	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1828	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1828	1448	regsvr32.exe	regsvr32.exe
PID 1828 wrote to memory of 1736	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1736	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1736	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1736	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1736	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1736	1828	regsvr32.exe	explorer.exe
PID 1736 wrote to memory of 452	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 452	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 452	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 452	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 1976	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 1976	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 1976	1736	explorer.exe	reg.exe
PID 1736 wrote to memory of 1976	1736	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bymwxkgvlr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll\"" /SC ONCE /Z /ST 18:32 /ET 18:44
4⤵
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\taskeng.exe
taskeng.exe {3F1C9469-6F49-4013-9AA1-F052686C18C4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oqkylrdzvna" /d "0"
5⤵
PID:452

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nutietnzxut" /d "0"
5⤵
PID:1976

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll
MD5
18395aac0377ac8ce575344f6717bcb9

SHA1
f5af9d161d5369fb0270a671d5505805a3140204

SHA256
1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd

SHA512
ac3a524b37a396b878ee131704213e32cf14044892ab49cae9ce8a4721dfb28e590787d03e5b93bd1b0706d762e95557c48827c29521b130ed2983d540a31868

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
c53a8e5c79da2521fe536b7e802ec824

SHA1
a84f5150a164082367a17956c8cc42546df339de

SHA256
043d4e57d809ff7132f49ac770ac62b3b342370864ea691af55701fb239e5327

SHA512
df38bbda817fa080864774c6efab8e01ca6b5695d5494a6d23e5c7123a9e7b4dd5efdcb2f36755c4a9a6f6187c89aab92c1ccb21ed9bfe87e88c6e4ba9972c12

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd.dll
MD5
18395aac0377ac8ce575344f6717bcb9

SHA1
f5af9d161d5369fb0270a671d5505805a3140204

SHA256
1992d7aa88249b15f7ba0936e1656cdd9aaf0fec81346afa8dc363c11293addd

SHA512
ac3a524b37a396b878ee131704213e32cf14044892ab49cae9ce8a4721dfb28e590787d03e5b93bd1b0706d762e95557c48827c29521b130ed2983d540a31868

Download Submit
memory/452-78-0x0000000000000000-mapping.dmp

Download
memory/572-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/572-60-0x0000000000000000-mapping.dmp

Download
memory/572-62-0x0000000074201000-0x0000000074203000-memory.dmp

Filesize
8KB

Download
memory/572-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/968-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Filesize
8KB

Download
memory/1448-65-0x0000000000000000-mapping.dmp

Download
memory/1456-63-0x0000000000000000-mapping.dmp

Download
memory/1580-58-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/1580-57-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1580-56-0x0000000074F11000-0x0000000074F13000-memory.dmp

Filesize
8KB

Download
memory/1580-55-0x0000000000000000-mapping.dmp

Download
memory/1736-73-0x0000000000000000-mapping.dmp

Download
memory/1736-77-0x00000000003B0000-0x00000000003D1000-memory.dmp

Filesize
132KB

Download
memory/1828-68-0x0000000000000000-mapping.dmp

Download
memory/1976-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads