qakbot | a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203

General

Target

a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll
Size

1.8MB
MD5

e8de1a621f8743238c9ce96cd91f58b8
SHA1

bc579c3ac95dc28a4575b6c27da4718763989509
SHA256

a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203
SHA512

97404dc8aa5701ae3189a8822876c14da81b0876e39c17050d871e774bbdc93b764f91bc61e9cffb1f292bb06324bcd8de1870ae5b89bc33d974b4af1b3a7c83

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3180 regsvr32.exe

pid	process
3180	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

684 schtasks.exe

pid	process
684	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\c1673d46 = efef8fccbfd822e5b065d317ce43e991fde9d8a7cd37cc41e2957e3f92023df11ae4d25ae261c7c46d46ef1b71eb5caa616ceb6692425eb6e9ffacf8d79efe073c61de6d2df9ae9e170ccf8b8afd446fe002edf0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\f6b9cd74 = 9401138de6b7d9e736bfd97f02c41813b3b586cac449f4b7756f805e82297eca81a31c35dba500b5e0ae33ded47ed39c2a3881b126b0cb43e7e7e051e4dd3f99a40e946ef4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\4e05aa11 = f2ac60831fc010730a9a4e344d2c9c9dc07288e4ee0a2a4d1471a700faad0d4cc25a90bcd5c25515b4feb503fe87313e67ca685e380833828fca22	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\8bb182fe = cf2a1bfc216e8b4a1b800b5c5f1bf2bddb3d6b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\be2e52b0 = 63b3c63186fc4f6075ff0454acbab5f1b73bc4d208ad533b98d7120ad8b781e905b24f9425f9c9586cd7f3d1e3dea4561b44db73d24b7853e33e182f2f16b5cd1132a8fa24bb9b702b2aefc62ee267049518	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\f4f8ed08 = a83cc9e63ddb3064e63639e48f322a53936f7c798bc42444323f6ed0fdec493e4e388b8d0c5d97e204288f4d88aa4fabcde9209b890bfedb133aa8afbd36e5526591b13e9b17a4b498e87ad99e3655e91b89b208d5794985ac0d515ceb946a891b51f568cc962f1f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\330de59b = 4c8b112eb7d71706423fa72605026b529f7748b2e47cfd3f9d4491b2a06ea70787b2e61faf9f3bc8444bccc88b5466b4bbc1e98e4453747cd3c3cc9bcf888933dbe760093fbba9b73ab8bf6d146f026c83438016b8c3622b295ac45b73c985aef7148446e77f2aec093eb85a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\4c448a6d = 627c958ec65363638333150479188cde04820fa6ca1b71eb012bfbd1ecf15935dc9fd0c2998425f4d88592164530af90a51cf2282d7ccd067f61f3694df3287837	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yxsttfpilio\c1673d46 = efef98ccbfd8177eae1354d9062a43c28071bef77914e669e4188be20c3854b47c109dad621f365cfbaeef52534694548fea29db295a6cd29cf647cee0a3cd6b698497cce39ab6d0caaf4e3012342038265943ca7f40698b765936922ebceeb4b14effd81779446741	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2636 regsvr32.exe
2636 regsvr32.exe
3180 regsvr32.exe
3180 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2636 regsvr32.exe
3180 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe
3180	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe
2636	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3460 wrote to memory of 2636	3460	regsvr32.exe	regsvr32.exe
PID 3460 wrote to memory of 2636	3460	regsvr32.exe	regsvr32.exe
PID 3460 wrote to memory of 2636	3460	regsvr32.exe	regsvr32.exe
PID 2636 wrote to memory of 912	2636	regsvr32.exe	explorer.exe
PID 2636 wrote to memory of 912	2636	regsvr32.exe	explorer.exe
PID 2636 wrote to memory of 912	2636	regsvr32.exe	explorer.exe
PID 2636 wrote to memory of 912	2636	regsvr32.exe	explorer.exe
PID 2636 wrote to memory of 912	2636	regsvr32.exe	explorer.exe
PID 912 wrote to memory of 684	912	explorer.exe	schtasks.exe
PID 912 wrote to memory of 684	912	explorer.exe	schtasks.exe
PID 912 wrote to memory of 684	912	explorer.exe	schtasks.exe
PID 1108 wrote to memory of 3180	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 3180	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 3180	1108	regsvr32.exe	regsvr32.exe
PID 3180 wrote to memory of 1184	3180	regsvr32.exe	explorer.exe
PID 3180 wrote to memory of 1184	3180	regsvr32.exe	explorer.exe
PID 3180 wrote to memory of 1184	3180	regsvr32.exe	explorer.exe
PID 3180 wrote to memory of 1184	3180	regsvr32.exe	explorer.exe
PID 3180 wrote to memory of 1184	3180	regsvr32.exe	explorer.exe
PID 1184 wrote to memory of 984	1184	explorer.exe	reg.exe
PID 1184 wrote to memory of 984	1184	explorer.exe	reg.exe
PID 1184 wrote to memory of 1140	1184	explorer.exe	reg.exe
PID 1184 wrote to memory of 1140	1184	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3460

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zgysoinc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll\"" /SC ONCE /Z /ST 06:18 /ET 06:30
4⤵
- Creates scheduled task(s)
PID:684

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Zydzi" /d "0"
4⤵
PID:984

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xihudzhraggn" /d "0"
4⤵
PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll
MD5
e8de1a621f8743238c9ce96cd91f58b8

SHA1
bc579c3ac95dc28a4575b6c27da4718763989509

SHA256
a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203

SHA512
97404dc8aa5701ae3189a8822876c14da81b0876e39c17050d871e774bbdc93b764f91bc61e9cffb1f292bb06324bcd8de1870ae5b89bc33d974b4af1b3a7c83

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
3f03800d1292d33b32e45efaedfb8df8

SHA1
1fa92b889709ac9d790b6dca55469be409b1cac0

SHA256
7f908743802855de183103f159533473a2cffbfa818a98d410765f744023e659

SHA512
1e7937896d164213f67520fe2a4bd621fcdce84743ca2adef75f8606d2f40124e6458e7f613bc7bdc7032841c81410c26be0b1bb53ff0ccc3fbae53806c5f5e4

Download Submit
\Users\Admin\AppData\Local\Temp\a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203.dll
MD5
e8de1a621f8743238c9ce96cd91f58b8

SHA1
bc579c3ac95dc28a4575b6c27da4718763989509

SHA256
a695f24e4266187d70e4513e8b41b6e63c18cdb8cb540f1883192cdd746ec203

SHA512
97404dc8aa5701ae3189a8822876c14da81b0876e39c17050d871e774bbdc93b764f91bc61e9cffb1f292bb06324bcd8de1870ae5b89bc33d974b4af1b3a7c83

Download Submit
memory/684-119-0x0000000000000000-mapping.dmp

Download
memory/912-120-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/912-121-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/912-122-0x0000000002DA0000-0x0000000002DC1000-memory.dmp

Filesize
132KB

Download
memory/912-118-0x0000000000000000-mapping.dmp

Download
memory/984-129-0x0000000000000000-mapping.dmp

Download
memory/1140-130-0x0000000000000000-mapping.dmp

Download
memory/1184-128-0x0000000000000000-mapping.dmp

Download
memory/1184-131-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/1184-132-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/1184-133-0x00000000026A0000-0x00000000026C1000-memory.dmp

Filesize
132KB

Download
memory/2636-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/2636-115-0x0000000000000000-mapping.dmp

Download
memory/2636-116-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3180-127-0x0000000000770000-0x000000000081E000-memory.dmp

Filesize
696KB

Download
memory/3180-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads