qakbot | 4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021

General

Target

4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll
Size

1.8MB
MD5

bbb43912a056489c72e2d1bd3bf88a95
SHA1

cab48f0d058feb68de923781929e6f3f3d935b7f
SHA256

4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021
SHA512

3ca53f3ef71d2d6af87cacbb7356fd4cb588f3b8b3c3f7d947c6c1297e2402b806cbbb537d4bb75990151d459a5a6f4be44fd656b76d72daa6c5a23581b3ab14

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1096 regsvr32.exe

pid	process
1096	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

764 schtasks.exe

pid	process
764	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\b40f756a = 33b12f52dd1b97cd717b8d6ad4d7030d8378165d60e632df1f6e91c543594756c9e13d20f508633e8eaa92eb8623a4365f97940389b12b99f6304671501a63742a5c0a6ece66af83f086cf503940	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\cb3120f = 33172a45bd57be9ab76559c8071510f3811fc5e869ca691a2a264a71ff088be127215fcebc7feaf741ad4ea4d99d8a28a1708d4b9c446100c5243710a10a676a75d5dcc4ec5400444591a5ec04ffa25b80165dfe7cc0ccfb090aca2df5e7af0a4d77ca079e327808	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\c9073ae0 = 162abec81e0c4e61298ad16e32695e1a312f3c288b1ae86592014068d86674d4d819bf8a6edf97eeac9aa26fb6d35aa4b13842e84bf8b4cd0c987c6693d1ca862b4b542ab1640a7d5d14d1325200a8fa90319721efb709d36669df6d27ce94b6136175c3ff	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\fc98eaae = dd76e0807ad30755ffec5942af7e6291cfcfb8c0c4c411e9879f56eb9a0cad214c19ad162e7f52ea821d17ceb2f8b6c6578a6a9d410fa958de64d63ca0f6586970267789295981b348be2dcc2dbdc76cdcbe71d396cb0f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\b64e5516 = 0567eda2a2a1c4e2e0e06a0baf80071b4f0c62eeaa3698b0431e320b7287890699458d7220113456d92c23328f85aa03277e273e9ab21589d944b673d9ed5b221ebfd30f81dcd4a10d3f5847b827769e5dfff4a1bd1b87e149146d8aaac8f1df3d96def87de3bfcb60404e060f5aeb3e1bd252f37abab252c6ad694ce693cb087643314c296b94788746d224b2880936f53b649ddedc46178f6ee8029720a276c86f6d1473c8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\71bb5d85 = 2ee4318e07755ed69544ade10ce092302a3628cea8ffc60e34bed5ad4a13ebb7293b25adddf96b28c9b18973d1405dde57632add81afebdf51d61a479d84ad9c0951e913bc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\ef23273 = 85973a5eafe72704d1c28b416bbc0257d9b7ee295dbd5cb49d95e3abb98b0ca19256880cdf2b9ea48d8114bb807d4cde4a9e4fb9e4b1c7d1aec24147d32c2ee149e456c85ea1eeb5c5c6ab11a875ff	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\83d18558 = e38b51527a242a9161d918cec7cd3d6b26226e4b85a6e5f1f598752c09d0707f12345eaa216ed21acb2ccb47d4efc0fa06e65620a7e7eb594bd6391cb0cac26b70cbe55fb73a8c1c553d2c98307b97b02f61a8f48f8b9f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipsdhgbpvgs\83d18558 = e38b46527a241f6af8e800b25aebeccbb3fe49152f1192e5f6353d5e42347aa5a0f022d0890405372594dee36870c8c830213e4f0d34df5794700de9b5391ca88886	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3780 regsvr32.exe
3780 regsvr32.exe
1096 regsvr32.exe
1096 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3780 regsvr32.exe
1096 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe
1096	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe
3780	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3544 wrote to memory of 3780	3544	regsvr32.exe	regsvr32.exe
PID 3544 wrote to memory of 3780	3544	regsvr32.exe	regsvr32.exe
PID 3544 wrote to memory of 3780	3544	regsvr32.exe	regsvr32.exe
PID 3780 wrote to memory of 624	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 624	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 624	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 624	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 624	3780	regsvr32.exe	explorer.exe
PID 624 wrote to memory of 764	624	explorer.exe	schtasks.exe
PID 624 wrote to memory of 764	624	explorer.exe	schtasks.exe
PID 624 wrote to memory of 764	624	explorer.exe	schtasks.exe
PID 1556 wrote to memory of 1096	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1096	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1096	1556	regsvr32.exe	regsvr32.exe
PID 1096 wrote to memory of 896	1096	regsvr32.exe	explorer.exe
PID 1096 wrote to memory of 896	1096	regsvr32.exe	explorer.exe
PID 1096 wrote to memory of 896	1096	regsvr32.exe	explorer.exe
PID 1096 wrote to memory of 896	1096	regsvr32.exe	explorer.exe
PID 1096 wrote to memory of 896	1096	regsvr32.exe	explorer.exe
PID 896 wrote to memory of 3944	896	explorer.exe	reg.exe
PID 896 wrote to memory of 3944	896	explorer.exe	reg.exe
PID 896 wrote to memory of 1208	896	explorer.exe	reg.exe
PID 896 wrote to memory of 1208	896	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn levbvrep /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll\"" /SC ONCE /Z /ST 06:18 /ET 06:30
4⤵
- Creates scheduled task(s)
PID:764

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Znmozup" /d "0"
4⤵
PID:3944

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Daohuwmbg" /d "0"
4⤵
PID:1208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll
MD5
bbb43912a056489c72e2d1bd3bf88a95

SHA1
cab48f0d058feb68de923781929e6f3f3d935b7f

SHA256
4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021

SHA512
3ca53f3ef71d2d6af87cacbb7356fd4cb588f3b8b3c3f7d947c6c1297e2402b806cbbb537d4bb75990151d459a5a6f4be44fd656b76d72daa6c5a23581b3ab14

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
374d0bfa420da20c44d00ed98076dbcc

SHA1
7c4d85af20f24e3e4e9cb09b60b29250265287ba

SHA256
19353b2c82318a401088d8f12c97548b80163c5ffc317d271b6c1ee1e48292bf

SHA512
12258c9e36548a0fc5517a987a77a2071370a88f559910ce9a9262337c642bf3685d37585bb3172b4e3de9bd0d04f23f0ff47f7b76099829d662d695d87c9eac

Download Submit
\Users\Admin\AppData\Local\Temp\4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021.dll
MD5
bbb43912a056489c72e2d1bd3bf88a95

SHA1
cab48f0d058feb68de923781929e6f3f3d935b7f

SHA256
4f05dead9fed88cae228de29b170ef42b5657e8587dcd4f8611ad9c26a744021

SHA512
3ca53f3ef71d2d6af87cacbb7356fd4cb588f3b8b3c3f7d947c6c1297e2402b806cbbb537d4bb75990151d459a5a6f4be44fd656b76d72daa6c5a23581b3ab14

Download Submit
memory/624-119-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/624-118-0x0000000000000000-mapping.dmp

Download
memory/624-121-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/624-122-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/764-120-0x0000000000000000-mapping.dmp

Download
memory/896-128-0x0000000000980000-0x00000000009A1000-memory.dmp

Filesize
132KB

Download
memory/896-127-0x0000000000000000-mapping.dmp

Download
memory/896-131-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/896-132-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/1096-124-0x0000000000000000-mapping.dmp

Download
memory/1208-130-0x0000000000000000-mapping.dmp

Download
memory/3780-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/3780-116-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/3780-115-0x0000000000000000-mapping.dmp

Download
memory/3944-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads