qakbot | e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884

General

Target

e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll
Size

1.8MB
MD5

3293dbd446a77c00bbd6088034d70b6c
SHA1

66410a5a2555787689aadaa426b22287c2d37f92
SHA256

e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884
SHA512

d5b699360284f524747123d3cecd3054d61c27ebda7dcf4a95700bf7c12eaddcd590028bf18073ff2f1bb2830d0eb297ff15cbad0d6dcda9276907cca2966bc3

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

384 regsvr32.exe

pid	process
384	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3964 schtasks.exe

pid	process
3964	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\e68ccdc9 = 31adfdc4f2457d7d5d02084ad05f6797e4f173eb3f607c17e7ba56829171ee7aec2b1fca31a98b97827c3e75ce5bb5200b76f56b3ddb836a040033f460325b73349b2a7c8874c65bf6e7fa378b1533b196f0a3a895a346b70c065f2ae1177ac69c296a559cbda5164638d989bae8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\d1523dfb = 81377b5284dc0a36ebd54d72f5a196d2ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\69ee5a9e = 661a02d59e11d5408cbce5eab99017e6b7a61a28de6c7a07e0ad7fc064d968c51657f761a70f8a3840d68ee57222561f835315bf8c5d7d220c50ef52852568ef057de15c4a04113546c27854350098d4075aac4d58fefe31f7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\99c5a23f = d45b789153f1a4af6e618fdeb01d5baf477f4c13	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\14e61514 = 816f36e51ce09aa223db17a190ed12a44de927cf4ce5993e15171175d204ee78e191768a3a9d2fe0b061e82ee32877a3a3673f33302a5ec169a5dd29a30585a75ba688c8af8207b7ceecc06d2e82d5b744e1348b20f944b7917b300df9693a09ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\ac5a7271 = 56cd261d9838c79355356f6b1d87eef41da8edd6751abdeb4a15db731f970a74d2792de8c0ea59d89c24902db8086535	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\6baf7ae2 = bd14a801f2d3a814b42261643b50b49b34e8f6ac2b898d57684ab43ee8e4ef80e785764a23509adebaf1c66fb4fe89efb685c0d6d485d1fd395eb456854660dd345bc26a9a45cb71219f743e2266836d3027c9edd65a14b66004b80bb9bc05363948ef2f7b67f3e12e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\e68ccdc9 = 31adeac4f24548c0624c9db5a1f832824f7061c8c4fd6ff219a09b539f9995a029be3f2f9491fe591aba6ba0ee58b5c54611cfa6e59ec7595e053f193ddbd75f229ab3fe78a7fee4b9f9ac5c8ca575fe6151a9012875d1ebfc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jwsiyjwawagxe\d3131d87 = 53d103445c6758f6423c54105ee2c63b4f0bee0e8669d8b2389f4ed9b16b30c9bf5b85810371d5381b6b3acec3fed37273f82228d443be3b8e077ef5de42e8d3f208d7498c3d00bbd941abe67d1bdc51bd739ea0208c2d65bf90c1d63dcae8f1b309b31a202cf145c52189	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3064 regsvr32.exe
3064 regsvr32.exe
384 regsvr32.exe
384 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3064 regsvr32.exe
384 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe
384	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2720 wrote to memory of 3064	2720	regsvr32.exe	regsvr32.exe
PID 2720 wrote to memory of 3064	2720	regsvr32.exe	regsvr32.exe
PID 2720 wrote to memory of 3064	2720	regsvr32.exe	regsvr32.exe
PID 3064 wrote to memory of 3848	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 3848	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 3848	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 3848	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 3848	3064	regsvr32.exe	explorer.exe
PID 3848 wrote to memory of 3964	3848	explorer.exe	schtasks.exe
PID 3848 wrote to memory of 3964	3848	explorer.exe	schtasks.exe
PID 3848 wrote to memory of 3964	3848	explorer.exe	schtasks.exe
PID 884 wrote to memory of 384	884	regsvr32.exe	regsvr32.exe
PID 884 wrote to memory of 384	884	regsvr32.exe	regsvr32.exe
PID 884 wrote to memory of 384	884	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 1448	384	regsvr32.exe	explorer.exe
PID 384 wrote to memory of 1448	384	regsvr32.exe	explorer.exe
PID 384 wrote to memory of 1448	384	regsvr32.exe	explorer.exe
PID 384 wrote to memory of 1448	384	regsvr32.exe	explorer.exe
PID 384 wrote to memory of 1448	384	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1236	1448	explorer.exe	reg.exe
PID 1448 wrote to memory of 1236	1448	explorer.exe	reg.exe
PID 1448 wrote to memory of 2832	1448	explorer.exe	reg.exe
PID 1448 wrote to memory of 2832	1448	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yuhdqlf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll\"" /SC ONCE /Z /ST 19:03 /ET 19:15
4⤵
- Creates scheduled task(s)
PID:3964

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Rayvnlzbva" /d "0"
4⤵
PID:1236

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Kamuu" /d "0"
4⤵
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll
MD5
3293dbd446a77c00bbd6088034d70b6c

SHA1
66410a5a2555787689aadaa426b22287c2d37f92

SHA256
e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884

SHA512
d5b699360284f524747123d3cecd3054d61c27ebda7dcf4a95700bf7c12eaddcd590028bf18073ff2f1bb2830d0eb297ff15cbad0d6dcda9276907cca2966bc3

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
b5a1711c9c1bda5e0aaf381977ad02ae

SHA1
10a51e6bf43b16ed2f277aa92385c3bdf5ce89ed

SHA256
374f75419e37d8a7e4d7fcd59cc1fc15199f5625994f73f72dd3504af1caf146

SHA512
9fd58aca59d3c8e9f08a9a6c41e221dc57c130005606e45e7e7a7ac74c3815836040b4e1fab877adcf7e2c2ffaccb77452fb9968e5cfe624a4f546a7f7f56b69

Download Submit
\Users\Admin\AppData\Local\Temp\e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884.dll
MD5
3293dbd446a77c00bbd6088034d70b6c

SHA1
66410a5a2555787689aadaa426b22287c2d37f92

SHA256
e3bd055c72e253d86dc95a25c64132f60d6fa87f7e94777993c240f423c7a884

SHA512
d5b699360284f524747123d3cecd3054d61c27ebda7dcf4a95700bf7c12eaddcd590028bf18073ff2f1bb2830d0eb297ff15cbad0d6dcda9276907cca2966bc3

Download Submit
memory/384-128-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/384-125-0x0000000000000000-mapping.dmp

Download
memory/1236-130-0x0000000000000000-mapping.dmp

Download
memory/1448-129-0x0000000000000000-mapping.dmp

Download
memory/1448-134-0x0000000002550000-0x0000000002571000-memory.dmp

Filesize
132KB

Download
memory/1448-133-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/1448-132-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/2832-131-0x0000000000000000-mapping.dmp

Download
memory/3064-117-0x0000000003040000-0x00000000030EE000-memory.dmp

Filesize
696KB

Download
memory/3064-116-0x0000000000000000-mapping.dmp

Download
memory/3064-118-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/3848-120-0x0000000002AA0000-0x0000000002AC1000-memory.dmp

Filesize
132KB

Download
memory/3848-119-0x0000000000000000-mapping.dmp

Download
memory/3848-123-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/3848-122-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/3964-121-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads