qakbot | 3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd

General

Target

3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
Size

1.8MB
MD5

421a451498a29469245236a0a5a5ce95
SHA1

31bbac052efbe319b3e7e0cb790ccf6db475afb6
SHA256

3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd
SHA512

798704198ec5a699492edc07122314f5e85c85bf034579707dcf7c71c27f51b53dde4438a83cdefb1be7a3bf0aedce3ff19a5f8d880e11853aec9f3876bcc4dc

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1332 regsvr32.exe

pid	process
1332	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1376 schtasks.exe

pid	process
1376	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\a96eae91 = fa218228fa7935ebdf2f4504173e6bce79fd2376c659590afe94877d5f5392b5e6174f9a21731f9194793d50081939e92f27e336aacf09292d02600f38dd3a8526c70dce15c676abd15293db	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Forrimdzu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\e3b81129 = 2b111c3a94b16b662a94cfaf79688b6b3bbd3a13b0ffaa392da962022f9bc832289a9615af7b5aaf35ecc0bf3424ec610ca78268935aab5cad03c30704603cd17d395aa9dcf9cb360d9342cf6b0855c6089cc9961942d73a20653eff0c1deb1554ad6eead1707e238d3ad60a56f9323ce8f0e9042848c76879e29f3d77dae3c393d84aeb7a81e44892e08002acc1d62f847fd7fbf5f7528255ddef2983098d376a6b452a72ff28cf0587097085f8599b631f5421ed2a757bb8ea9fc5a51e7f9f99674689b266e5dd112558	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\244d19ba = ad5b824902bce9cc79644a467e1e695781af31b289aa07813256a59da2996eca800cc766a30763c315636f0f67945408135734e46fb2e5af92	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\9cf17edf = 99d954d92c6956cfeb258a946cdd35d0b3f4bba6510a272185096f43bc274a9d6290a25a78acc055ebb79975efc51003c94431ec	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\5b04764c = 05b0083383429406c87d49bb810d36ab3eec22e8398c4210abcb2e39	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\d627c167 = 17406a9b0035e9ae77b7f65c04ef32f98755f722331d6bc650536e825faa69612476cac4445d5d2845945f4791e8d1e72fb75327b9205d37a8759884ab510fb41b20605d0d9fe78c8fd185ae8d1af20a1bbd4339a2a556a6ab6951db8a34298c59c4717b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\d627c167 = 17407d9b0035dc2e1f6d8c63ea1d14abcd517159dc9017d7982a188e6561b1d31b96d54a92400fe9548251513bf18a32ea90ca7fca5475a558354fa9a0c4bca77e132231de25a22e9b12b84af905c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\e1f93155 = a1221cda503f4db47c89ecf676b65dda71d012c22b0f5d5eb73cdaaaa59a929394b7760e96c149c33eeaf6a94d110e480f55	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Forrimdzu\59455630 = 5438f026f893f14b37c3dc0aa0a50e7c1c77002ce304244e755ab24af47f82826eb278fbcb4df9a1b9a66618e685f33ce96523951fc56b29094c2be5f37e947adc4e527a4c77fe233572acf41b3fd2e9f3362d3942e83c031158fd67019d7e8501	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1532 regsvr32.exe
1332 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1532 regsvr32.exe
1332 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe
1532	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1592 wrote to memory of 1532	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1532	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1532	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1532	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1532	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1532	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1532	1592	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 332	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 332	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 332	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 332	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 332	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 332	1532	regsvr32.exe	explorer.exe
PID 332 wrote to memory of 1376	332	explorer.exe	schtasks.exe
PID 332 wrote to memory of 1376	332	explorer.exe	schtasks.exe
PID 332 wrote to memory of 1376	332	explorer.exe	schtasks.exe
PID 332 wrote to memory of 1376	332	explorer.exe	schtasks.exe
PID 1488 wrote to memory of 1404	1488	taskeng.exe	regsvr32.exe
PID 1488 wrote to memory of 1404	1488	taskeng.exe	regsvr32.exe
PID 1488 wrote to memory of 1404	1488	taskeng.exe	regsvr32.exe
PID 1488 wrote to memory of 1404	1488	taskeng.exe	regsvr32.exe
PID 1488 wrote to memory of 1404	1488	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1016	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1016	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1016	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1016	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1016	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1016	1332	regsvr32.exe	explorer.exe
PID 1016 wrote to memory of 2036	1016	explorer.exe	reg.exe
PID 1016 wrote to memory of 2036	1016	explorer.exe	reg.exe
PID 1016 wrote to memory of 2036	1016	explorer.exe	reg.exe
PID 1016 wrote to memory of 2036	1016	explorer.exe	reg.exe
PID 1016 wrote to memory of 1932	1016	explorer.exe	reg.exe
PID 1016 wrote to memory of 1932	1016	explorer.exe	reg.exe
PID 1016 wrote to memory of 1932	1016	explorer.exe	reg.exe
PID 1016 wrote to memory of 1932	1016	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nswlosrafl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll\"" /SC ONCE /Z /ST 20:02 /ET 20:14
4⤵
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\taskeng.exe
taskeng.exe {45F693B0-B25E-47C4-8799-7413179AFE55} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Flybvnoejvah" /d "0"
5⤵
PID:2036

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Vfliwkwjkwb" /d "0"
5⤵
PID:1932

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
MD5
421a451498a29469245236a0a5a5ce95

SHA1
31bbac052efbe319b3e7e0cb790ccf6db475afb6

SHA256
3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd

SHA512
798704198ec5a699492edc07122314f5e85c85bf034579707dcf7c71c27f51b53dde4438a83cdefb1be7a3bf0aedce3ff19a5f8d880e11853aec9f3876bcc4dc

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
34da1061c618dd06b28c05306ab56289

SHA1
f27b13bc4baafd6c76eaae589efb5c6740b81366

SHA256
6b2d0758f99656288e77b357374401ee49b97bd6fd758cbd84478ab2b2890332

SHA512
e696a6441f97ed96fefb203a2b14d1011de4dd60b39a8dd58650d005fe930d8aa3795cd00fb111d7ca66756448a34adba84bd2d07b5fe7bdda414f8f9f309c14

Download Submit
\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
MD5
421a451498a29469245236a0a5a5ce95

SHA1
31bbac052efbe319b3e7e0cb790ccf6db475afb6

SHA256
3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd

SHA512
798704198ec5a699492edc07122314f5e85c85bf034579707dcf7c71c27f51b53dde4438a83cdefb1be7a3bf0aedce3ff19a5f8d880e11853aec9f3876bcc4dc

Download Submit
memory/332-59-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/332-60-0x0000000000000000-mapping.dmp

Download
memory/332-62-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/332-64-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1016-76-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1016-73-0x0000000000000000-mapping.dmp

Download
memory/1332-68-0x0000000000000000-mapping.dmp

Download
memory/1376-63-0x0000000000000000-mapping.dmp

Download
memory/1404-65-0x0000000000000000-mapping.dmp

Download
memory/1532-58-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/1532-57-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1532-56-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1532-55-0x0000000000000000-mapping.dmp

Download
memory/1592-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1932-78-0x0000000000000000-mapping.dmp

Download
memory/2036-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads