qakbot | 3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd

General

Target

3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
Size

1.8MB
MD5

421a451498a29469245236a0a5a5ce95
SHA1

31bbac052efbe319b3e7e0cb790ccf6db475afb6
SHA256

3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd
SHA512

798704198ec5a699492edc07122314f5e85c85bf034579707dcf7c71c27f51b53dde4438a83cdefb1be7a3bf0aedce3ff19a5f8d880e11853aec9f3876bcc4dc

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1544 regsvr32.exe

pid	process
1544	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1312 schtasks.exe

pid	process
1312	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\a1510fee = 7e486f426560f9578ab5532c38ec09a9c5f67752b530611d3a9e184437727252921cd1339de8c9b276e5af5f7e97d384b97e242ed3251f7a720be72ba9ec29f46a5df546f85a21ae973b267f5b0f905b99da766d475d5a3a42957bbee4aa23bc15d419d2a8	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\de186018 = 39576b4c95d2d170fc9378a6beb133	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\e9c6902a = b2544e55b83dc9105e7f429fe9675e9a6341e93f1e9434d084c2df9f0a73435af83779a27f451b9ea46099397347f016d5cf93cc17b349b1e2ae39b0497bc5413d91864d8e2ff923895485fb9a49b7ebf6726c5a69d189ae416df0ebad416286e2dba2ac043f47d514034cf777	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\533bd733 = 0f6fdff698a42de4f6dfc0dc80671c6a8f2699f314f0fd7e048c11a4919ac8e66edc6dc35af425c8cc5cf5d241b6deb2647f92149925521f3631d9d58d6224428aa80b3942f9f20b7edafa432738a64bb42e72c1a6a24687b99ed2123783b2bd7f18105ac2c148f4326d6048	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\de186018 = 39577c4c95d2e410d47f86e92c232b46682f68f8cdc20d46f7407f884fbcd7d57874bf25	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\eb87b056 = f4b50f6ff596a3386356cacd745ec2f08c58df981fe19930cc226b7dc621f5e8c56198c32cef9141e5a6d628fbb93ae20772b9fe3d05ebc5f4eeccd1104e46448b52021194ec5a8b9ff4ec296d8082714277e691837f55c8534f758badafe873dd12fdddb54e59005b5d8e516fea5635bdb36c8406754574db93555aa73679a87b8dfb52551520dc4867691eb6b9b2d8823ac2de36562a281829da4cf6d5934cb4e430a3e498c3263e89e78f4034f7ab62a9b4a8bc84146368d34188cabbd7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\517af74f = e3c22fa20b58f865573ac9d322dbc251798830838ec7536c07d73f0e1091a55e66ffa748bb03626d6006b3763ab43c83bbe1535fc068d713fc151713b9a0a63cfd95ea93c80c6936bdc768c2f8eabc35096ad93f68	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\2c72b8c5 = 245ecb340223f7e5c8b84c46ab3b5bcc7c58ea11975d0cc64b15d530d263e06197b1c077dbcd5b3c00b788a1a784bdab81324355ed53f7a05dd3f47438920e4a07b1e5091eb3b18850361295e53e925ab38c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tbiigwoybouy\94cedfa0 = bf45b18fb3c949086199b3eb7bb36610fefc359266bb9a175ae8b30dd18480408e588349feda35e9cb286bcf79579a4190e01bc57e244fddcf6dbf28ce6b21461fe2e0fc64cc6047	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3052 regsvr32.exe
3052 regsvr32.exe
1544 regsvr32.exe
1544 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3052 regsvr32.exe
1544 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe
1544	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe
3052	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 692 wrote to memory of 3052	692	regsvr32.exe	regsvr32.exe
PID 692 wrote to memory of 3052	692	regsvr32.exe	regsvr32.exe
PID 692 wrote to memory of 3052	692	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 804	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 804	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 804	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 804	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 804	3052	regsvr32.exe	explorer.exe
PID 804 wrote to memory of 1312	804	explorer.exe	schtasks.exe
PID 804 wrote to memory of 1312	804	explorer.exe	schtasks.exe
PID 804 wrote to memory of 1312	804	explorer.exe	schtasks.exe
PID 1864 wrote to memory of 1544	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1544	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1544	1864	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 736	1544	regsvr32.exe	explorer.exe
PID 1544 wrote to memory of 736	1544	regsvr32.exe	explorer.exe
PID 1544 wrote to memory of 736	1544	regsvr32.exe	explorer.exe
PID 1544 wrote to memory of 736	1544	regsvr32.exe	explorer.exe
PID 1544 wrote to memory of 736	1544	regsvr32.exe	explorer.exe
PID 736 wrote to memory of 2720	736	explorer.exe	reg.exe
PID 736 wrote to memory of 2720	736	explorer.exe	reg.exe
PID 736 wrote to memory of 1512	736	explorer.exe	reg.exe
PID 736 wrote to memory of 1512	736	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kcdcvtsnc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll\"" /SC ONCE /Z /ST 03:27 /ET 03:39
4⤵
- Creates scheduled task(s)
PID:1312

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ezrqur" /d "0"
4⤵
PID:2720

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Apwqikagmre" /d "0"
4⤵
PID:1512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
MD5
421a451498a29469245236a0a5a5ce95

SHA1
31bbac052efbe319b3e7e0cb790ccf6db475afb6

SHA256
3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd

SHA512
798704198ec5a699492edc07122314f5e85c85bf034579707dcf7c71c27f51b53dde4438a83cdefb1be7a3bf0aedce3ff19a5f8d880e11853aec9f3876bcc4dc

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
e3c2679fa75859f50387edd17b5eb5df

SHA1
98b8f3f4234d038ce472e6fb151520d2d7d574f8

SHA256
6a6091645bb7d2df4c4f1f5397b4f0620f7f2544bd82e802f7cfdf780a8284df

SHA512
aafbf5c2b312610ef07d6169c4c71025b5cf6557579f2bdd4d62cb104100a2f8b687ba34187d4df507cb4619e31d572c60c45c46c4f2734d4c82a8b6f8441f5a

Download Submit
\Users\Admin\AppData\Local\Temp\3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd.dll
MD5
421a451498a29469245236a0a5a5ce95

SHA1
31bbac052efbe319b3e7e0cb790ccf6db475afb6

SHA256
3c4ae021bc6b9905bf33554beb883ce09639b96285c96ada0323fde491437ebd

SHA512
798704198ec5a699492edc07122314f5e85c85bf034579707dcf7c71c27f51b53dde4438a83cdefb1be7a3bf0aedce3ff19a5f8d880e11853aec9f3876bcc4dc

Download Submit
memory/736-134-0x0000000003210000-0x0000000003231000-memory.dmp

Filesize
132KB

Download
memory/736-132-0x0000000003A70000-0x0000000003A71000-memory.dmp

Filesize
4KB

Download
memory/736-133-0x0000000003A70000-0x0000000003A71000-memory.dmp

Filesize
4KB

Download
memory/736-129-0x0000000000000000-mapping.dmp

Download
memory/804-121-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/804-123-0x0000000003210000-0x0000000003231000-memory.dmp

Filesize
132KB

Download
memory/804-122-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/804-119-0x0000000000000000-mapping.dmp

Download
memory/1312-120-0x0000000000000000-mapping.dmp

Download
memory/1512-131-0x0000000000000000-mapping.dmp

Download
memory/1544-125-0x0000000000000000-mapping.dmp

Download
memory/1544-128-0x0000000002A00000-0x0000000002B4A000-memory.dmp

Filesize
1.3MB

Download
memory/2720-130-0x0000000000000000-mapping.dmp

Download
memory/3052-116-0x0000000000000000-mapping.dmp

Download
memory/3052-118-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/3052-117-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads