qakbot | 80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83

General

Target

80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
Size

1.8MB
MD5

fd8ec77190e15c21b716fecf7cd0779c
SHA1

88b67d0f37e6a1ca9135e67188ec0471a8b89628
SHA256

80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83
SHA512

bae09d512043bd532d3d77825f471b7c20d4a0ce504b40d768c4df2c5de70de87efa3778f1ccca8347b44289fcbff178f5b6715ca1f0cee592cd731401733f9e

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1568 regsvr32.exe

pid	process
1568	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1480 schtasks.exe

pid	process
1480	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\99a771b5 = 9846c1b567f007a6bfb238e9cf11e2819ed234046f0bbba52b4a3749f65dcd9e409f6f45c16c780438ba5f2f4dc114cbacec9062cd206804e52f5116f241	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\235a36ac = be3c1ab37a8153208d9630d429bed31171b30dec482a4ebea47174b69791cd10cff4514f832be693eaef240fa9454599e0ec2874ceee0794f2e1bd8f10bf225fb36a66fceda2cd83ed098555382a8279b17e8c69db579aad9274	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\d130ee71 = 156e18a496f2430bb29daae14a7ee0636a15f06eb954	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\ae798187 = 09beaa505520cd1d7b4cb5bc1646322fc1ee24db34436eff897e231e45dffc475c8b50282cca8cbc004cfa664ed069745d23082fbacb283931d26aa73487a3df8c7ed44ac327131d49ab582f5cc6e0bf5a36bf	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\ae798187 = 09bebd505520f85a3a34e5a1d85d97e8dec6d9639b86351e3079278326011c20be8ec1cc65481a25513bbdaa8fbbd27de830d35a17a5324fce9294a01af0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\9be651c9 = f7f7e430ee67081b8207697f2bff5583bbcc3324e8a04a241348328cdc5c956b8c2cd02486d646c0a600559a7d7e0c43c3f820f5eb029efb0d35df00f941ca40ff106912c968b8d4ee9efbabfa0071f3314387624ae719364198a0f6f6b54fc1f279888fed4f065154e4a23347d2845363bf929f715ef49af013f30a639e16a03462c5885d49da7e7589dd0c4e469c6f5462d96bfb3b77dd0555380258bbe71fc02b677d0d8dec51df043f22b3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\211b16d0 = af5072307d4b1eac0e8f99f4ea8ac41f3eed71f281b10c9120145992b4e7455b6f748a45ade5c5c42e3fcda9c6f8a3ea5b5c099ef341f56d9cb2ca258b782860db3e7ab28f8a4a00df6468b285826d8072e357	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\5c13595a = 06d579e65be3f5bda13c5c9d8c0e3e3b3cad42e6c404fb7f35810f76d01c15836fb1ea9ca039789d04421047804127af91f09d9154edd9e3d44bb07ed23e64f3feba1527ffa5689a4b62a20bede179bdf06f28615f9a85ec610e6a395e7d4f499e0aebec174f49	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkmxazkneijl\e4af3e3f = fdc6948352eef2a67faadbefcd7c61e32d76a1d871b41c40ab53439c489e3d63a6a092cea780300d012a273f0376724b245c5889b6cdfb645c28c63cb592bb81dd7e7a91664ee35d202970b60cd7	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1556 regsvr32.exe
1568 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1556 regsvr32.exe
1568 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe
1568	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe
1556	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1272 wrote to memory of 1556	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1556	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1556	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1556	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1556	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1556	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1556	1272	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 436	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 436	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 436	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 436	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 436	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 436	1556	regsvr32.exe	explorer.exe
PID 436 wrote to memory of 1480	436	explorer.exe	schtasks.exe
PID 436 wrote to memory of 1480	436	explorer.exe	schtasks.exe
PID 436 wrote to memory of 1480	436	explorer.exe	schtasks.exe
PID 436 wrote to memory of 1480	436	explorer.exe	schtasks.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 268	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 268	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 268	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 268	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 268	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 268	1568	regsvr32.exe	explorer.exe
PID 268 wrote to memory of 2044	268	explorer.exe	reg.exe
PID 268 wrote to memory of 2044	268	explorer.exe	reg.exe
PID 268 wrote to memory of 2044	268	explorer.exe	reg.exe
PID 268 wrote to memory of 2044	268	explorer.exe	reg.exe
PID 268 wrote to memory of 1636	268	explorer.exe	reg.exe
PID 268 wrote to memory of 1636	268	explorer.exe	reg.exe
PID 268 wrote to memory of 1636	268	explorer.exe	reg.exe
PID 268 wrote to memory of 1636	268	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn glgomxl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll\"" /SC ONCE /Z /ST 17:02 /ET 17:14
4⤵
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\taskeng.exe
taskeng.exe {A9026602-2E1D-408F-8ECF-95719E97C52A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wljmzcag" /d "0"
5⤵
PID:2044

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ikddg" /d "0"
5⤵
PID:1636

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
MD5
fd8ec77190e15c21b716fecf7cd0779c

SHA1
88b67d0f37e6a1ca9135e67188ec0471a8b89628

SHA256
80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83

SHA512
bae09d512043bd532d3d77825f471b7c20d4a0ce504b40d768c4df2c5de70de87efa3778f1ccca8347b44289fcbff178f5b6715ca1f0cee592cd731401733f9e

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
d7ca733db48bf652ae864c06a068f49e

SHA1
455019ac67f1a234053dd6cdb6701b5b7a89ea46

SHA256
b976c07eea998443132677de0e2c4c5d1f4bd2a3dc6e664b6d73f4f67c39bcd6

SHA512
f4d3503e617a4a4d6dae8a6c67c558acc5131e93e333f2936906593b832abdbc4248069e9343746a8cade2671af94a67bafcf6b5823f779aaf71132f69e0756c

Download Submit
\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
MD5
fd8ec77190e15c21b716fecf7cd0779c

SHA1
88b67d0f37e6a1ca9135e67188ec0471a8b89628

SHA256
80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83

SHA512
bae09d512043bd532d3d77825f471b7c20d4a0ce504b40d768c4df2c5de70de87efa3778f1ccca8347b44289fcbff178f5b6715ca1f0cee592cd731401733f9e

Download Submit
memory/268-79-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/268-74-0x0000000000000000-mapping.dmp

Download
memory/436-60-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/436-61-0x0000000000000000-mapping.dmp

Download
memory/436-63-0x0000000073FD1000-0x0000000073FD3000-memory.dmp

Filesize
8KB

Download
memory/436-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1272-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/1328-66-0x0000000000000000-mapping.dmp

Download
memory/1480-65-0x0000000000000000-mapping.dmp

Download
memory/1556-59-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/1556-58-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1556-57-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1556-56-0x0000000000000000-mapping.dmp

Download
memory/1568-69-0x0000000000000000-mapping.dmp

Download
memory/1636-78-0x0000000000000000-mapping.dmp

Download
memory/2044-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads