qakbot | 80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83

General

Target

80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
Size

1.8MB
MD5

fd8ec77190e15c21b716fecf7cd0779c
SHA1

88b67d0f37e6a1ca9135e67188ec0471a8b89628
SHA256

80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83
SHA512

bae09d512043bd532d3d77825f471b7c20d4a0ce504b40d768c4df2c5de70de87efa3778f1ccca8347b44289fcbff178f5b6715ca1f0cee592cd731401733f9e

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3592 regsvr32.exe

pid	process
3592	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

964 schtasks.exe

pid	process
964	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\f09b3e80 = 3cec05c4bc6c9166a7ceb32e578e503815596ed0c95c4276f5e0202d4c8fedcbeaa8db60142252d33c35c2a4ecba8a40cb2879e08bf3c91db00b523e8bcd275c7bbc0107ce6d3150d06ff72800df20501233f85978d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\8fd25176 = 560220f54cb87bd86c186d5b569da9a2fa5872f958652703783e4aebec77452749e5b3ecfe04d8c318b18608fa9a210f6fa4cfa2dd655d85fc1b9e7c955ce84e30f899ffc36144f8490f2c5e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\8fd25176 = 560237f54cb84e51e8e81a5c6cee6db700dd06aa5f25d58f24a9c0a8648144a57042dec08a6985a2905799635518a90d941ac362ac8332	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\ba4d8138 = e98b2725d3748b8144f83f8bad9534801b30a5bc9231107b0e931f7a66263ecd2eb5d380553233590a1b05852a6d3c87034b28c3b69dd95d015d0f8252bea4ad55ba3e6cca5bb55e8c01ed812bead884e461e3e27fde2b61ff7f6442a5f7f3d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\b80ca144 = a3b2451e45db79ca66d57fb99bbdfd1b6facb4539ee6b9da99f88ca7b751f50663cb27affcc05bc31ae7f96488ddf708a7388da46ad37ddd9ff8089d6bf0ccae14c682b85b2b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\2f1e65d = f91ee7b69491db22daba93cd1427ea23f86afb9be958a4c747049a5cd017d3a1b8a773d065c82d407a286bb7a76e8468439b6468e63be15bfa64d559cbe0ec57dbed71b5	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\b0c621 = 34c20201b04064cd9fdb8af30446a039900a242041ba636a309d4ff0b451a9e1d4b958948bdbb3f84edf083a9575	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\7db889ab = f443c1a4644c881e94bbba4c16bf0ee4f4c042e63fc29ce36dc9cf979f96b45c07c89d334452acc2b21489cfe7abd5485f757c48f403a58c6f005d9c2fa34329c7c3839b7dfb5e0841e253a76ac6611c119c82466a4921928c37bb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvaifuem\c504eece = 6581449898a2a6959cd778d51c45873795a42ecf27215407b4de55d0983c	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3608 regsvr32.exe
3608 regsvr32.exe
3592 regsvr32.exe
3592 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3608 regsvr32.exe
3592 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe
3608	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4016 wrote to memory of 3608	4016	regsvr32.exe	regsvr32.exe
PID 4016 wrote to memory of 3608	4016	regsvr32.exe	regsvr32.exe
PID 4016 wrote to memory of 3608	4016	regsvr32.exe	regsvr32.exe
PID 3608 wrote to memory of 4076	3608	regsvr32.exe	explorer.exe
PID 3608 wrote to memory of 4076	3608	regsvr32.exe	explorer.exe
PID 3608 wrote to memory of 4076	3608	regsvr32.exe	explorer.exe
PID 3608 wrote to memory of 4076	3608	regsvr32.exe	explorer.exe
PID 3608 wrote to memory of 4076	3608	regsvr32.exe	explorer.exe
PID 4076 wrote to memory of 964	4076	explorer.exe	schtasks.exe
PID 4076 wrote to memory of 964	4076	explorer.exe	schtasks.exe
PID 4076 wrote to memory of 964	4076	explorer.exe	schtasks.exe
PID 2616 wrote to memory of 3592	2616	regsvr32.exe	regsvr32.exe
PID 2616 wrote to memory of 3592	2616	regsvr32.exe	regsvr32.exe
PID 2616 wrote to memory of 3592	2616	regsvr32.exe	regsvr32.exe
PID 3592 wrote to memory of 700	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 700	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 700	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 700	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 700	3592	regsvr32.exe	explorer.exe
PID 700 wrote to memory of 3128	700	explorer.exe	reg.exe
PID 700 wrote to memory of 3128	700	explorer.exe	reg.exe
PID 700 wrote to memory of 3132	700	explorer.exe	reg.exe
PID 700 wrote to memory of 3132	700	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dfjhpepy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:964

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bngwkaga" /d "0"
4⤵
PID:3128

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mlevym" /d "0"
4⤵
PID:3132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
MD5
fd8ec77190e15c21b716fecf7cd0779c

SHA1
88b67d0f37e6a1ca9135e67188ec0471a8b89628

SHA256
80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83

SHA512
bae09d512043bd532d3d77825f471b7c20d4a0ce504b40d768c4df2c5de70de87efa3778f1ccca8347b44289fcbff178f5b6715ca1f0cee592cd731401733f9e

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
98b495282e39cebc0f2826125707b553

SHA1
bd9a3b7d2481873f10ed111bf27fb369c056dbb9

SHA256
657a587016620c92a6039b32020f4e8057b2bd8a26dd6e5f90fea8442875fc21

SHA512
a8bf76961768589a0866b3d1a7862dfb5dbfce08041560b12128cfa16dc38b568d95e544238361cfb2c3016fa48191c6e9676c10242cb64e8aee4ace1fb39f33

Download Submit
\Users\Admin\AppData\Local\Temp\80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83.dll
MD5
fd8ec77190e15c21b716fecf7cd0779c

SHA1
88b67d0f37e6a1ca9135e67188ec0471a8b89628

SHA256
80c4e704a99c9be8dc3acfd71cd00c03d53ac65a71351a6cd8130a0e15309e83

SHA512
bae09d512043bd532d3d77825f471b7c20d4a0ce504b40d768c4df2c5de70de87efa3778f1ccca8347b44289fcbff178f5b6715ca1f0cee592cd731401733f9e

Download Submit
memory/700-127-0x0000000000000000-mapping.dmp

Download
memory/700-132-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/700-131-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/700-130-0x0000000002AD0000-0x0000000002AF1000-memory.dmp

Filesize
132KB

Download
memory/964-119-0x0000000000000000-mapping.dmp

Download
memory/3128-128-0x0000000000000000-mapping.dmp

Download
memory/3132-129-0x0000000000000000-mapping.dmp

Download
memory/3592-124-0x0000000000000000-mapping.dmp

Download
memory/3608-116-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/3608-115-0x0000000000000000-mapping.dmp

Download
memory/3608-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/4076-118-0x0000000000000000-mapping.dmp

Download
memory/4076-122-0x0000000002E40000-0x0000000002E61000-memory.dmp

Filesize
132KB

Download
memory/4076-121-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/4076-120-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads