qakbot | 389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0

General

Target

389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll
Size

1.8MB
MD5

b03925d1b6456fda778ab3fce1288a96
SHA1

5e1bc81ae008bd4e31412df04d22d2f02a34b452
SHA256

389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0
SHA512

5655f2a21dd3d54e0491757ef66762e8bc79c2440a24b800d2c6e1c40e3ea2925dfdf5ba6ac7ecc6b9e9a66db3616f4753e8d8f43b98839dca68a8c457304f73

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4240 regsvr32.exe

pid	process
4240	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

64 schtasks.exe

pid	process
64	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\4e4ee1ff = 24d583351242723ae56e34548a653da878afc14ab84871c595fe54fbd8a63ad45d82cf61e83c21a56077a713552390b2a664fa11d9325b098172be97d450ffda37bdcd0edab7d71b89fee5fe2569f883526e4fe569924de68c0627b421c6871203430d32909e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\31078e09 = ddced8031b7f2caf8a968d49343cebff614b2c62e00a8c6dc8e8bd7447c38595d57f47f98e1e63707b113170cd148b4f96d19577534112b800511ce730b3d419f4ff4c4859bcb803905a303d1f5dc8b67aa8283dc85dc7d03ebef4684094ed023db9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\4985e47 = f7974a20c9525171b182eaed08d6961a963204bf1e6cd5c38ad3ef1f596864101497953cda7df4e850a48cffe3c40bfe73e096d01d496820b746c1e54186d1078e7aeb8947f42d11d8d1dc9d49e38a04e1477fae9c6c1a6744d2bfe911e2f6779c377ca49879db07a43fa5d79fd6bd59ce72e189e90e894dc8f1b147dd6ded77f3214c4ddebbaa25a39dd8ecb886c094758cb57c74c04688e5143aedeaa8f0e30335cff047247fedc9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\6d97e3b = e3d2ebb040337348c0da698196721d637b00b6d96c6e3eca8dc936b044efbbb9def04da833a1ec21afbafe516f9392245cb0722cdf3baffbadb5f01bd93824e5bd4cc34be2efc51a8e5c4a65ececbff32ba4821b23	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\7bd131b1 = 4433d27037e7b5117c1f725dc823ec6a4c86f7cc659d580cae6f29fb71028b2e089128e986d13f342e288cab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\bc243922 = 81bedac736a63ff36c34c29ba055aaf8ede30080ad714d9d04708535e82d21ce74c61928e21cf315960dc3bcaf751f0b9595dd3fc1b2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\31078e09 = ddcecf031b7f199fe85afbc596b5cb075e185573447abff9f80ae55326d8c7dafa6d2f6aaf176ded550dd2a4b32b01a8e79c8aab745bee6f1f5022f16e71b88f36401a0938862325a638fba83c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\be65195e = 7713f796b59a7a0572004ee728f1296f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vstuonc\c36d56d4 = dc83a9594b47054b03c359cb5c2c9f03b7e834c598ae1c215e3136753c5dc6bd57d44e86e741d61f6713edc14847ab7c42739e2bc882a45b503ec7dacc712c1280817d2b31041f898aac33ed3dde522f98581489fb	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3592 regsvr32.exe
3592 regsvr32.exe
4240 regsvr32.exe
4240 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3592 regsvr32.exe
4240 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe
4240	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe
3592	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3328 wrote to memory of 3592	3328	regsvr32.exe	regsvr32.exe
PID 3328 wrote to memory of 3592	3328	regsvr32.exe	regsvr32.exe
PID 3328 wrote to memory of 3592	3328	regsvr32.exe	regsvr32.exe
PID 3592 wrote to memory of 3832	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 3832	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 3832	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 3832	3592	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 3832	3592	regsvr32.exe	explorer.exe
PID 3832 wrote to memory of 64	3832	explorer.exe	schtasks.exe
PID 3832 wrote to memory of 64	3832	explorer.exe	schtasks.exe
PID 3832 wrote to memory of 64	3832	explorer.exe	schtasks.exe
PID 1800 wrote to memory of 4240	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 4240	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 4240	1800	regsvr32.exe	regsvr32.exe
PID 4240 wrote to memory of 544	4240	regsvr32.exe	explorer.exe
PID 4240 wrote to memory of 544	4240	regsvr32.exe	explorer.exe
PID 4240 wrote to memory of 544	4240	regsvr32.exe	explorer.exe
PID 4240 wrote to memory of 544	4240	regsvr32.exe	explorer.exe
PID 4240 wrote to memory of 544	4240	regsvr32.exe	explorer.exe
PID 544 wrote to memory of 768	544	explorer.exe	reg.exe
PID 544 wrote to memory of 768	544	explorer.exe	reg.exe
PID 544 wrote to memory of 3996	544	explorer.exe	reg.exe
PID 544 wrote to memory of 3996	544	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xditqvit /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll\"" /SC ONCE /Z /ST 12:02 /ET 12:14
4⤵
- Creates scheduled task(s)
PID:64

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Orzamade" /d "0"
4⤵
PID:768

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iqlruteoln" /d "0"
4⤵
PID:3996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll
MD5
b03925d1b6456fda778ab3fce1288a96

SHA1
5e1bc81ae008bd4e31412df04d22d2f02a34b452

SHA256
389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0

SHA512
5655f2a21dd3d54e0491757ef66762e8bc79c2440a24b800d2c6e1c40e3ea2925dfdf5ba6ac7ecc6b9e9a66db3616f4753e8d8f43b98839dca68a8c457304f73

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
a6e415413fd04dcec099fdeb9ed5fa50

SHA1
59c0efaccec3319fd1f76816963eee733a4965c2

SHA256
4f8e70354e75f33c6ae2cc06bd6b7c91f633faba96f9fd14833d8e7568070fcc

SHA512
b4ff10b98309e4be0ba755224e3e43dc8974d75510eb9bfb2770c09d9fad21ae42a965cb916e2fc8d2cd1955490ff942498042a2c417c10cce631336e3604dfb

Download Submit
\Users\Admin\AppData\Local\Temp\389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0.dll
MD5
b03925d1b6456fda778ab3fce1288a96

SHA1
5e1bc81ae008bd4e31412df04d22d2f02a34b452

SHA256
389b1cd20f6a09afcb6bc277fd30c221fe22674314aaa86b404cc20aa5896ab0

SHA512
5655f2a21dd3d54e0491757ef66762e8bc79c2440a24b800d2c6e1c40e3ea2925dfdf5ba6ac7ecc6b9e9a66db3616f4753e8d8f43b98839dca68a8c457304f73

Download Submit
memory/64-119-0x0000000000000000-mapping.dmp

Download
memory/544-128-0x0000000000000000-mapping.dmp

Download
memory/544-133-0x0000000000610000-0x0000000000631000-memory.dmp

Filesize
132KB

Download
memory/544-132-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/544-131-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/768-129-0x0000000000000000-mapping.dmp

Download
memory/3592-116-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/3592-115-0x0000000000000000-mapping.dmp

Download
memory/3592-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/3832-118-0x0000000000000000-mapping.dmp

Download
memory/3832-122-0x0000000000D00000-0x0000000000D21000-memory.dmp

Filesize
132KB

Download
memory/3832-121-0x00000000010F0000-0x00000000010F1000-memory.dmp

Filesize
4KB

Download
memory/3832-120-0x00000000010F0000-0x00000000010F1000-memory.dmp

Filesize
4KB

Download
memory/3996-130-0x0000000000000000-mapping.dmp

Download
memory/4240-127-0x00000000007A0000-0x00000000008EA000-memory.dmp

Filesize
1.3MB

Download
memory/4240-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads