qakbot | e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

General

Target

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
Size

1.8MB
MD5

5b8c5b0caad8a0e3cf8068ec5917b35e
SHA1

d3d4f7b2735b23ef798295775a008cff52add81b
SHA256

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf
SHA512

7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

884 regsvr32.exe

pid	process
884	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1336 schtasks.exe

pid	process
1336	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\40e6223e = ef3814ce7db76ff11de35613f684916c65ac92934b33ab0cb490b827d8d6af5a438bd60bcbdf546708651f1923309ee1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\cf84b569 = 6b86f68f3e41ef9f57ed4293c70fcb63a410e2e84b502d0848728f51a2bf3a14a9d6065e960271856049c20768a420f81c3f356facfdb310f2f78b43f17779b39338feca725e05fab8f4a74182d6f5556addcd1e91a97330b1324855a89b551e76eeda84976985	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\a309d86 = b98a6f8c38f8b6284f9c4766cb1ee0b26753d272f9061ed7724ab6b5129cffb8dd2492e2e4593836afb1fe47a6b95497ad4e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\cdc59515 = d666ff9875434c73691cba3eedc6d24580c495f20db7999780cfe4c8c56aa6b758649d08e77c3d2a72c54a651f1e5d7da168887884b5015bfe1d1702f9d3a1e4710598b32c436da09368	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\3faf4dc8 = 80d52ff4a361447cb2137e212af1e901b487810a3f5f8b29b6e2b5537e68a80a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmeimdae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\7579f270 = 35e5a23564ecaa66eec99618efe0de8f6dbcc6bb025d7c1edf4d73887b76dc5585743fbb555575215beb94b29250db0b872590cbac1b5a81f060d3d7d81571ebd5a9caaee97fb13a4e258dedcec3841ad77a9e90217a9596b953ebf32103b2caa5de28ff808320359dc4d16acf4628c47205f189522952faf992f0e68fa98112c04d68503491b58d5bd6d22204ddc8a4105584bc509c7d6a83be8230a6eb291f697364468be390fbfce7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\7738d20c = 89a5ac53110b2bc9997b387e972118e0beb8eb6b34bca83c21fe31c8a7f5570b6721483166a5e7e17d743858e9e6e9cbc1ff899089d6b18922cd41a07e591d268cb79a6709a04a829886ab84d64c38ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\b28cfae3 = ab391efc353cd664352051f5cde19def406f73c0ba4e3974760acc8e18a7840f7b41086c381138	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Bmeimdae\40e6223e = ef3803ce7db75a670953710fc25204cc32b75e328f9d20be9decf9b791e7159c1c846bb0b63760c5587dd7821bb5b57b5463ca801a8cbc465281f71bf9d39cd1ea9aad503f	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

952 regsvr32.exe
884 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

952 regsvr32.exe
884 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe
884	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1884 wrote to memory of 952	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 952	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 952	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 952	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 952	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 952	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 952	1884	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 848	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 848	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 848	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 848	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 848	952	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 848	952	regsvr32.exe	explorer.exe
PID 848 wrote to memory of 1336	848	explorer.exe	schtasks.exe
PID 848 wrote to memory of 1336	848	explorer.exe	schtasks.exe
PID 848 wrote to memory of 1336	848	explorer.exe	schtasks.exe
PID 848 wrote to memory of 1336	848	explorer.exe	schtasks.exe
PID 652 wrote to memory of 1260	652	taskeng.exe	regsvr32.exe
PID 652 wrote to memory of 1260	652	taskeng.exe	regsvr32.exe
PID 652 wrote to memory of 1260	652	taskeng.exe	regsvr32.exe
PID 652 wrote to memory of 1260	652	taskeng.exe	regsvr32.exe
PID 652 wrote to memory of 1260	652	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 884	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 884	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 884	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 884	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 884	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 884	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 884	1260	regsvr32.exe	regsvr32.exe
PID 884 wrote to memory of 984	884	regsvr32.exe	explorer.exe
PID 884 wrote to memory of 984	884	regsvr32.exe	explorer.exe
PID 884 wrote to memory of 984	884	regsvr32.exe	explorer.exe
PID 884 wrote to memory of 984	884	regsvr32.exe	explorer.exe
PID 884 wrote to memory of 984	884	regsvr32.exe	explorer.exe
PID 884 wrote to memory of 984	884	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1040	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1040	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1040	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1040	984	explorer.exe	reg.exe
PID 984 wrote to memory of 852	984	explorer.exe	reg.exe
PID 984 wrote to memory of 852	984	explorer.exe	reg.exe
PID 984 wrote to memory of 852	984	explorer.exe	reg.exe
PID 984 wrote to memory of 852	984	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn olbfdahhb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll\"" /SC ONCE /Z /ST 20:02 /ET 20:14
4⤵
- Creates scheduled task(s)
PID:1336

C:\Windows\system32\taskeng.exe
taskeng.exe {F91A3647-C26B-48C3-9278-142D0A8FC1A0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yxmpdnjo" /d "0"
5⤵
PID:1040

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zzisfy" /d "0"
5⤵
PID:852

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
MD5
5b8c5b0caad8a0e3cf8068ec5917b35e

SHA1
d3d4f7b2735b23ef798295775a008cff52add81b

SHA256
e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

SHA512
7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
d0ff3e601edbbbca1e85527d5150b5bb

SHA1
654a623ac81e77735fcab442a416d07b0764cb77

SHA256
3b234b06b481952fcc209347da68fd9ba5f8aba0f36f0f25c7ccc60a6ec5ad50

SHA512
dae99a6ff4260a64ffc6e64e2381ce545e761a2e0902c4c2b1251b1b1ac8a7e5660cba4a910e2e8adbca876b8ab996bc5a61300f44d256e0ce95adc9b320a1e5

Download Submit
\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
MD5
5b8c5b0caad8a0e3cf8068ec5917b35e

SHA1
d3d4f7b2735b23ef798295775a008cff52add81b

SHA256
e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

SHA512
7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Download Submit
memory/848-63-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/848-56-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/848-57-0x0000000000000000-mapping.dmp

Download
memory/848-61-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/852-76-0x0000000000000000-mapping.dmp

Download
memory/884-67-0x0000000000000000-mapping.dmp

Download
memory/952-58-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/952-59-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/952-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/952-54-0x0000000000000000-mapping.dmp

Download
memory/984-72-0x0000000000000000-mapping.dmp

Download
memory/984-77-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1040-75-0x0000000000000000-mapping.dmp

Download
memory/1260-64-0x0000000000000000-mapping.dmp

Download
memory/1336-62-0x0000000000000000-mapping.dmp

Download
memory/1884-53-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads