qakbot | e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

General

Target

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
Size

1.8MB
MD5

5b8c5b0caad8a0e3cf8068ec5917b35e
SHA1

d3d4f7b2735b23ef798295775a008cff52add81b
SHA256

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf
SHA512

7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4036 regsvr32.exe

pid	process
4036	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

364 schtasks.exe

pid	process
364	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\b5cae190 = 03e24fdaf455bfc7d48b9de6f92038354e5eaf9d1d1749dfcf0376be	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\805531de = 5ddf0ce75a856da49c4a9f2204b46082ab999e8c0eae514def6f52fe98ee734662debcf525e25b914529cde320800d20374a56616a92ac4bfd5aebef4627ba42ce4edbe356c6b860eeb11aa245832427842be32728de4b0dfa869355f19a8817d4718f1a3bbef56b67e0b34e15939580a97f0ff4f99b1fc39ae947655b25fa7bfa53a2496ba44b9159e77a41a99a51ac9de3b9de56543bb4798d7feb769920d7323e25ebd94f783af05267fc12edabbabee29d00bae087ee2fb72885c5d1de825a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\3aa876c7 = 35fc43e3cba48247143d9fcc227ce6303038bb40390bffadb95758c8996a5722a5b912775fff83c74fb8a6008c673730de1cf07c904c52f43009bb3a4f699e357346d984e6416ba22f3071d4417608c27efe2adcf44ce87727b6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\38e956bb = d700d89bf22d703ffc3485265d7b9f5dbc1624ebe8b7d00fa81d4344	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\821411a2 = aebc495ecdb0de8d23f32b6a7ec0a07e52d46763	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\47a0394d = 6400eccd1c4bb799edc1314cc0587dbb992472ca6feaac33d1d48db4938cc81b90031fdc8a55ca9c35f253b6a313c30bb3ac621b41dbf71c92762a7d87e833d60ded873ca9a919885a6fdce0122740ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\ff1c5e28 = e7c88d99e6315779d14d3b2a352ce4110ed6e5dda3298d67c6499a27493b48982391681462f6c2f2392fbcd82d0895b398f558c573b2cd605f04a7623913	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\ca838e66 = e453545a0ae416087dcaea4c8adebe09e059e43cd973b740a851e42c0daeef993717f141688978d4f9134e08c7f1358f329d10f24bedf611eb1c11bd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmyezpvynii\b5cae190 = 03e258daf4558acbf3c7d3314abd74a761adc19072ef95d8c0541b394060e88b22e9dabd090693f65e2bda4b59309ab55b	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3120 regsvr32.exe
3120 regsvr32.exe
4036 regsvr32.exe
4036 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3120 regsvr32.exe
4036 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe
3120	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3608 wrote to memory of 3120	3608	regsvr32.exe	regsvr32.exe
PID 3608 wrote to memory of 3120	3608	regsvr32.exe	regsvr32.exe
PID 3608 wrote to memory of 3120	3608	regsvr32.exe	regsvr32.exe
PID 3120 wrote to memory of 2260	3120	regsvr32.exe	explorer.exe
PID 3120 wrote to memory of 2260	3120	regsvr32.exe	explorer.exe
PID 3120 wrote to memory of 2260	3120	regsvr32.exe	explorer.exe
PID 3120 wrote to memory of 2260	3120	regsvr32.exe	explorer.exe
PID 3120 wrote to memory of 2260	3120	regsvr32.exe	explorer.exe
PID 2260 wrote to memory of 364	2260	explorer.exe	schtasks.exe
PID 2260 wrote to memory of 364	2260	explorer.exe	schtasks.exe
PID 2260 wrote to memory of 364	2260	explorer.exe	schtasks.exe
PID 1892 wrote to memory of 4036	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 4036	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 4036	1892	regsvr32.exe	regsvr32.exe
PID 4036 wrote to memory of 608	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 608	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 608	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 608	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 608	4036	regsvr32.exe	explorer.exe
PID 608 wrote to memory of 2420	608	explorer.exe	reg.exe
PID 608 wrote to memory of 2420	608	explorer.exe	reg.exe
PID 608 wrote to memory of 720	608	explorer.exe	reg.exe
PID 608 wrote to memory of 720	608	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3120

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oqzpqqhkrc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:364

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Iafezextl" /d "0"
4⤵
PID:2420

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uniup" /d "0"
4⤵
PID:720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
MD5
5b8c5b0caad8a0e3cf8068ec5917b35e

SHA1
d3d4f7b2735b23ef798295775a008cff52add81b

SHA256
e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

SHA512
7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
6b9a10d4f8784d6bcbca340f1fc55adc

SHA1
7b20da9435ae59c057dfa8179e0bcf8c6261a9f1

SHA256
167e5b2908ebda4dd0d8c114089cfb5376edfb4f1ae9729967e7fd6970329f09

SHA512
7e28de0434dde5e22a9e0c8840b0e5065fe64ee3e92baa98cdeff6f97c9e67df69329463f2efa990944d0cf0ee54246ead82407c5c57426493067871494a8eba

Download Submit
\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
MD5
5b8c5b0caad8a0e3cf8068ec5917b35e

SHA1
d3d4f7b2735b23ef798295775a008cff52add81b

SHA256
e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

SHA512
7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Download Submit
memory/364-119-0x0000000000000000-mapping.dmp

Download
memory/608-132-0x0000000002F20000-0x0000000002F41000-memory.dmp

Filesize
132KB

Download
memory/608-130-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/608-131-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/608-127-0x0000000000000000-mapping.dmp

Download
memory/720-129-0x0000000000000000-mapping.dmp

Download
memory/2260-120-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2260-121-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2260-122-0x0000000000160000-0x0000000000181000-memory.dmp

Filesize
132KB

Download
memory/2260-118-0x0000000000000000-mapping.dmp

Download
memory/2420-128-0x0000000000000000-mapping.dmp

Download
memory/3120-115-0x0000000000000000-mapping.dmp

Download
memory/3120-116-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/3120-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/4036-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads