qakbot | e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

General

Target

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
Size

1.8MB
MD5

5b8c5b0caad8a0e3cf8068ec5917b35e
SHA1

d3d4f7b2735b23ef798295775a008cff52add81b
SHA256

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf
SHA512

7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1512 regsvr32.exe

pid	process
1512	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1616 schtasks.exe

pid	process
1616	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\cf59580f = 8fe5f1a4c26e71da4357b964c918e6fe117befeb36686ed16bc0a89aae9ac22f77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\77e53f6a = 32ef8dd35a9fd96e0bd70d67f667b055e9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\75a41f16 = 3ed82e2cdbbbf0386f4681851211a3c0e4ba0539dc58f6144dba1617be48be1d82	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\f887a83d = 856e6551ae5b9f1363e7ecfd5959695511caa502d34653259b995568d18efd8433c553e5e2a314b4409d34a8b34c4fb4cbd5db43225cecfed0195910eebfeea1787af93a266b6fd665181d70ea06966158b69ddf	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\f887a83d = 856e7251ae5baa49e03fe9141424d77289efee6bc63a03d6cb15049613d4e545f13e8b4cb867c1552d562891a703a7e3e5f1121cae42af758c064484d510e4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\cd187873 = e988ddb1f5da5e62f1d006aebf5f53ac7830fcabf664996e395bbae11f8cc9604c171aea20908c22f165daa83468fb1b4341075d321e83e0ba91c0c9626a516cb93bc0c682bcb13eb57ab0169492776ffe2604733b7ca8ddf4cd986c8df98edafff3410e81963660c87d41744b1e5466f306b40781d079b94c695cd1aba888cbc84a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\aed70e0 = a148bf3860b54c86a0077c430d23fba0437d74ead2678b9c2c5ca897a956e277ac41593e9dc257f105d30a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\b2511785 = 82bd62e29ce34cb193e446c4e1ded0b3a157304596f5b9844b598398060c04ba242b6da4940620d552f1ea025dfe1c3d14b9b9542091d47df3c9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ekdnwkalourpr\87cec7cb = e4ab5bb9884a316621ba95ed30cd2ff0b7972c9be86edb475c6b8346a17d312e3ababc3abde6fe4b415dcbb4f0fa5d905a367841d30c673e	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1592 regsvr32.exe
1512 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1592 regsvr32.exe
1512 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 844 wrote to memory of 1592	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1592	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1592	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1592	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1592	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1592	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1592	844	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 468	1592	regsvr32.exe	explorer.exe
PID 1592 wrote to memory of 468	1592	regsvr32.exe	explorer.exe
PID 1592 wrote to memory of 468	1592	regsvr32.exe	explorer.exe
PID 1592 wrote to memory of 468	1592	regsvr32.exe	explorer.exe
PID 1592 wrote to memory of 468	1592	regsvr32.exe	explorer.exe
PID 1592 wrote to memory of 468	1592	regsvr32.exe	explorer.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1512 wrote to memory of 1872	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1872	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1872	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1872	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1872	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1872	1512	regsvr32.exe	explorer.exe
PID 1872 wrote to memory of 1748	1872	explorer.exe	reg.exe
PID 1872 wrote to memory of 1748	1872	explorer.exe	reg.exe
PID 1872 wrote to memory of 1748	1872	explorer.exe	reg.exe
PID 1872 wrote to memory of 1748	1872	explorer.exe	reg.exe
PID 1872 wrote to memory of 540	1872	explorer.exe	reg.exe
PID 1872 wrote to memory of 540	1872	explorer.exe	reg.exe
PID 1872 wrote to memory of 540	1872	explorer.exe	reg.exe
PID 1872 wrote to memory of 540	1872	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tzvtacpux /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll\"" /SC ONCE /Z /ST 20:02 /ET 20:14
4⤵
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\taskeng.exe
taskeng.exe {6368F6E2-4BF3-49D2-AE98-5064DFAAEFD8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mmtmaoxyaay" /d "0"
5⤵
PID:1748

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ijhwayiurfa" /d "0"
5⤵
PID:540

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
MD5
5b8c5b0caad8a0e3cf8068ec5917b35e

SHA1
d3d4f7b2735b23ef798295775a008cff52add81b

SHA256
e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

SHA512
7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
38b1b3a81532d5a63e3b6285a78e5b85

SHA1
0ab8ccfecb3dffef731b04d8a053ee81b9b118d1

SHA256
6a1c36ef7702b03981ae24ea6c43d298aba6a1f147f244210adec999b5396cf1

SHA512
c1de7b269078eaeec65d3beb89b3d773ec24de3eb342b371653115c679f48a57af269ea88d5931b995e0f6fdac88e4f04d349971d6055474c1b04f40b7ca3886

Download Submit
\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
MD5
5b8c5b0caad8a0e3cf8068ec5917b35e

SHA1
d3d4f7b2735b23ef798295775a008cff52add81b

SHA256
e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

SHA512
7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Download Submit
memory/468-64-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/468-57-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/468-58-0x0000000000000000-mapping.dmp

Download
memory/468-62-0x0000000074611000-0x0000000074613000-memory.dmp

Filesize
8KB

Download
memory/540-77-0x0000000000000000-mapping.dmp

Download
memory/844-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1512-68-0x0000000000000000-mapping.dmp

Download
memory/1592-60-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/1592-59-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1592-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1592-55-0x0000000000000000-mapping.dmp

Download
memory/1616-63-0x0000000000000000-mapping.dmp

Download
memory/1632-65-0x0000000000000000-mapping.dmp

Download
memory/1748-76-0x0000000000000000-mapping.dmp

Download
memory/1872-73-0x0000000000000000-mapping.dmp

Download
memory/1872-78-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads