qakbot | e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf

General

Target

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
Size

1.8MB
MD5

5b8c5b0caad8a0e3cf8068ec5917b35e
SHA1

d3d4f7b2735b23ef798295775a008cff52add81b
SHA256

e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf
SHA512

7035355af20b09a3af71bc3a71151150d9c081f73b90ed040e28d0b2cb5cd4406f35df9bd1641a380fed2ef47e466d58a26b64a5d8047e7b4ce4f6feec170e6f

Score

10^/10

qakbot cullinan 1640170781 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Drops file in System32 directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4028 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3716 regsvr32.exe
3716 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3716 regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

pid	process
4028	schtasks.exe

Suspicious use of FindShellTrayWindow 20 IoCs

Processes:

regsvr32.exe

pid	process
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe
3716	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3364 wrote to memory of 3716	3364	regsvr32.exe	regsvr32.exe
PID 3364 wrote to memory of 3716	3364	regsvr32.exe	regsvr32.exe
PID 3364 wrote to memory of 3716	3364	regsvr32.exe	regsvr32.exe
PID 3716 wrote to memory of 3208	3716	regsvr32.exe	explorer.exe
PID 3716 wrote to memory of 3208	3716	regsvr32.exe	explorer.exe
PID 3716 wrote to memory of 3208	3716	regsvr32.exe	explorer.exe
PID 3716 wrote to memory of 3208	3716	regsvr32.exe	explorer.exe
PID 3716 wrote to memory of 3208	3716	regsvr32.exe	explorer.exe
PID 3208 wrote to memory of 4028	3208	explorer.exe	schtasks.exe
PID 3208 wrote to memory of 4028	3208	explorer.exe	schtasks.exe
PID 3208 wrote to memory of 4028	3208	explorer.exe	schtasks.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fvmqjknqpc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e0725530383e5cb85561255932adc38a0d9f9c96f2bacf6cef8847694ec602bf.dll\"" /SC ONCE /Z /ST 21:02 /ET 21:14
4⤵
- Creates scheduled task(s)
PID:4028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3208-118-0x0000000000000000-mapping.dmp

Download
memory/3208-120-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/3208-121-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/3208-122-0x0000000002720000-0x0000000002741000-memory.dmp

Filesize
132KB

Download
memory/3716-115-0x0000000000000000-mapping.dmp

Download
memory/3716-116-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/3716-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/4028-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads