qakbot | 1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

General

Target

1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
Size

1.8MB
MD5

b7113424e89937b22a6da097622a83d5
SHA1

9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906
SHA256

1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a
SHA512

e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1940 regsvr32.exe

pid	process
1940	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1564 schtasks.exe

pid	process
1564	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\47c32812 = 6f538ee49d51fa5a5b0cfd424d259322bc6809d86d6af099b498537750450ab21cbdc1d9be06b052aa998832992fd65298e99be78047ca6298458084b5216fb30838fc611ebccb559165ac24003abf39b53cf0b8	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrnycui	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\47c32812 = 6f5399e49d51cf96b8ebe90f6f8cd5cb7bc20cd5326227b79bc0fcad0e67788cb3453fa1db9c26e091a76ec773cfcf618cafaea1a9223b9d0590d8a38e5459	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\725cf85c = 221ae1c6f50396d3765b1484e8eb8c948c39eef0d23fbf805fed726a877398bfcea5fd0dc50b0e7f1e7ea0812cffaf0dea6bc76d3592b2a86df27fef619c84fcf4289fb2de9101fb19ce2873031c24150dcef65525173a42b2cc148252b8aed7f760216dc8cb1a037929e5bb16cb1978cd33ee66974b2a020f8dac706bb6cb3e54afe1363c212bf9f317ed6cddb12619f29731c7f7a4680a59e3f2de9070f2380753c344806b080e923387f06a353744738678	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\c8a1bf45 = 6cef0c32bd49b900718e391ae36c8a35e97c1e98c38abc3a640eeff11cdbbcfe9ec52275f88963bdcbb57601def7b5fad05dd2078e925961fc4e2c607b72fcdd0ce6bf427b03e6a560dc88b56f5dcfd8c6a7a635570f353b74bd6539cc60519e8b652a24153cfc7df3576dc77314725c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\d1597aa = 3e6833bfb84e0f234a39f28b47156266b732bb5af4e540c169fd44e217ef7d23a0c042d737d0d70b348a462e71f105	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\701dd820 = 39b1a03ff4254ae2104dc8f4929f4a043141e88f37c35c68dd7467a09cdb0d85ab1a099ba159ff38cd175df67a22d041e666fe9ef1cfe69b7d93e468bf53cdd43db8586dfc13aaab31b56c322f25af5e629e7118d2dc4e3ea132011b477cf46b5482a5a12363	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\b5a9f0cf = 9adede5c58b65da575e390902762e80ae62bcc371b63476ccee4a5c29d3c1e37c31d60cd0e4b21646e1fd2d8068ccbf51af6bb1b87277cc3cfdc4fdc5484db238f27109d83c481f0a073f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\cae09f39 = 05328f4a94e1809d7d67310adb73d8f86ef60f70c572ff8fbbdae8237e8311a3c04c90ce0ae3f7761dd7781e27911f7af317683129cba0170eccb9e0166c9d83379c769658c9c89953d699a45c53b199ef034be684ff0bad982dcd3983fcbdea54929704f66e0e6d0465ff51	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yrnycui\388a47e4 = f7cce3659981a380aeecbcf61a68774146e0f29a58e0630de11ee965e4b052cf76	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1548 regsvr32.exe
1940 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1548 regsvr32.exe
1940 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe
1940	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 808 wrote to memory of 1548	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 1548	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 1548	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 1548	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 1548	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 1548	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 1548	808	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 320	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 320	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 320	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 320	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 320	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 320	1548	regsvr32.exe	explorer.exe
PID 320 wrote to memory of 1564	320	explorer.exe	schtasks.exe
PID 320 wrote to memory of 1564	320	explorer.exe	schtasks.exe
PID 320 wrote to memory of 1564	320	explorer.exe	schtasks.exe
PID 320 wrote to memory of 1564	320	explorer.exe	schtasks.exe
PID 1788 wrote to memory of 972	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 972	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 972	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 972	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 972	1788	taskeng.exe	regsvr32.exe
PID 972 wrote to memory of 1940	972	regsvr32.exe	regsvr32.exe
PID 972 wrote to memory of 1940	972	regsvr32.exe	regsvr32.exe
PID 972 wrote to memory of 1940	972	regsvr32.exe	regsvr32.exe
PID 972 wrote to memory of 1940	972	regsvr32.exe	regsvr32.exe
PID 972 wrote to memory of 1940	972	regsvr32.exe	regsvr32.exe
PID 972 wrote to memory of 1940	972	regsvr32.exe	regsvr32.exe
PID 972 wrote to memory of 1940	972	regsvr32.exe	regsvr32.exe
PID 1940 wrote to memory of 872	1940	regsvr32.exe	explorer.exe
PID 1940 wrote to memory of 872	1940	regsvr32.exe	explorer.exe
PID 1940 wrote to memory of 872	1940	regsvr32.exe	explorer.exe
PID 1940 wrote to memory of 872	1940	regsvr32.exe	explorer.exe
PID 1940 wrote to memory of 872	1940	regsvr32.exe	explorer.exe
PID 1940 wrote to memory of 872	1940	regsvr32.exe	explorer.exe
PID 872 wrote to memory of 1728	872	explorer.exe	reg.exe
PID 872 wrote to memory of 1728	872	explorer.exe	reg.exe
PID 872 wrote to memory of 1728	872	explorer.exe	reg.exe
PID 872 wrote to memory of 1728	872	explorer.exe	reg.exe
PID 872 wrote to memory of 988	872	explorer.exe	reg.exe
PID 872 wrote to memory of 988	872	explorer.exe	reg.exe
PID 872 wrote to memory of 988	872	explorer.exe	reg.exe
PID 872 wrote to memory of 988	872	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vrcmtdkb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll\"" /SC ONCE /Z /ST 04:02 /ET 04:14
4⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\taskeng.exe
taskeng.exe {FA5CEE24-8362-482F-81DA-7B8F232F64C8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fiffswu" /d "0"
5⤵
PID:1728

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Beeabfun" /d "0"
5⤵
PID:988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
MD5
b7113424e89937b22a6da097622a83d5

SHA1
9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906

SHA256
1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

SHA512
e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
1f6053059084785863fa339978746ef5

SHA1
615050107dfb8fc40b52c07da6c8a398e635ad08

SHA256
d8daff051ddbcc70098e910dae26db091c9fef255478d89295e9c152affa0e16

SHA512
d39a55199d3b2535ab1cdebcbf98eb099fed0ea775715eb1b7629e500c63c62497530197376b7cbc66b1b730b28f3524e1ae668dae605b9ebfc5d961d77b031a

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
MD5
b7113424e89937b22a6da097622a83d5

SHA1
9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906

SHA256
1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

SHA512
e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Download Submit
memory/320-56-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/320-57-0x0000000000000000-mapping.dmp

Download
memory/320-59-0x0000000074CB1000-0x0000000074CB3000-memory.dmp

Filesize
8KB

Download
memory/320-62-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-53-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Filesize
8KB

Download
memory/872-72-0x0000000000000000-mapping.dmp

Download
memory/872-78-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/972-64-0x0000000000000000-mapping.dmp

Download
memory/988-77-0x0000000000000000-mapping.dmp

Download
memory/1548-60-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1548-61-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/1548-55-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1548-54-0x0000000000000000-mapping.dmp

Download
memory/1564-63-0x0000000000000000-mapping.dmp

Download
memory/1728-76-0x0000000000000000-mapping.dmp

Download
memory/1940-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads