qakbot | 1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

General

Target

1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
Size

1.8MB
MD5

b7113424e89937b22a6da097622a83d5
SHA1

9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906
SHA256

1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a
SHA512

e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3876 regsvr32.exe

pid	process
3876	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3224 schtasks.exe

pid	process
3224	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\222b63f4 = 056d03b230a852018abf17fb604e23fab019ec6c60321a1bb44c343e059f32	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\ad49f4a3 = 834592bb4555e6277bb9ca9285f6a250e011acb327930631f9c6a8428904c7167b905694ef307642d1ce870c8ccbb4179125e47c6dba1a9a31e84acfcd301b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\5d620c02 = 6564b2e6a6504584ad19fa3cdb6625938aea8740076f9e97ff68fe4db120d11870c65249b946757ae69c1c08bd6c37fb3041a86f902068fa8f84f3826c95c99f8d50927e18ab37913e5fd96087d8bf218970a52a4c6e9693	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\222b63f4 = 056d14b230a8679f8dfdf952e2cdda9b8fa644e8769d951d59ed24d9ad5350ed7a3cc62885c2bdf8f416d430cd863c9ffeeacc7c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\af08d4df = 33688549b5fec7a57be921a8b67a58898ea237baea8d336f29691f20d518c03a49957a89c08b4750765de2b7fa81ac24a80617132e53d44aab1f3d6312af18781dfada1f2fd610f19318c5ebd98c855c98a496	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\17b4b3ba = 134f5ec93924d4463bb49987cafb4df4d11370a12932360b1b770564df986705ea6a8bd61004fa1dbec148139c0469c2b780eb97e32244d2396641506dc8084522f284c3c8f417d075fb2c4d238756d900a465756c10be589ae80203a74776ee681f756ba15346e8e565f4f9500944bf1b391156943d552fd783	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\15f593c6 = 1f8a7a382109f877ecd82e70cba7c4ae21a6b2aa110e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\d041bb29 = c583a064c343958d322935c1b2d48f665bda58defcda16477000f9d4f9024e875f0e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ezbowxuimiuk\68fddc4c = d5b29ab3c3cedaf8151ea750cdfb09	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

860 regsvr32.exe
860 regsvr32.exe
3876 regsvr32.exe
3876 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

860 regsvr32.exe
3876 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe
3876	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 552 wrote to memory of 860	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 860	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 860	552	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 1256	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1256	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1256	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1256	860	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 1256	860	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 3224	1256	explorer.exe	schtasks.exe
PID 1256 wrote to memory of 3224	1256	explorer.exe	schtasks.exe
PID 1256 wrote to memory of 3224	1256	explorer.exe	schtasks.exe
PID 3208 wrote to memory of 3876	3208	regsvr32.exe	regsvr32.exe
PID 3208 wrote to memory of 3876	3208	regsvr32.exe	regsvr32.exe
PID 3208 wrote to memory of 3876	3208	regsvr32.exe	regsvr32.exe
PID 3876 wrote to memory of 740	3876	regsvr32.exe	explorer.exe
PID 3876 wrote to memory of 740	3876	regsvr32.exe	explorer.exe
PID 3876 wrote to memory of 740	3876	regsvr32.exe	explorer.exe
PID 3876 wrote to memory of 740	3876	regsvr32.exe	explorer.exe
PID 3876 wrote to memory of 740	3876	regsvr32.exe	explorer.exe
PID 740 wrote to memory of 792	740	explorer.exe	reg.exe
PID 740 wrote to memory of 792	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1964	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1964	740	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qgqnwnkdhx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:3224

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Euvomtbzaol" /d "0"
4⤵
PID:792

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Bfcee" /d "0"
4⤵
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
MD5
b7113424e89937b22a6da097622a83d5

SHA1
9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906

SHA256
1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

SHA512
e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
56d12c51bdaa22698daade6c386960ae

SHA1
a77c241ba6b68e497f5b842084d1337480bdeaa2

SHA256
c0a7cbcb399632166111c5cf7f9575e2826c774417fdf431dcd2d4b5cc93a6eb

SHA512
ee953fe65b23f4a3d56240eabf04c38a1465e6dc52eeb34ce8de787d542ce0ae6397b5691ea10207e0d1d2fcd20361c68ade1afa39d138e08ddffdfe654a158e

Download Submit
\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
MD5
b7113424e89937b22a6da097622a83d5

SHA1
9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906

SHA256
1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

SHA512
e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Download Submit
memory/740-127-0x0000000000000000-mapping.dmp

Download
memory/740-131-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/740-132-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/740-130-0x0000000002FD0000-0x0000000002FF1000-memory.dmp

Filesize
132KB

Download
memory/792-128-0x0000000000000000-mapping.dmp

Download
memory/860-116-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/860-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/860-115-0x0000000000000000-mapping.dmp

Download
memory/1256-118-0x0000000000000000-mapping.dmp

Download
memory/1256-122-0x0000000000980000-0x00000000009A1000-memory.dmp

Filesize
132KB

Download
memory/1256-121-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/1256-120-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/1964-129-0x0000000000000000-mapping.dmp

Download
memory/3224-119-0x0000000000000000-mapping.dmp

Download
memory/3876-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads