qakbot | 1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

General

Target

1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
Size

1.8MB
MD5

b7113424e89937b22a6da097622a83d5
SHA1

9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906
SHA256

1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a
SHA512

e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1948 regsvr32.exe

pid	process
1948	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1348 schtasks.exe

pid	process
1348	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\2bf39d47 = 56b6769d1d1d9ac606877518db7431df3104dc3e3a424f041e781b9f618c5b504a8fa750b9d81fd1909f7d84e6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\934ffa22 = 0e9943040e9a5e4313263d354ce72428f7b7df41a1c15a8c57a81265e84a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\ee47b5a8 = 4b7b9a5225e54c64fcfbd96cd6b2a981f1eb3e2fc64ecb72b5a72f989695befa42587e0ba47cc57b2175214663e98583673e781ce131161a6b740f943af4f999d4e29f332a3f6334d9caaa6ede9a580cc39870ae9d67f81adcb466227ab8aeef9b8a96151018d8e2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\56fbd2cd = 73af2803a676b2a77e13e1fdcd3b68721b5d8e4549da1bdf19e1bdd591ba53dbac71214872cf485097e4870ca66f4e4aabc3af528465066136541d7b790c11e354345c44496cd530f96d86b9c6635d6b56a02468d0da4993f4f1c4987ea48b7c5f3d9eccbd9be3fe1541f8caa6cff7e880	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\1c2d6d75 = 83917da2fe99f405df7b38e9d5713dd2f8313dabf7bb83c671b6d068c61a22fe	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\1c2d6d75 = 83916aa2fe99c1964f1fa2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\29b2bd3b = 48a935041b9e68def0b8b07e2c615167b727ffeed63986f6f6e11f98c282a55ac310957afa16824d74549d9f48b22698b4a1ad680734dbf1a134606537695a69e90c451b22c5a48a6ef4c12cdf5d277afa6c35489edec3c09aeb9401b2b7693ade893cfc17edef1ff877b9b29e78a832b8818d31e536	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\910eda5e = 85e87b41056f4fa30ebd9b54e709f11f975e6e94bbf39264	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lvxgtcom\63640283 = ccf7ceec852c755ea4a62561b9deeaa2ea9d053d42cc6e8cd8efcce2200fc6497250c20542345cabfbb981109352cf17b8f4e34021e6edaaeb29819fbd666d0800dc126a86730a875ad567b889026617fe028012dff062ec102890ee71ea1a2d9e70d613eb4c73e0e61be6	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3140 regsvr32.exe
3140 regsvr32.exe
1948 regsvr32.exe
1948 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3140 regsvr32.exe
1948 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe
3140	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2724 wrote to memory of 3140	2724	regsvr32.exe	regsvr32.exe
PID 2724 wrote to memory of 3140	2724	regsvr32.exe	regsvr32.exe
PID 2724 wrote to memory of 3140	2724	regsvr32.exe	regsvr32.exe
PID 3140 wrote to memory of 1016	3140	regsvr32.exe	explorer.exe
PID 3140 wrote to memory of 1016	3140	regsvr32.exe	explorer.exe
PID 3140 wrote to memory of 1016	3140	regsvr32.exe	explorer.exe
PID 3140 wrote to memory of 1016	3140	regsvr32.exe	explorer.exe
PID 3140 wrote to memory of 1016	3140	regsvr32.exe	explorer.exe
PID 1016 wrote to memory of 1348	1016	explorer.exe	schtasks.exe
PID 1016 wrote to memory of 1348	1016	explorer.exe	schtasks.exe
PID 1016 wrote to memory of 1348	1016	explorer.exe	schtasks.exe
PID 2788 wrote to memory of 1948	2788	regsvr32.exe	regsvr32.exe
PID 2788 wrote to memory of 1948	2788	regsvr32.exe	regsvr32.exe
PID 2788 wrote to memory of 1948	2788	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 404	1948	regsvr32.exe	explorer.exe
PID 1948 wrote to memory of 404	1948	regsvr32.exe	explorer.exe
PID 1948 wrote to memory of 404	1948	regsvr32.exe	explorer.exe
PID 1948 wrote to memory of 404	1948	regsvr32.exe	explorer.exe
PID 1948 wrote to memory of 404	1948	regsvr32.exe	explorer.exe
PID 404 wrote to memory of 1088	404	explorer.exe	reg.exe
PID 404 wrote to memory of 1088	404	explorer.exe	reg.exe
PID 404 wrote to memory of 2340	404	explorer.exe	reg.exe
PID 404 wrote to memory of 2340	404	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jqcbinr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll\"" /SC ONCE /Z /ST 12:49 /ET 13:01
4⤵
- Creates scheduled task(s)
PID:1348

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:404

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Avfrsvgtpth" /d "0"
4⤵
PID:1088

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Lwydoranvx" /d "0"
4⤵
PID:2340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
MD5
b7113424e89937b22a6da097622a83d5

SHA1
9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906

SHA256
1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

SHA512
e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
e547a1ee4616452199ca38c26adb0ba2

SHA1
984df4e16cd18e1f98f835c8986e54eb8ad76d6b

SHA256
c6730f17f462ceff4b611e5b9c68717bc8bac8fa2162c5a1b0eb23150b78eb03

SHA512
8b74224514c81e8c1af220548aad460c50323759b0063478bf2c7f1ea72b72ccc8cf4451ac7743049d12f912d26178d19da9c06888ea775f60085d65eedb1fbb

Download Submit
\Users\Admin\AppData\Local\Temp\1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a.dll
MD5
b7113424e89937b22a6da097622a83d5

SHA1
9e0219d7f65ef05e2c1ce19f24dfcf32eb5c8906

SHA256
1bbfe3e3d11a78fe8c9a8abf0eb3de8c915d34d3938d8f886d896e334ff36b8a

SHA512
e179b96f8f3dfee1a7882ee840500c1fe4ab35792d280503876b90323f0332f888b015fc55fa08de1dda0234a99bc15b23aff61315db721542133aab5ab85c0e

Download Submit
memory/404-128-0x0000000000000000-mapping.dmp

Download
memory/404-133-0x0000000000760000-0x0000000000781000-memory.dmp

Filesize
132KB

Download
memory/404-131-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/404-132-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/1016-118-0x0000000000000000-mapping.dmp

Download
memory/1016-120-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1016-121-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/1016-122-0x00000000008C0000-0x00000000008E1000-memory.dmp

Filesize
132KB

Download
memory/1088-129-0x0000000000000000-mapping.dmp

Download
memory/1348-119-0x0000000000000000-mapping.dmp

Download
memory/1948-127-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1948-124-0x0000000000000000-mapping.dmp

Download
memory/2340-130-0x0000000000000000-mapping.dmp

Download
memory/3140-115-0x0000000000000000-mapping.dmp

Download
memory/3140-117-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/3140-116-0x0000000000AB0000-0x0000000000BFA000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads