qakbot | d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

General

Target

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
Size

512KB
MD5

1a0c333053b2e8ee809e48ed8ff67be3
SHA1

a547b3002ce848d130af2129843c29c9585fc0f8
SHA256

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0
SHA512

618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Score

10^/10

qakbot cullinan 1639742517 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1624 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1248 schtasks.exe

pid	process
1624	regsvr32.exe

pid	process
1248	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vfojjattwn	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\bf517221 = c6036392a3552353bd02352cd8704b0616e19b733c5c55accec3b6abbee1ffc69e057251faf6a499dddcb21c9294dbb5bb0950389584977ee22333f64250e0c4541545efb26d666a942490f5c86a948640	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\7ed1544 = e9151577f11c72294e863a34b5ba1e69dfc656ae17e09b8d2f509a9e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\7ae55ace = 2a383ba452fb89c27fa7fa7c67acd3ecef99745bbe75b87b004f43378678dd3bdf40a1b190f191093d2a2b0e28964b4f4d2c86d53b7ad2c8641a4d59262057abc90221df939710dc880d56c96ecbbeefc0dffd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\5ac3538 = e15f91c508762b704880e96abc57784b3d3d23e35f8e380cde5457ec490fd1b0af4e2ee0a5a684b4e066cdc5be53f6a5ab31774a0fdcbfbb12ae7fbd47d739dc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\f7c6ede5 = 410217888cfd3daaa36a5a564fe1e079e00abbd7c33e7764fdb2dfd75105b3657a2dbb62c8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\888f8213 = c858c16943a1db48f0b3046e19f7c6c4c7055c2abe4f2ee49d7a0962455ef8fed6c2f27be910e7458d9bb887d774e6e014f181249e202a95ea8f93e3be765fefa28e1d0ba2e10f6a829fc2a3e8943b5a710107aa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\888f8213 = c858d66943a1ee109abea21612459c2b2fd926cf570a32e71c0c8d36f9a0ebdc256ef1676bd5e6093fc67969bf5ee5bf3430fb7850452716bcc36cd5063edc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\bd10525d = d9e762d4de6ff6e378744b31d8e860485389431c4e5e293ae3ba90a6c387809f6c38b0f5730ff79a03830d401955d64b234cb07ac925b1d8dcfa714b99694a449bd25b95d64391d7d01e8be5baa8ff78d78b927a85dbd12b505aaa59f547e8817f1aff470dd5e48bce310dc9b6143b0b7c4e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vfojjattwn\c2593dab = aa3bfc3e7574a29e4c353db33a0d55934d944d4df554c7b04df82aa27e46b8eed9d325949654160999b1431c55359c745929ba888dae8ec59970b0171f2d1072fd49c9ca5ca0d428d80403e498c05a693422556e83db8b993e19a8e9896efb956576	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1724 rundll32.exe
1624 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1724 rundll32.exe
1624 regsvr32.exe

pid	process
1724	rundll32.exe
1624	regsvr32.exe

pid	process
1724	rundll32.exe
1624	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 976 wrote to memory of 1724	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 1724	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 1724	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 1724	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 1724	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 1724	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 1724	976	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 580	1724	rundll32.exe	explorer.exe
PID 1724 wrote to memory of 580	1724	rundll32.exe	explorer.exe
PID 1724 wrote to memory of 580	1724	rundll32.exe	explorer.exe
PID 1724 wrote to memory of 580	1724	rundll32.exe	explorer.exe
PID 1724 wrote to memory of 580	1724	rundll32.exe	explorer.exe
PID 1724 wrote to memory of 580	1724	rundll32.exe	explorer.exe
PID 580 wrote to memory of 1248	580	explorer.exe	schtasks.exe
PID 580 wrote to memory of 1248	580	explorer.exe	schtasks.exe
PID 580 wrote to memory of 1248	580	explorer.exe	schtasks.exe
PID 580 wrote to memory of 1248	580	explorer.exe	schtasks.exe
PID 1616 wrote to memory of 1648	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 1648	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 1648	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 1648	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 1648	1616	taskeng.exe	regsvr32.exe
PID 1648 wrote to memory of 1624	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1624	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1624	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1624	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1624	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1624	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1624	1648	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 1496	1624	regsvr32.exe	explorer.exe
PID 1624 wrote to memory of 1496	1624	regsvr32.exe	explorer.exe
PID 1624 wrote to memory of 1496	1624	regsvr32.exe	explorer.exe
PID 1624 wrote to memory of 1496	1624	regsvr32.exe	explorer.exe
PID 1624 wrote to memory of 1496	1624	regsvr32.exe	explorer.exe
PID 1624 wrote to memory of 1496	1624	regsvr32.exe	explorer.exe
PID 1496 wrote to memory of 1780	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1780	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1780	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1780	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1128	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1128	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1128	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1128	1496	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn axbwrlzqrr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll\"" /SC ONCE /Z /ST 08:02 /ET 08:14
4⤵
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\taskeng.exe
taskeng.exe {385BA619-4781-4352-AC20-4820469A6780} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yehayzij" /d "0"
5⤵
PID:1780

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pkzhsiu" /d "0"
5⤵
PID:1128

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
MD5
1a0c333053b2e8ee809e48ed8ff67be3

SHA1
a547b3002ce848d130af2129843c29c9585fc0f8

SHA256
d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

SHA512
618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Download Submit
\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
MD5
1a0c333053b2e8ee809e48ed8ff67be3

SHA1
a547b3002ce848d130af2129843c29c9585fc0f8

SHA256
d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

SHA512
618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Download Submit
memory/580-64-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/580-69-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/580-67-0x0000000074F81000-0x0000000074F83000-memory.dmp

Filesize
8KB

Download
memory/580-65-0x0000000000000000-mapping.dmp

Download
memory/1128-88-0x0000000000000000-mapping.dmp

Download
memory/1248-68-0x0000000000000000-mapping.dmp

Download
memory/1496-89-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1496-84-0x0000000000000000-mapping.dmp

Download
memory/1624-78-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1624-73-0x0000000000000000-mapping.dmp

Download
memory/1624-81-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1624-82-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1624-80-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1624-79-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1624-77-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1624-76-0x0000000000190000-0x0000000000214000-memory.dmp

Filesize
528KB

Download
memory/1648-71-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download
memory/1648-70-0x0000000000000000-mapping.dmp

Download
memory/1724-58-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1724-60-0x00000000007E0000-0x0000000000801000-memory.dmp

Filesize
132KB

Download
memory/1724-54-0x0000000000000000-mapping.dmp

Download
memory/1724-63-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1724-59-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1724-61-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1724-62-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1724-57-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1724-56-0x0000000000720000-0x00000000007A4000-memory.dmp

Filesize
528KB

Download
memory/1724-55-0x0000000076491000-0x0000000076493000-memory.dmp

Filesize
8KB

Download
memory/1780-87-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads