qakbot | d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

General

Target

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
Size

512KB
MD5

1a0c333053b2e8ee809e48ed8ff67be3
SHA1

a547b3002ce848d130af2129843c29c9585fc0f8
SHA256

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0
SHA512

618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Score

10^/10

qakbot cullinan 1639742517 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1260 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

696 schtasks.exe

pid	process
1260	regsvr32.exe

pid	process
696	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\9a4bb42e = 3f169ba6e544b603f2123df161b24150c2ae0185ec7246fe98c2d4cbec454a6b45e56e42767035cd2564381e4efe6d4cb84142207289d038dd97e50c3fcae8037cc909390a72a92368aa5ef1d4c61d9385915ae57a426b4290561c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\980a9452 = 6ff5ce9416d973cdfc4394bc6ca0215e4498bf0b44d5fc6dd2bd40b05b56ad90ec624af3dd647276a7f3fe8933befdec136d96a2041049f43c487204847344	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\5dbebcbd = 9100beccd93cec7be512ce9eedd05f01c2b94ec56eda10d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\22f7d34b = 0b4169969118e82bd567af1989a6ee15577dd716fa97a8d3066c0ac22752fa031850ee48556ffc91e25d29a3888b0b78501e2327a7374f11d68226762cc264719359b2cf6009591b3fdc27e9fb6308ea954f817838ce82b9a414	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\d09d0b96 = 9ee5ab5a85cdfc725a2953717f21209d53ca1c9cbf65fea33880cd	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Djttvbhvkv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\afd46460 = bd149de18dbf9daef9fec5a674bc8c71106c1d557b81acb4e1c923d7e00896bebc9fed0d08	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\afd46460 = bd148ae18dbfa8e31111f8eeea57f5dccd3ab6318409ba6bf04e56296fc7d8ba33469e0162f23aa470aa2ac9a1bcfd4959fb662e1d022fb142a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\20b6f337 = 3bf481ece047ab4c3aa77166a89f4ebcddb597f455e79cff9a2240d4f307727f72b7c951f958ad3e453c66d7d12ad0628476203b4dea57df880bd273160f2ebe6ad443b4bdf3f6d4974f3ddc81	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Djttvbhvkv\e502dbd8 = 7ab059bf8e65e776a4cb54ff1424bda46363e03f19789a2a4c13629790153c1ed7949a93542228f9be40e4b546a85295b58522a0ccf28e88ac10cecf35776a302e15d696611a99bbb607abd91900ba8fcb07a69c4935e037abdbea0d2d918c480c	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

960 rundll32.exe
1260 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

960 rundll32.exe
1260 regsvr32.exe

pid	process
960	rundll32.exe
1260	regsvr32.exe

pid	process
960	rundll32.exe
1260	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 760 wrote to memory of 960	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 960	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 960	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 960	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 960	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 960	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 960	760	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1468	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1468	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1468	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1468	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1468	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1468	960	rundll32.exe	explorer.exe
PID 1468 wrote to memory of 696	1468	explorer.exe	schtasks.exe
PID 1468 wrote to memory of 696	1468	explorer.exe	schtasks.exe
PID 1468 wrote to memory of 696	1468	explorer.exe	schtasks.exe
PID 1468 wrote to memory of 696	1468	explorer.exe	schtasks.exe
PID 1540 wrote to memory of 108	1540	taskeng.exe	regsvr32.exe
PID 1540 wrote to memory of 108	1540	taskeng.exe	regsvr32.exe
PID 1540 wrote to memory of 108	1540	taskeng.exe	regsvr32.exe
PID 1540 wrote to memory of 108	1540	taskeng.exe	regsvr32.exe
PID 1540 wrote to memory of 108	1540	taskeng.exe	regsvr32.exe
PID 108 wrote to memory of 1260	108	regsvr32.exe	regsvr32.exe
PID 108 wrote to memory of 1260	108	regsvr32.exe	regsvr32.exe
PID 108 wrote to memory of 1260	108	regsvr32.exe	regsvr32.exe
PID 108 wrote to memory of 1260	108	regsvr32.exe	regsvr32.exe
PID 108 wrote to memory of 1260	108	regsvr32.exe	regsvr32.exe
PID 108 wrote to memory of 1260	108	regsvr32.exe	regsvr32.exe
PID 108 wrote to memory of 1260	108	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 300	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 300	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 300	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 300	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 300	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 300	1260	regsvr32.exe	explorer.exe
PID 300 wrote to memory of 1172	300	explorer.exe	reg.exe
PID 300 wrote to memory of 1172	300	explorer.exe	reg.exe
PID 300 wrote to memory of 1172	300	explorer.exe	reg.exe
PID 300 wrote to memory of 1172	300	explorer.exe	reg.exe
PID 300 wrote to memory of 1788	300	explorer.exe	reg.exe
PID 300 wrote to memory of 1788	300	explorer.exe	reg.exe
PID 300 wrote to memory of 1788	300	explorer.exe	reg.exe
PID 300 wrote to memory of 1788	300	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn eioabyup /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll\"" /SC ONCE /Z /ST 08:02 /ET 08:14
      4⤵
      Creates scheduled task(s)
      PID:696

C:\Windows\system32\taskeng.exe
taskeng.exe {C1B3D955-917F-46E7-A2FF-4B3BB29C4ADA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:300
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ifhwy" /d "0"
        5⤵
        
        PID:1172
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Vldvxe" /d "0"
        5⤵
        
        PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll

MD5
1a0c333053b2e8ee809e48ed8ff67be3

SHA1
a547b3002ce848d130af2129843c29c9585fc0f8

SHA256
d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

SHA512
618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll

MD5
1a0c333053b2e8ee809e48ed8ff67be3

SHA1
a547b3002ce848d130af2129843c29c9585fc0f8

SHA256
d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

SHA512
618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Download Submit
memory/108-71-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Filesize
8KB

Download
memory/108-70-0x0000000000000000-mapping.dmp

Download
memory/300-90-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/300-84-0x0000000000000000-mapping.dmp

Download
memory/696-66-0x0000000000000000-mapping.dmp

Download
memory/960-59-0x0000000001DD0000-0x0000000001DF1000-memory.dmp

Filesize
132KB

Download
memory/960-61-0x0000000001DD0000-0x0000000001DF1000-memory.dmp

Filesize
132KB

Download
memory/960-60-0x0000000001DD0000-0x0000000001DF1000-memory.dmp

Filesize
132KB

Download
memory/960-68-0x0000000001DD0000-0x0000000001DF1000-memory.dmp

Filesize
132KB

Download
memory/960-67-0x0000000001DA0000-0x0000000001DC1000-memory.dmp

Filesize
132KB

Download
memory/960-58-0x0000000001DD0000-0x0000000001DF1000-memory.dmp

Filesize
132KB

Download
memory/960-57-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/960-56-0x00000000001F0000-0x0000000000274000-memory.dmp

Filesize
528KB

Download
memory/960-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/960-54-0x0000000000000000-mapping.dmp

Download
memory/1172-88-0x0000000000000000-mapping.dmp

Download
memory/1260-80-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1260-76-0x0000000000A00000-0x0000000000A84000-memory.dmp

Filesize
528KB

Download
memory/1260-78-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1260-77-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1260-79-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1260-73-0x0000000000000000-mapping.dmp

Download
memory/1260-81-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1260-82-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1468-69-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1468-65-0x00000000740A1000-0x00000000740A3000-memory.dmp

Filesize
8KB

Download
memory/1468-63-0x0000000000000000-mapping.dmp

Download
memory/1468-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1788-89-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads