qakbot | d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

General

Target

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
Size

512KB
MD5

1a0c333053b2e8ee809e48ed8ff67be3
SHA1

a547b3002ce848d130af2129843c29c9585fc0f8
SHA256

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0
SHA512

618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Score

10^/10

qakbot cullinan 1639742517 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1216 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

572 schtasks.exe

pid	process
1216	regsvr32.exe

pid	process
572	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\1d03d869 = 47ef316854d0d22ffac10b7499e4b4463807ada23b6c3155e337a622973580a70c6c7b64fb85c08ee3b829d5d6289ffe3a795ff7e2233e3b8800c59905e6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\289c0827 = a6ec60ec136c841b6c999c29f5c98258bad03f4a1962c8a88bca754bd12c3c123b697f61655bd3689a166cb07e03b37c81b9e6958ef9a1858a636964fe9f9073e7af12575c8aad1d3e43a549053c061b156c4ef0eba43dd75e906ad552aae23ed2ea6dfefee1cb24f8f9fc2d68ca9c515bc02e10b8088f51e14402c948ac481f69a2b0fa86a4c6819f3bbc439ec53c47785b0e9865c022bed990ebbc5b00ab4b17f3251ba0d7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\90206f42 = de888c2711e6b91d43eb96f8f27865ae7bada2c6bfd9278a8a05214fbe5ff07b004a06af7d2b38612a3d4de37c389b39cc9525829d6119939b0206f9a4622e7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\2add285b = 32b86d0b8a38c3bea20f641add176d9b7cbed5465f2705c48eb613a65e5fe8f324ae25476bb968aaa452a71400d76d0214450546becf275cd65fc1e2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\92614f3e = 8590e2599294ed5e3407edc339229b77da09d6c0e5ac187185add110495a91d2e220d79721e4941a30b8793ce605ce618fe57e1e3f25bca4537ff5379d570932547cefba25ea113bb6ebe3899764935d9e34ae5cd6593e7275837a9753c0d953d9cd3b4a1340	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\ef6900b4 = 433cdbb3aeb043a6586f4a0e8476b16ffb14e30dd974644cddbb218b0886a1e30d5ed9fbadac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\57d567d1 = 7da8121512f627764a04dbed414b835f8a244371474dbc92da3f18cd59a5a12993324bd749c7ece63a8885712cc8ee8f4bfc85cc129278348321b4ecc91b0050d3e5901a1c8046f7aee521a4cd67beb957ae7dfc30c0e305cd521b9c4086327afe72793dc108fb03d4f2343c74	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\624ab79f = 1aa2a48ca363a69167a772b13181f906e4482e322a8103142765d92c699f4f291e70ea107fb80697f1b005bd57c647db7bbc21175e1c1522d042b7491b751a19458814e3bccda3d3c83c1148343b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgsooehjanui\1d03d869 = 47ef266854d0e78b52866879a724e752424ab2f7e08e79f347040a2e35c02c7591d1b72034e66d5bc33d81dff9a315d089de6cc1b12c7ce7fc77e835542022ba4742b94921f74909cc9f47941cf545239946af	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1676 rundll32.exe
1216 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1676 rundll32.exe
1216 regsvr32.exe

pid	process
1676	rundll32.exe
1216	regsvr32.exe

pid	process
1676	rundll32.exe
1216	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1648 wrote to memory of 1676	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1676	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1676	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1676	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1676	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1676	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1676	1648	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 552	1676	rundll32.exe	explorer.exe
PID 1676 wrote to memory of 552	1676	rundll32.exe	explorer.exe
PID 1676 wrote to memory of 552	1676	rundll32.exe	explorer.exe
PID 1676 wrote to memory of 552	1676	rundll32.exe	explorer.exe
PID 1676 wrote to memory of 552	1676	rundll32.exe	explorer.exe
PID 1676 wrote to memory of 552	1676	rundll32.exe	explorer.exe
PID 552 wrote to memory of 572	552	explorer.exe	schtasks.exe
PID 552 wrote to memory of 572	552	explorer.exe	schtasks.exe
PID 552 wrote to memory of 572	552	explorer.exe	schtasks.exe
PID 552 wrote to memory of 572	552	explorer.exe	schtasks.exe
PID 1256 wrote to memory of 1128	1256	taskeng.exe	regsvr32.exe
PID 1256 wrote to memory of 1128	1256	taskeng.exe	regsvr32.exe
PID 1256 wrote to memory of 1128	1256	taskeng.exe	regsvr32.exe
PID 1256 wrote to memory of 1128	1256	taskeng.exe	regsvr32.exe
PID 1256 wrote to memory of 1128	1256	taskeng.exe	regsvr32.exe
PID 1128 wrote to memory of 1216	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1216	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1216	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1216	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1216	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1216	1128	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1216	1128	regsvr32.exe	regsvr32.exe
PID 1216 wrote to memory of 1672	1216	regsvr32.exe	explorer.exe
PID 1216 wrote to memory of 1672	1216	regsvr32.exe	explorer.exe
PID 1216 wrote to memory of 1672	1216	regsvr32.exe	explorer.exe
PID 1216 wrote to memory of 1672	1216	regsvr32.exe	explorer.exe
PID 1216 wrote to memory of 1672	1216	regsvr32.exe	explorer.exe
PID 1216 wrote to memory of 1672	1216	regsvr32.exe	explorer.exe
PID 1672 wrote to memory of 1728	1672	explorer.exe	reg.exe
PID 1672 wrote to memory of 1728	1672	explorer.exe	reg.exe
PID 1672 wrote to memory of 1728	1672	explorer.exe	reg.exe
PID 1672 wrote to memory of 1728	1672	explorer.exe	reg.exe
PID 1672 wrote to memory of 288	1672	explorer.exe	reg.exe
PID 1672 wrote to memory of 288	1672	explorer.exe	reg.exe
PID 1672 wrote to memory of 288	1672	explorer.exe	reg.exe
PID 1672 wrote to memory of 288	1672	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pkzjrdkkp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll\"" /SC ONCE /Z /ST 15:41 /ET 15:53
4⤵
- Creates scheduled task(s)
PID:572

C:\Windows\system32\taskeng.exe
taskeng.exe {CF1CCFA3-2CC0-4615-89DB-03D191619835} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Peuwezacxi" /d "0"
5⤵
PID:1728

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Bykoz" /d "0"
5⤵
PID:288

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
MD5
1a0c333053b2e8ee809e48ed8ff67be3

SHA1
a547b3002ce848d130af2129843c29c9585fc0f8

SHA256
d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

SHA512
618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
MD5
1a0c333053b2e8ee809e48ed8ff67be3

SHA1
a547b3002ce848d130af2129843c29c9585fc0f8

SHA256
d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

SHA512
618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Download Submit
memory/288-91-0x0000000000000000-mapping.dmp

Download
memory/552-66-0x0000000000000000-mapping.dmp

Download
memory/552-70-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/552-68-0x00000000742C1000-0x00000000742C3000-memory.dmp

Filesize
8KB

Download
memory/552-65-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/572-69-0x0000000000000000-mapping.dmp

Download
memory/1128-72-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Filesize
8KB

Download
memory/1128-71-0x0000000000000000-mapping.dmp

Download
memory/1216-81-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/1216-87-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1216-88-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/1216-80-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/1216-78-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/1216-79-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/1216-77-0x0000000000330000-0x00000000003B4000-memory.dmp

Filesize
528KB

Download
memory/1216-74-0x0000000000000000-mapping.dmp

Download
memory/1672-83-0x0000000000000000-mapping.dmp

Download
memory/1672-89-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1676-61-0x00000000008E0000-0x0000000000901000-memory.dmp

Filesize
132KB

Download
memory/1676-59-0x00000000008E0000-0x0000000000901000-memory.dmp

Filesize
132KB

Download
memory/1676-63-0x0000000000230000-0x0000000000251000-memory.dmp

Filesize
132KB

Download
memory/1676-55-0x0000000000000000-mapping.dmp

Download
memory/1676-60-0x00000000008E0000-0x0000000000901000-memory.dmp

Filesize
132KB

Download
memory/1676-57-0x00000000002F0000-0x0000000000374000-memory.dmp

Filesize
528KB

Download
memory/1676-64-0x00000000008E0000-0x0000000000901000-memory.dmp

Filesize
132KB

Download
memory/1676-62-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1676-58-0x00000000008E0000-0x0000000000901000-memory.dmp

Filesize
132KB

Download
memory/1676-56-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1728-90-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads