qakbot | 03f6fa3d29bb41918ffe92bd934b75225b8d13ae3260512d473b6d75f7437feb

General

Target

2.exe.dll
Size

750KB
MD5

b70b3e711d4f31c5512988ae7ed483b4
SHA1

a97744e5bfae4915e8d8f0588e773d5850437631
SHA256

03f6fa3d29bb41918ffe92bd934b75225b8d13ae3260512d473b6d75f7437feb
SHA512

f097f518bcad9956c3bfe7d785a998c0a31b380e6b2ba9fe418b83c9922b9ec9561a41e6a6d1e99ade44401a175a811c2e1008f44d2fffa0a67eb47a8fd6b1ce

Score

10^/10

qakbot obama105 1632821932 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama105

Campaign

1632821932

C2

120.151.47.189:443

41.228.22.180:443

39.52.241.3:995

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1040 regsvr32.exe

pid	process
1040	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1688 schtasks.exe

pid	process
1688	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0819F34E-B589-4D06-BE19-4B451298CC3E}\WpadDecision = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0af38d31fde5cd92330a90df8e1ca6bf63c99d904c7e4077b4cc421fbb3892790f2680eaea90694a06ca58ca5482633947fe56d59d9620ff6f3ba8d789af7be7f00c5ecb6a5e23f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0118000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\a46a0724 = e5defb3e42c940f4d3416a9edbfa76763b871d080a5b7b70cc9633838c07aed32bed66185ae9ddf04d4697d09490ab8d0c6110a7211d05110cea7ee551a289c44ff2a594fa3e5acd6921f5e70227b1bd8a7c22cbaab7f7192d6d9872b021c6f0857a849107260912b248aafc90573c12	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0b138d31feb45e3c53579ec967bf4b382dcb9b9d2738a408985a065dbe9ccdbdc320c204f9bf85778de	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-38-36-9b-86-f2\WpadDecisionTime = e04aff31acb4d701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0af38d31fde5cd92330a90df8e1ca6bfd369fd904c7e4077b4cc421fbb3892094f76b0eaea90694a06ca58ca5482633947fe56d59d9620ff6f3ba8d789af7be7f00c5ecb6a5e23f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-38-36-9b-86-f2\WpadDecisionTime = 409c2728afb4d701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\1cd66041 = d50c5ee3c8cffdaf0ce80e9276d3fc455428d5cb37983500e60a8cecff4e73a5172e1a4b78bc65bd0357f0601555ad09e4eac7c834f1389dfdcf6e8ba1858e5228f064056b5eb934880246bbdabc0884074a4aeaa4c38dd44e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0a638d31fde5cd92331e30df1ebcd63f5329d970fcae403784bf230c2568bf2779afa0667e403b75a5b7672db6a98b9f4716291cad65fa38a4791ccfc6bee	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0819F34E-B589-4D06-BE19-4B451298CC3E}\WpadDecisionTime = 008f1cdcadb4d701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-38-36-9b-86-f2\WpadDecisionTime = 6059a04baeb4d701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iaapredo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\d96248ae = acf22f64d9f1d771cfe42e4b84317385d0d7dcf66118759a46e3913d00c5ae345c49e8b2bc3f6624d8f1ff129b6ff697356a5eda75a5e860ff5ea43b1459cfe1c103b47ab61a627fca16e9	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-38-36-9b-86-f2\WpadDecisionReason = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0af38d31fde5cd92330a90df8e1ca6afd3299d904c7e4077b4cc421fbb3892794f3610eaea90694a06ca58ca5482633947fe56d59d9620ff6f3ba8d789af7be7f00c5ecb6a5e23f	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-38-36-9b-86-f2\WpadDetectedUrl	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0819F34E-B589-4D06-BE19-4B451298CC3E}\WpadDecisionTime = 409c2728afb4d701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0af38d31fde5cd92330a90df8e1ca6cf6309fd904c7e4077b4cc421fbb3892094f76b0eaea90694a06ca58ca5482633947fe56d59d9620ff6f3ba8d789af7be7f00c5ecb6a5e23f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0a638d31fde5cd92331e30df1ebcd63f5329d970fcae4017745f230c2568bf2779afa0667e403b75a5b7672db6a98b9f4716291cad65fa38a4791ccfc6bee	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0af38d31fde5cd92330a90df8e1ca6bf2349ad904c7e4077b4cc421fbb3892792f56a0eaea90694a06ca58ca5482633947fe56d59d9620ff6f3ba8d789af7be7f00c5ecb6a5e23f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\db2368d2 = 0f7d1338a1b17dee66d2536a834995bfdaf003a1bf934bbe950351b30fdd320047a44ba598751bb3e9a6e643c6858208d8eabc9969f5b6e9018dead5ed13fcaf077acab2355e644b805cea0a46b6ae59cf9624af21494e94d4685ba3a47573bbf4c1452c9244aa02e8e7bc5dc52ad076a57264e8a436ea9c742892a613cd65c513ea73f297	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iaapredo\eebcb89c = a5f0af38d31fde5cd92330a90df8e1ca6afd3299d904c7e4077b4cc421fbb389269cf06f0eaea90694a06ca58ca5482633947fe56d59d9620ff6f3ba8d789af7be7f00c5ecb6a5e23f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0819F34E-B589-4D06-BE19-4B451298CC3E}\02-38-36-9b-86-f2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0819F34E-B589-4D06-BE19-4B451298CC3E}\WpadDecisionTime = a0fb5a18aeb4d701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0819F34E-B589-4D06-BE19-4B451298CC3E}\WpadDecisionTime = 6059a04baeb4d701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-38-36-9b-86-f2\WpadDecision = "0"	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2008 rundll32.exe
1040 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2008 rundll32.exe
1040 regsvr32.exe

pid	process
2008	rundll32.exe
1040	regsvr32.exe

pid	process
2008	rundll32.exe
1040	regsvr32.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2032 wrote to memory of 2008	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2008	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2008	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2008	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2008	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2008	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2008	2032	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1544	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1544	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1544	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1544	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1544	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1544	2008	rundll32.exe	explorer.exe
PID 1544 wrote to memory of 1688	1544	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 1688	1544	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 1688	1544	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 1688	1544	explorer.exe	schtasks.exe
PID 1240 wrote to memory of 1280	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1280	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1280	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1280	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1280	1240	taskeng.exe	regsvr32.exe
PID 1280 wrote to memory of 1040	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1040	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1040	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1040	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1040	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1040	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1040	1280	regsvr32.exe	regsvr32.exe
PID 1040 wrote to memory of 456	1040	regsvr32.exe	explorer.exe
PID 1040 wrote to memory of 456	1040	regsvr32.exe	explorer.exe
PID 1040 wrote to memory of 456	1040	regsvr32.exe	explorer.exe
PID 1040 wrote to memory of 456	1040	regsvr32.exe	explorer.exe
PID 1040 wrote to memory of 456	1040	regsvr32.exe	explorer.exe
PID 1040 wrote to memory of 456	1040	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 1572	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1572	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1572	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1572	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1536	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1536	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1536	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1536	456	explorer.exe	reg.exe
PID 644 wrote to memory of 1172	644	taskeng.exe	regsvr32.exe
PID 644 wrote to memory of 1172	644	taskeng.exe	regsvr32.exe
PID 644 wrote to memory of 1172	644	taskeng.exe	regsvr32.exe
PID 644 wrote to memory of 1172	644	taskeng.exe	regsvr32.exe
PID 644 wrote to memory of 1172	644	taskeng.exe	regsvr32.exe
PID 1172 wrote to memory of 1452	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 1452	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 1452	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 1452	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 1452	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 1452	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 1452	1172	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.exe.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jelfjrn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2.exe.dll\"" /SC ONCE /Z /ST 20:56 /ET 21:08
4⤵
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {3F3CE7E6-68AC-45F9-9F2D-02FCC8C89B20} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2.exe.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\2.exe.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mobyjhwha" /d "0"
5⤵
PID:1572

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cywuwzlm" /d "0"
5⤵
PID:1536

C:\Windows\system32\taskeng.exe
taskeng.exe {F0CA1AAA-D3A3-42BB-B420-77D4752FE898} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2.exe.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\2.exe.dll"
3⤵
PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2.exe.dll
MD5
b70b3e711d4f31c5512988ae7ed483b4

SHA1
a97744e5bfae4915e8d8f0588e773d5850437631

SHA256
03f6fa3d29bb41918ffe92bd934b75225b8d13ae3260512d473b6d75f7437feb

SHA512
f097f518bcad9956c3bfe7d785a998c0a31b380e6b2ba9fe418b83c9922b9ec9561a41e6a6d1e99ade44401a175a811c2e1008f44d2fffa0a67eb47a8fd6b1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.exe.dll
MD5
596c70401f9089cb85763bd7b8cb3e26

SHA1
0ab3df7c5157b4e280c5c236937b988293f0026d

SHA256
508d12a008812946aa224bcfb627f7d50a3afc5ffd4e6da0e9cf7cc873552ddc

SHA512
341671115cde94ee2e478712d21337bd09eb579c24fb28bff9a1c62f3af4d66639221edc7449c3520f056503b61f6b7a508b4763690201dfdf058f1c45e7287c

Download Submit
\Users\Admin\AppData\Local\Temp\2.exe.dll
MD5
b70b3e711d4f31c5512988ae7ed483b4

SHA1
a97744e5bfae4915e8d8f0588e773d5850437631

SHA256
03f6fa3d29bb41918ffe92bd934b75225b8d13ae3260512d473b6d75f7437feb

SHA512
f097f518bcad9956c3bfe7d785a998c0a31b380e6b2ba9fe418b83c9922b9ec9561a41e6a6d1e99ade44401a175a811c2e1008f44d2fffa0a67eb47a8fd6b1ce

Download Submit
memory/456-78-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/456-73-0x0000000000000000-mapping.dmp

Download
memory/1040-71-0x00000000748A0000-0x0000000074972000-memory.dmp

Filesize
840KB

Download
memory/1040-67-0x0000000000000000-mapping.dmp

Download
memory/1040-72-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1040-70-0x00000000748A0000-0x00000000748C1000-memory.dmp

Filesize
132KB

Download
memory/1172-79-0x0000000000000000-mapping.dmp

Download
memory/1280-65-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Filesize
8KB

Download
memory/1280-64-0x0000000000000000-mapping.dmp

Download
memory/1452-82-0x0000000000000000-mapping.dmp

Download
memory/1536-77-0x0000000000000000-mapping.dmp

Download
memory/1544-61-0x00000000750F1000-0x00000000750F3000-memory.dmp

Filesize
8KB

Download
memory/1544-63-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1544-59-0x0000000000000000-mapping.dmp

Download
memory/1572-76-0x0000000000000000-mapping.dmp

Download
memory/1688-62-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-58-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2008-57-0x0000000075260000-0x0000000075332000-memory.dmp

Filesize
840KB

Download
memory/2008-56-0x0000000075260000-0x0000000075281000-memory.dmp

Filesize
132KB

Download
memory/2008-55-0x00000000759B1000-0x00000000759B3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads