Analysis
-
max time kernel
1797s -
max time network
1827s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-10-2021 17:59
Static task
static1
Behavioral task
behavioral1
Sample
rob.html.dll
Resource
win7v20210408
General
-
Target
rob.html.dll
-
Size
846KB
-
MD5
3283652c1e57afef22993b466cc7440f
-
SHA1
412262cff6773355f271be7f2a3ebc1a01d73194
-
SHA256
5d24821c2558cc18b84c341cde0a93dc090c9311864f65e85624b5746eda560d
-
SHA512
90501854198a1ac9145223cedfb14880ef7507b13ce2cd0ac938c940d572e13e0155fc31f77f50907a01e1787245c3dff2f3f7206bd6dd13844cba4a56d04d80
Malware Config
Extracted
qakbot
402.363
tr
1633597626
120.150.218.241:995
185.250.148.74:443
89.137.52.44:443
66.103.170.104:2222
86.8.177.143:443
216.201.162.158:443
174.54.193.186:443
103.148.120.144:443
188.50.169.158:443
124.123.42.115:2222
140.82.49.12:443
199.27.127.129:443
81.241.252.59:2078
209.142.97.161:995
209.50.20.255:443
73.230.205.91:443
200.232.214.222:995
103.142.10.177:443
2.222.167.138:443
41.228.22.180:443
122.11.220.212:2222
78.191.58.219:995
47.22.148.6:443
74.72.237.54:443
217.17.56.163:465
96.57.188.174:2078
94.200.181.154:443
37.210.152.224:995
201.93.111.2:995
202.134.178.157:443
89.101.97.139:443
73.52.50.32:443
188.55.235.110:995
27.223.92.142:995
181.118.183.94:443
136.232.34.70:443
186.32.163.199:443
72.173.78.211:443
76.25.142.196:443
45.46.53.140:2222
98.157.235.126:443
173.21.10.71:2222
73.151.236.31:443
71.74.12.34:443
75.75.179.226:443
167.248.117.81:443
67.165.206.193:993
47.40.196.233:2222
72.252.201.69:443
181.4.53.6:465
109.12.111.14:443
24.171.50.5:443
24.139.72.117:443
24.55.112.61:443
24.229.150.54:995
77.57.204.78:443
81.250.153.227:2222
49.33.237.65:443
66.177.215.152:50010
177.170.201.134:995
75.188.35.168:443
120.151.47.189:443
173.25.162.221:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
39.52.229.8:995
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
69.30.186.190:443
189.131.221.201:443
68.204.7.158:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
24.119.214.7:443
63.70.164.200:995
177.94.125.59:995
82.18.173.253:2222
73.130.180.25:443
217.17.56.163:2078
162.244.227.34:443
75.66.88.33:443
206.47.134.234:2222
167.248.54.34:2222
73.77.87.137:443
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
162.210.220.137:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
97.98.130.50:443
196.117.224.53:995
191.191.38.8:443
188.210.210.122:443
96.46.103.109:2222
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1744 regsvr32.exe -
Drops file in System32 directory 6 IoCs
Processes:
explorer.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1] explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 explorer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 40b7fb2083bcd701 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b90c026fd9ac0374569c2980506036074a8b0a23eb0859fb762a7d4e0ddad6ba8f5d22e64d16fedf16f702c3cf50b982f92ac234777daa46628089369f6c8e6359b5de17dabbe50955da336e535cdd65e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\f0056770 = 32bb13c54b99cb09b7db034a08f0977c57cde76c4714706bf7b876c7 explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b8ec026fdaf2159db1fc2b2a6410e80dd846214b027272d38b61eb9ed9e2c6979b822e975fef6e6a8c4ab3a502d11f3653442f8d7d727c9340fc02d8c89ad9c87c8efd75fbcc678a20c31031a2a49a842934b049479c45b818dea4763aad24946cef2fe272885c6ed3656c0b20ea8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\4af82069 = f89551e86ade92e12a52ca826e8ad5e6cd906ffab228f1169b2d28848e93c8feefa264 explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b8ec026fdaf2159db1fc2b2a6410e80db816514b027272d38b61eb9ed9e2c697dba23e975fef6e6a8c4ab3a502d11f3653442f8d7d727c9340fc02d8c89ad9c87c8efd75fbcc678a20c31031a2a49a842934b049479c45b818dea4763aad24946cef2fe272885c6ed3656c0b20ea8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b8ec026fdaf2159db1fc2b2a6410e87dd896614b027272d38b61eb9ed9e2c6e79b526e975fef6e6a8c4ab3a502d11f3653442f8d7d727c9340fc02d8c89ad9c87c8efd75fbcc678a20c31031a2a49a842934b049479c45b818dea4763aad24946cef2fe272885c6ed3656c0b20ea8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\8f4c0886 = fdccfdf10e8d376b9bf5d55e12e1acf0f45bc257591a1ee72c28effbeb8b256ec085749cc7aa0fac8b6317a4b6ed978d324e6e8d98e115ecb1c705f0953b8779bd1e522d explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = a07a053182bcd701 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b87c026fdaf2159db1e88b2ae440d8fdb86665bb42e262832b52850810c596b571c65d67b3f4b44546097daec4d6a64dec08be771b2eaeb7c9a8e6573d0f9ae265c2823105fc5999e6a414616849f32dbb202a4de848d5b3159e7197ad5901c06f3808e22fd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b8ec026fdaf2159db1fc2b2a6410e87dd896614b027272d38b61eb9ed9e2c6e77b420e975fef6e6a8c4ab3a502d11f3653442f8d7d727c9340fc02d8c89ad9c87c8efd75fbcc678a20c31031a2a49a842934b049479c45b818dea4763aad24946cef2fe272885c6ed3656c0b20ea8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecisionTime = c08ee8eb82bcd701 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 00d69f8082bcd701 explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\4a-bf-ca-a0-7c-46 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecisionTime = a07a053182bcd701 explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecisionReason = "1" explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecision = "0" explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b8ec026fdaf2159db1fc2b2a6410e80dd846214b027272d38b61eb9ed9e2c6977bf23e975fef6e6a8c4ab3a502d11f3653442f8d7d727c9340fc02d8c89ad9c87c8efd75fbcc678a20c31031a2a49a842934b049479c45b818dea4763aad24946cef2fe272885c6ed3656c0b20ea8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDetectedUrl explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecisionTime = c0cfb6fb81bcd701 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\48b90015 = 4a2f9d6f33a43009e0e0de9c2d25463ef77cd19615855b9924d4047263d16202f682c8d9bdcde96d246b804250c0700ecbffe666fc28d776114fe86f3ef1d149fcc4f5ed1737e716f0efd92ab082f444c305cec71665ecc58f2dc95889eea04057c3f93f6dae22c6dfcd800c13f5e152aef6f583a9afe5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\7d26d05b = 782b87c026fdaf2159db1e88b2ae440d8fdb86665bb42e262a33b32850810c596b571c65d67b3f4b44546097daec4d6a64dec08be771b2eaeb7c9a8e6573d0f9ae265c2823105fc5999e6a414616849f32dbb202a4de848d5b3159e7197ad5901c06f3808e22fd explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46 explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aiwrhbqx\26fbfad = 3ab320915f2ccda0214ee015f383b3a10ff44e109904a18b2abbb862fbec23bea6b6e2b1c00779a48967f6f293eb9bc895357400ae959df564c4696365f84579d626c6f851e226f1a8a13a109118ee708ca7b010a75bf8740835aedb4dc10818fbf0d4f3b7d30ff4f7d9799f4fb7e74e explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Aiwrhbqx explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 836 rundll32.exe 1744 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 836 rundll32.exe 1744 regsvr32.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1824 wrote to memory of 836 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 836 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 836 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 836 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 836 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 836 1824 rundll32.exe rundll32.exe PID 1824 wrote to memory of 836 1824 rundll32.exe rundll32.exe PID 836 wrote to memory of 1728 836 rundll32.exe explorer.exe PID 836 wrote to memory of 1728 836 rundll32.exe explorer.exe PID 836 wrote to memory of 1728 836 rundll32.exe explorer.exe PID 836 wrote to memory of 1728 836 rundll32.exe explorer.exe PID 836 wrote to memory of 1728 836 rundll32.exe explorer.exe PID 836 wrote to memory of 1728 836 rundll32.exe explorer.exe PID 1728 wrote to memory of 1760 1728 explorer.exe schtasks.exe PID 1728 wrote to memory of 1760 1728 explorer.exe schtasks.exe PID 1728 wrote to memory of 1760 1728 explorer.exe schtasks.exe PID 1728 wrote to memory of 1760 1728 explorer.exe schtasks.exe PID 1552 wrote to memory of 588 1552 taskeng.exe regsvr32.exe PID 1552 wrote to memory of 588 1552 taskeng.exe regsvr32.exe PID 1552 wrote to memory of 588 1552 taskeng.exe regsvr32.exe PID 1552 wrote to memory of 588 1552 taskeng.exe regsvr32.exe PID 1552 wrote to memory of 588 1552 taskeng.exe regsvr32.exe PID 588 wrote to memory of 1744 588 regsvr32.exe regsvr32.exe PID 588 wrote to memory of 1744 588 regsvr32.exe regsvr32.exe PID 588 wrote to memory of 1744 588 regsvr32.exe regsvr32.exe PID 588 wrote to memory of 1744 588 regsvr32.exe regsvr32.exe PID 588 wrote to memory of 1744 588 regsvr32.exe regsvr32.exe PID 588 wrote to memory of 1744 588 regsvr32.exe regsvr32.exe PID 588 wrote to memory of 1744 588 regsvr32.exe regsvr32.exe PID 1744 wrote to memory of 1508 1744 regsvr32.exe explorer.exe PID 1744 wrote to memory of 1508 1744 regsvr32.exe explorer.exe PID 1744 wrote to memory of 1508 1744 regsvr32.exe explorer.exe PID 1744 wrote to memory of 1508 1744 regsvr32.exe explorer.exe PID 1744 wrote to memory of 1508 1744 regsvr32.exe explorer.exe PID 1744 wrote to memory of 1508 1744 regsvr32.exe explorer.exe PID 1508 wrote to memory of 952 1508 explorer.exe reg.exe PID 1508 wrote to memory of 952 1508 explorer.exe reg.exe PID 1508 wrote to memory of 952 1508 explorer.exe reg.exe PID 1508 wrote to memory of 952 1508 explorer.exe reg.exe PID 1508 wrote to memory of 904 1508 explorer.exe reg.exe PID 1508 wrote to memory of 904 1508 explorer.exe reg.exe PID 1508 wrote to memory of 904 1508 explorer.exe reg.exe PID 1508 wrote to memory of 904 1508 explorer.exe reg.exe PID 1628 wrote to memory of 1368 1628 taskeng.exe regsvr32.exe PID 1628 wrote to memory of 1368 1628 taskeng.exe regsvr32.exe PID 1628 wrote to memory of 1368 1628 taskeng.exe regsvr32.exe PID 1628 wrote to memory of 1368 1628 taskeng.exe regsvr32.exe PID 1628 wrote to memory of 1368 1628 taskeng.exe regsvr32.exe PID 1368 wrote to memory of 964 1368 regsvr32.exe regsvr32.exe PID 1368 wrote to memory of 964 1368 regsvr32.exe regsvr32.exe PID 1368 wrote to memory of 964 1368 regsvr32.exe regsvr32.exe PID 1368 wrote to memory of 964 1368 regsvr32.exe regsvr32.exe PID 1368 wrote to memory of 964 1368 regsvr32.exe regsvr32.exe PID 1368 wrote to memory of 964 1368 regsvr32.exe regsvr32.exe PID 1368 wrote to memory of 964 1368 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rob.html.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rob.html.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xlvsrcjlo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\rob.html.dll\"" /SC ONCE /Z /ST 20:03 /ET 20:154⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {31A2E240-944F-4E76-9B1D-CFBE22305DC5} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\rob.html.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\rob.html.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Rpieeo" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hshlh" /d "0"5⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {8CC05D74-D3A7-4094-AA73-4D86635C0A31} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\rob.html.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\rob.html.dll"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rob.html.dllMD5
3283652c1e57afef22993b466cc7440f
SHA1412262cff6773355f271be7f2a3ebc1a01d73194
SHA2565d24821c2558cc18b84c341cde0a93dc090c9311864f65e85624b5746eda560d
SHA51290501854198a1ac9145223cedfb14880ef7507b13ce2cd0ac938c940d572e13e0155fc31f77f50907a01e1787245c3dff2f3f7206bd6dd13844cba4a56d04d80
-
C:\Users\Admin\AppData\Local\Temp\rob.html.dllMD5
462f635466e1a1a120a3be0264bf57d7
SHA12afbb4dd4d6b658db5854e837ac0491f03c477dd
SHA256d477cdae90e4f0d8c017b8e9bcafc6677d91ed387c664d3c5073251f27d91111
SHA51201d61e14c4a2788bbf6943284a177fd206a1c013d0a35dd9c30771d4d3a78fe80ecd00b40af2a2cb9c49e6c8a687c9c3d09e38ed10bbeff0509b3136aa282502
-
\Users\Admin\AppData\Local\Temp\rob.html.dllMD5
3283652c1e57afef22993b466cc7440f
SHA1412262cff6773355f271be7f2a3ebc1a01d73194
SHA2565d24821c2558cc18b84c341cde0a93dc090c9311864f65e85624b5746eda560d
SHA51290501854198a1ac9145223cedfb14880ef7507b13ce2cd0ac938c940d572e13e0155fc31f77f50907a01e1787245c3dff2f3f7206bd6dd13844cba4a56d04d80
-
memory/588-73-0x000007FEFB631000-0x000007FEFB633000-memory.dmpFilesize
8KB
-
memory/588-72-0x0000000000000000-mapping.dmp
-
memory/836-64-0x0000000074340000-0x0000000074361000-memory.dmpFilesize
132KB
-
memory/836-0-0x0000000000000000-mapping.dmp
-
memory/836-1-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/836-63-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/836-62-0x0000000074340000-0x00000000744B1000-memory.dmpFilesize
1.4MB
-
memory/836-65-0x0000000074340000-0x00000000744B1000-memory.dmpFilesize
1.4MB
-
memory/904-88-0x0000000000000000-mapping.dmp
-
memory/952-85-0x0000000000000000-mapping.dmp
-
memory/964-92-0x0000000000000000-mapping.dmp
-
memory/1368-89-0x0000000000000000-mapping.dmp
-
memory/1508-82-0x0000000000000000-mapping.dmp
-
memory/1508-87-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1728-66-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1728-71-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1728-69-0x00000000741D1000-0x00000000741D3000-memory.dmpFilesize
8KB
-
memory/1728-67-0x0000000000000000-mapping.dmp
-
memory/1744-80-0x00000000738C0000-0x0000000073A31000-memory.dmpFilesize
1.4MB
-
memory/1744-79-0x00000000738C0000-0x00000000738E1000-memory.dmpFilesize
132KB
-
memory/1744-78-0x00000000738C0000-0x0000000073A31000-memory.dmpFilesize
1.4MB
-
memory/1744-86-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1744-75-0x0000000000000000-mapping.dmp
-
memory/1760-70-0x0000000000000000-mapping.dmp