qakbot | b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

General

Target

test.test.dll
Size

820KB
MD5

398b4b11bd10b155bead7267c48fc869
SHA1

8c9338c72a4cbe4fe6929a2f16d506e171663a62
SHA256

b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d
SHA512

47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1052 regsvr32.exe

pid	process
1052	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

540 schtasks.exe

pid	process
540	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33e40e38ed96e907f66148970d2e572cdc42a502f6b46aa3874445d61bb09fce2d5329120681651d4dec28a048e3fe468bd63ffca8c51978fe97be2d2232030b4d56d4f3b53a88ec391b5dfe4c84ee056295993dfd4f479e2cab1336962cda5307399e62e024b6c9ae2c0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = 50a60e3bb9bed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecisionTime = b0399655babed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecisionTime = f0709763bbbed701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0109000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\ee5fccfd = b302bd9f812b78025ecd987b9a55215b0ad2e4c9f63da2d89d9db83f5de445	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecision = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = b0399655babed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = 30b84ef8babed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000010000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0109000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = 10f906c5babed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = 3002ab33bbbed701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = 70ff058dbabed701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000012000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0109000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33e40e38ed96e907f66148970d2e57cc4c12b502f6b46aa3874445d61bb09fde2d2369120681651d4dec28a048e3fe468bd63ffca8c51978fe97be2d2232030b4d56d4f3b53a88ec391b5dfe4c84ee056295993dfd4f479e2cab1336962cda5307399e62e024b6c9ae2c0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33740e38ed96e907f675e8978d9e27ec4c4211f256643ad347c729a89ec89c7b0347cab029d99adb6bf6f761affc0de8ccc22927b7e0b5f277da0e56d1fe7a96eb7a337cd65228432917a546ffabe5397874907c2c7b811ff120fc4a51af101cbf3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33e40e38ed96e907f66148970d2e572cdc42a502f6b46aa3874445d61bb09f3ead53a9120681651d4dec28a048e3fe468bd63ffca8c51978fe97be2d2232030b4d56d4f3b53a88ec391b5dfe4c84ee056295993dfd4f479e2cab1336962cda5307399e62e024b6c9ae2c0	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = f0709763bbbed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\93578377 = cf5b31f2b6411d0cdb1a9b220cbac1d037201bf4127144ce51f41879a9492d26919e48a7b0c4b0e503b392301a70d5e47c06ff7fefea33ddad0682fcc0e7a1d7d1cffdb3123bb2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33740e38ed96e907f675e8978d9e27ec4c4211f256643af3b72729a89ec89c7b0347cab029d99adb6bf6f761affc0de8ccc22927b7e0b5f277da0e56d1fe7a96eb7a337cd65228432917a546ffabe5397874907c2c7b811ff120fc4a51af101cbf3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecisionTime = 7055c46ab9bed701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000011000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0109000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecisionTime = 70d476edb9bed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecisionTime = 7099aa98bbbed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\9116a30b = 128a772e6c881dcc55dbdc11a8fe732d8d39b7b3d7d1240f7af36d14cc58849f978253cbecb948d280f5072d7eeba2d5b31577b7d029163a6ceeade7cfbc44e797f9bc06326f2bf3aa3e85f7ae415ab56cbbe2e43859d9e30ddb17e1835dba515c364df8eb14ee13554e457d87	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecisionTime = 10a28607b9bed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-35-aa-c3-83-8a\WpadDecisionTime = 10a28607b9bed701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33e40e38ed96e907f66148970d2e57dc4ca27502f6b46aa3874445d61bb09fce2d5329120681651d4dec28a048e3fe468bd63ffca8c51978fe97be2d2232030b4d56d4f3b53a88ec391b5dfe4c84ee056295993dfd4f479e2cab1336962cda5307399e62e024b6c9ae2c0	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33e40e38ed96e907f66148970d2e57dc0c227502f6b46aa3874445d61bb09fce6d7339120681651d4dec28a048e3fe468bd63ffca8c51978fe97be2d2232030b4d56d4f3b53a88ec391b5dfe4c84ee056295993dfd4f479e2cab1336962cda5307399e62e024b6c9ae2c0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33e40e38ed96e907f66148970d2e57dc0c227502f6b46aa3874445d61bb09fce4d0329120681651d4dec28a048e3fe468bd63ffca8c51978fe97be2d2232030b4d56d4f3b53a88ec391b5dfe4c84ee056295993dfd4f479e2cab1336962cda5307399e62e024b6c9ae2c0	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecision = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{85C57E2F-4604-4355-AAF9-0AD9D5C2A36F}\WpadDecisionTime = d03a5ee6b8bed701	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

860 rundll32.exe
1052 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

860 rundll32.exe
1052 regsvr32.exe

pid	process
860	rundll32.exe
1052	regsvr32.exe

pid	process
860	rundll32.exe
1052	regsvr32.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1144 wrote to memory of 860	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 860	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 860	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 860	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 860	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 860	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 860	1144	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 680	860	rundll32.exe	explorer.exe
PID 860 wrote to memory of 680	860	rundll32.exe	explorer.exe
PID 860 wrote to memory of 680	860	rundll32.exe	explorer.exe
PID 860 wrote to memory of 680	860	rundll32.exe	explorer.exe
PID 860 wrote to memory of 680	860	rundll32.exe	explorer.exe
PID 860 wrote to memory of 680	860	rundll32.exe	explorer.exe
PID 680 wrote to memory of 540	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 540	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 540	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 540	680	explorer.exe	schtasks.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 1716	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 1716	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 1716	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 1716	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 1716	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 1716	1052	regsvr32.exe	explorer.exe
PID 1716 wrote to memory of 1368	1716	explorer.exe	reg.exe
PID 1716 wrote to memory of 1368	1716	explorer.exe	reg.exe
PID 1716 wrote to memory of 1368	1716	explorer.exe	reg.exe
PID 1716 wrote to memory of 1368	1716	explorer.exe	reg.exe
PID 1716 wrote to memory of 1828	1716	explorer.exe	reg.exe
PID 1716 wrote to memory of 1828	1716	explorer.exe	reg.exe
PID 1716 wrote to memory of 1828	1716	explorer.exe	reg.exe
PID 1716 wrote to memory of 1828	1716	explorer.exe	reg.exe
PID 1172 wrote to memory of 1816	1172	taskeng.exe	regsvr32.exe
PID 1172 wrote to memory of 1816	1172	taskeng.exe	regsvr32.exe
PID 1172 wrote to memory of 1816	1172	taskeng.exe	regsvr32.exe
PID 1172 wrote to memory of 1816	1172	taskeng.exe	regsvr32.exe
PID 1172 wrote to memory of 1816	1172	taskeng.exe	regsvr32.exe
PID 1816 wrote to memory of 1492	1816	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 1492	1816	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 1492	1816	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 1492	1816	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 1492	1816	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 1492	1816	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 1492	1816	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xmhhyeed /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 15:51 /ET 16:03
4⤵
- Creates scheduled task(s)
PID:540

C:\Windows\system32\taskeng.exe
taskeng.exe {E4DC42AD-4815-42FB-B3E4-1F826B2E5053} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Tuxxzejueuu" /d "0"
5⤵
PID:1368

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nryngceudyam" /d "0"
5⤵
PID:1828

C:\Windows\system32\taskeng.exe
taskeng.exe {EF0403EC-06BC-47B7-873B-7B3723897183} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
3⤵
PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
398b4b11bd10b155bead7267c48fc869

SHA1
8c9338c72a4cbe4fe6929a2f16d506e171663a62

SHA256
b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

SHA512
47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
0aa7f635b14a48dd6e4a770e5d5a43f8

SHA1
3f0c55fa62843de2631084b79309181bfef5f1e0

SHA256
f5a865d1d477d59c9996ed8771329fe546a5cfe62cb8f8f2bcdecb9f9ff85184

SHA512
aec7c13e64832cbfe792ab40c6275058c25c586d8a07a5618b40b0d198fe6aaf31558f1b272a1ecefdafde4392b600c7b3ca681fec27b7eac06abf1414f871fe

Download Submit
\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
398b4b11bd10b155bead7267c48fc869

SHA1
8c9338c72a4cbe4fe6929a2f16d506e171663a62

SHA256
b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

SHA512
47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f

Download Submit
memory/540-63-0x0000000000000000-mapping.dmp

Download
memory/680-62-0x0000000074831000-0x0000000074833000-memory.dmp

Filesize
8KB

Download
memory/680-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/680-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/680-60-0x0000000000000000-mapping.dmp

Download
memory/836-66-0x000007FEFBC91000-0x000007FEFBC93000-memory.dmp

Filesize
8KB

Download
memory/836-65-0x0000000000000000-mapping.dmp

Download
memory/860-58-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/860-57-0x00000000749A0000-0x0000000074B11000-memory.dmp

Filesize
1.4MB

Download
memory/860-53-0x0000000000000000-mapping.dmp

Download
memory/860-56-0x00000000749A0000-0x00000000749C1000-memory.dmp

Filesize
132KB

Download
memory/860-54-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/860-55-0x00000000749A0000-0x0000000074B11000-memory.dmp

Filesize
1.4MB

Download
memory/1052-72-0x0000000073F20000-0x0000000073F41000-memory.dmp

Filesize
132KB

Download
memory/1052-71-0x0000000073F20000-0x0000000074091000-memory.dmp

Filesize
1.4MB

Download
memory/1052-73-0x0000000073F20000-0x0000000074091000-memory.dmp

Filesize
1.4MB

Download
memory/1052-74-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1052-68-0x0000000000000000-mapping.dmp

Download
memory/1368-79-0x0000000000000000-mapping.dmp

Download
memory/1492-85-0x0000000000000000-mapping.dmp

Download
memory/1716-76-0x0000000000000000-mapping.dmp

Download
memory/1716-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1816-82-0x0000000000000000-mapping.dmp

Download
memory/1828-80-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads