qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll
Size

1.1MB
MD5

2eb9fcc198e5adc902797ad4cf6b44d6
SHA1

4e3451336ed44af410fdd4fa91316f80fc695fb2
SHA256

839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3
SHA512

2cac97e753a35a328a273f72eeec97cc143c0c245d0a59dbac8cffb06f7862ee723c54428d11366b3cabc5673751893ce85d62bdb531e6fdc32676c10c1b9104

Score

10^/10

qakbot tr 1633943125 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633943125

140.82.49.12:443

89.137.52.44:443

24.107.165.50:443

66.216.193.114:443

75.131.217.182:443

41.86.42.158:995

24.119.214.7:443

67.166.233.75:443

105.198.236.99:443

120.151.47.189:443

2.222.167.138:443

41.228.22.180:443

78.105.213.151:995

5.193.125.67:995

41.86.42.158:443

96.57.188.174:2078

120.150.218.241:995

66.177.215.152:0

122.11.220.212:2222

73.52.50.32:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1784 regsvr32.exe

pid	process
1784	regsvr32.exe

Drops file in System32 directory 12 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2812 schtasks.exe

pid	process
2812	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\c674fa7f = 3811ba2ea7e1a3df3078a272b984f26b10a0d51aeeaa2340c8bcd4c1d5c9e7f9f2f1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed578c6878d01d9d9bcd4f6bbb83fe18021c702dddf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55846379d01d9d9bcd4f6bbb83fe18021e7b2fdbf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed528d6a75d01d9d9bcd4f6bbb83fe180219702bd4f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55806b78d01d9d9bcd4f6bbb83fe18021e7f2cdef4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52816272d01d9d9bcd4f6bbb83fe1802197e2adaf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976a28affd4f8b46f1054a96c2a5353ccd97bbf5409824b6b0d698a69f3003bab87b3553e1d672a1e5362b33dca92c27857e2d700c4c03bd910e0e2a003621a62e4f76f7bb97f080f01b215e3ba87db4dcbb21b48e4ebcfec0096501e64d36bdae879bf74c7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976b58affd4cdbad0e810955485deeb5d846c7299189198ce476e8d8545ed416d4389537d276fd8b1ef013bd2db549dae1d5384331fedaaec715788550589fce16cdf0e5d494f697f07476833aa08fdd1077f38fbdcbaab1d03ed08c808a4fc42e664a753fd37c7977d1d94df5e69e508997648fff4299ba150d9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed558d6e70d01d9d9bcd4f6bbb83fe18021e712dd9f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\7ec89d1a = a5622f92ffd6f881f09600f1652803b2f440d5e35dfba59934fc7cc2861492d07815cad2e1e8ed5933859d4d00c93ad3396fe4ea4f226778020a4a6bf4be7e249fd74a7cd669dda1d39fb66b63c929d0dd3e5d7999bf552245c59e7252046803bc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\341e22a2 = d082c0060210f2a53496941afcf95b47a022142b04f523cdb0cc66cd347517a16afd72e1ecb85edcae8f7d89bff45e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52846c73d01d9d9bcd4f6bbb83fe1802197a24dcf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52816272d01d9d9bcd4f6bbb83fe1802197c25dff4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\c435da03 = 9140925b961cc086bb83f60576df392e98cd804db9efd2c33b631fdbaf3403025e3277f175ea71572fd013d29b8f11943f8203ed25dcf8ea6e6d40214744401626000f9f947916c85a75bcc09de7a7d5de6163b3f9679bd5674ad045db6b4f89a6f2f4f1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed558d6e70d01d9d9bcd4f6bbb83fe1802197824d4f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55846379d01d9d9bcd4f6bbb83fe18021e792ed8f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\7c89bd66 = a43e63a7bda6723cf053355f2ba45843ab8b977b263d0f5a4742321b8b11713368e81fbddffb24778a93697c1901bace404057188e633b06b926ccdd7bc3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\181f2ec = a598fad7021f38a062e7557bb2b027f0ddc427f42b1f9e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed578c6878d01d9d9bcd4f6bbb83fe18021c7124dff4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed528d6a75d01d9d9bcd4f6bbb83fe1802197e2adaf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed57836b73d01d9d9bcd4f6bbb83fe18021c7e2cdef4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed54806c71d01d9d9bcd4f6bbb83fe18021f7f28def4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55806b78d01d9d9bcd4f6bbb83fe18021e7d2cd5f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed548d6d76d01d9d9bcd4f6bbb83fe18021f7129ddf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed558d6e70d01d9d9bcd4f6bbb83fe18021e7f2cdef4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52846c73d01d9d9bcd4f6bbb83fe1802197824d4f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976b58affd4cdbad0e810955485deeb5d846c7299189198c846698d8545ed416d4389537d276fd8b1ef013bd2db549dae1d5384331fedaaec715788550589fce16cdf0e5d494f697f07476833aa08fdd1077f38fbdcbaab1d03ed08c808a4fc42e664a753fd37c7977d1d94df5e69e508997648fff4299ba150d9	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2936 rundll32.exe
2936 rundll32.exe
1784 regsvr32.exe
1784 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2936 rundll32.exe
1784 regsvr32.exe

pid	process
2936	rundll32.exe
2936	rundll32.exe
1784	regsvr32.exe
1784	regsvr32.exe

pid	process
2936	rundll32.exe
1784	regsvr32.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 4000 wrote to memory of 2936	4000	rundll32.exe	rundll32.exe
PID 4000 wrote to memory of 2936	4000	rundll32.exe	rundll32.exe
PID 4000 wrote to memory of 2936	4000	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 508	2936	rundll32.exe	explorer.exe
PID 2936 wrote to memory of 508	2936	rundll32.exe	explorer.exe
PID 2936 wrote to memory of 508	2936	rundll32.exe	explorer.exe
PID 2936 wrote to memory of 508	2936	rundll32.exe	explorer.exe
PID 2936 wrote to memory of 508	2936	rundll32.exe	explorer.exe
PID 508 wrote to memory of 2812	508	explorer.exe	schtasks.exe
PID 508 wrote to memory of 2812	508	explorer.exe	schtasks.exe
PID 508 wrote to memory of 2812	508	explorer.exe	schtasks.exe
PID 1520 wrote to memory of 1784	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 1784	1520	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 1784	1520	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 952	1784	regsvr32.exe	explorer.exe
PID 1784 wrote to memory of 952	1784	regsvr32.exe	explorer.exe
PID 1784 wrote to memory of 952	1784	regsvr32.exe	explorer.exe
PID 1784 wrote to memory of 952	1784	regsvr32.exe	explorer.exe
PID 1784 wrote to memory of 952	1784	regsvr32.exe	explorer.exe
PID 952 wrote to memory of 1060	952	explorer.exe	reg.exe
PID 952 wrote to memory of 1060	952	explorer.exe	reg.exe
PID 952 wrote to memory of 3564	952	explorer.exe	reg.exe
PID 952 wrote to memory of 3564	952	explorer.exe	reg.exe
PID 3468 wrote to memory of 3176	3468	regsvr32.exe	regsvr32.exe
PID 3468 wrote to memory of 3176	3468	regsvr32.exe	regsvr32.exe
PID 3468 wrote to memory of 3176	3468	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:508

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hslebksywe /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll\"" /SC ONCE /Z /ST 09:07 /ET 09:19
4⤵
- Creates scheduled task(s)
PID:2812

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ymkfq" /d "0"
4⤵
PID:1060

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pedzlfaytfep" /d "0"
4⤵
PID:3564

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
2⤵
PID:3176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll
MD5
2eb9fcc198e5adc902797ad4cf6b44d6

SHA1
4e3451336ed44af410fdd4fa91316f80fc695fb2

SHA256
839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3

SHA512
2cac97e753a35a328a273f72eeec97cc143c0c245d0a59dbac8cffb06f7862ee723c54428d11366b3cabc5673751893ce85d62bdb531e6fdc32676c10c1b9104

Download Submit
C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll
MD5
20758b5943b4e76780f4a210e5797dce

SHA1
2d6085cea9a5d66933fa29d9b52858e02036c6cb

SHA256
f42449fa925093825f47f82b54863c9d9c5951edcc8cb5dd985080b53b276d98

SHA512
8dd3d806837a4d58d066e7c476ffa28c8c1a5813e5085a7be6dd3445bd31e19708bc7293a0cfdb029c228fc6c232dc0526919ab3b51978514f836dd2fe09b1f8

Download Submit
\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll
MD5
2eb9fcc198e5adc902797ad4cf6b44d6

SHA1
4e3451336ed44af410fdd4fa91316f80fc695fb2

SHA256
839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3

SHA512
2cac97e753a35a328a273f72eeec97cc143c0c245d0a59dbac8cffb06f7862ee723c54428d11366b3cabc5673751893ce85d62bdb531e6fdc32676c10c1b9104

Download Submit
memory/508-123-0x0000000000000000-mapping.dmp

Download
memory/508-125-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/508-126-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/508-127-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download
memory/952-140-0x00000000008D0000-0x00000000008F1000-memory.dmp

Filesize
132KB

Download
memory/952-138-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/952-139-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/952-135-0x0000000000000000-mapping.dmp

Download
memory/1060-136-0x0000000000000000-mapping.dmp

Download
memory/1784-129-0x0000000000000000-mapping.dmp

Download
memory/1784-131-0x0000000072CF0000-0x0000000072EA5000-memory.dmp

Filesize
1.7MB

Download
memory/1784-132-0x0000000072CF0000-0x0000000072D11000-memory.dmp

Filesize
132KB

Download
memory/1784-133-0x0000000072CF0000-0x0000000072EA5000-memory.dmp

Filesize
1.7MB

Download
memory/1784-134-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2812-124-0x0000000000000000-mapping.dmp

Download
memory/2936-118-0x0000000000000000-mapping.dmp

Download
memory/2936-122-0x0000000000780000-0x000000000082E000-memory.dmp

Filesize
696KB

Download
memory/2936-121-0x0000000074020000-0x00000000741D5000-memory.dmp

Filesize
1.7MB

Download
memory/2936-120-0x0000000074020000-0x0000000074041000-memory.dmp

Filesize
132KB

Download
memory/2936-119-0x0000000074020000-0x00000000741D5000-memory.dmp

Filesize
1.7MB

Download
memory/3176-142-0x0000000000000000-mapping.dmp

Download
memory/3564-137-0x0000000000000000-mapping.dmp

Download