qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll
Size

1.1MB
MD5

2eb9fcc198e5adc902797ad4cf6b44d6
SHA1

4e3451336ed44af410fdd4fa91316f80fc695fb2
SHA256

839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3
SHA512

2cac97e753a35a328a273f72eeec97cc143c0c245d0a59dbac8cffb06f7862ee723c54428d11366b3cabc5673751893ce85d62bdb531e6fdc32676c10c1b9104

Score

10^/10

qakbot tr 1633943125 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633943125

140.82.49.12:443

89.137.52.44:443

24.107.165.50:443

66.216.193.114:443

75.131.217.182:443

41.86.42.158:995

24.119.214.7:443

67.166.233.75:443

105.198.236.99:443

120.151.47.189:443

2.222.167.138:443

41.228.22.180:443

78.105.213.151:995

5.193.125.67:995

41.86.42.158:443

96.57.188.174:2078

120.150.218.241:995

66.177.215.152:0

122.11.220.212:2222

73.52.50.32:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1784	regsvr32.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2812	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\c674fa7f = 3811ba2ea7e1a3df3078a272b984f26b10a0d51aeeaa2340c8bcd4c1d5c9e7f9f2f1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed578c6878d01d9d9bcd4f6bbb83fe18021c702dddf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55846379d01d9d9bcd4f6bbb83fe18021e7b2fdbf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed528d6a75d01d9d9bcd4f6bbb83fe180219702bd4f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55806b78d01d9d9bcd4f6bbb83fe18021e7f2cdef4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52816272d01d9d9bcd4f6bbb83fe1802197e2adaf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976a28affd4f8b46f1054a96c2a5353ccd97bbf5409824b6b0d698a69f3003bab87b3553e1d672a1e5362b33dca92c27857e2d700c4c03bd910e0e2a003621a62e4f76f7bb97f080f01b215e3ba87db4dcbb21b48e4ebcfec0096501e64d36bdae879bf74c7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976b58affd4cdbad0e810955485deeb5d846c7299189198ce476e8d8545ed416d4389537d276fd8b1ef013bd2db549dae1d5384331fedaaec715788550589fce16cdf0e5d494f697f07476833aa08fdd1077f38fbdcbaab1d03ed08c808a4fc42e664a753fd37c7977d1d94df5e69e508997648fff4299ba150d9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed558d6e70d01d9d9bcd4f6bbb83fe18021e712dd9f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\7ec89d1a = a5622f92ffd6f881f09600f1652803b2f440d5e35dfba59934fc7cc2861492d07815cad2e1e8ed5933859d4d00c93ad3396fe4ea4f226778020a4a6bf4be7e249fd74a7cd669dda1d39fb66b63c929d0dd3e5d7999bf552245c59e7252046803bc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\341e22a2 = d082c0060210f2a53496941afcf95b47a022142b04f523cdb0cc66cd347517a16afd72e1ecb85edcae8f7d89bff45e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52846c73d01d9d9bcd4f6bbb83fe1802197a24dcf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52816272d01d9d9bcd4f6bbb83fe1802197c25dff4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\c435da03 = 9140925b961cc086bb83f60576df392e98cd804db9efd2c33b631fdbaf3403025e3277f175ea71572fd013d29b8f11943f8203ed25dcf8ea6e6d40214744401626000f9f947916c85a75bcc09de7a7d5de6163b3f9679bd5674ad045db6b4f89a6f2f4f1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed558d6e70d01d9d9bcd4f6bbb83fe1802197824d4f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55846379d01d9d9bcd4f6bbb83fe18021e792ed8f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\7c89bd66 = a43e63a7bda6723cf053355f2ba45843ab8b977b263d0f5a4742321b8b11713368e81fbddffb24778a93697c1901bace404057188e633b06b926ccdd7bc3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\181f2ec = a598fad7021f38a062e7557bb2b027f0ddc427f42b1f9e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed578c6878d01d9d9bcd4f6bbb83fe18021c7124dff4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed528d6a75d01d9d9bcd4f6bbb83fe1802197e2adaf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed57836b73d01d9d9bcd4f6bbb83fe18021c7e2cdef4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed54806c71d01d9d9bcd4f6bbb83fe18021f7f28def4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed55806b78d01d9d9bcd4f6bbb83fe18021e7d2cd5f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed548d6d76d01d9d9bcd4f6bbb83fe18021f7129ddf4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed558d6e70d01d9d9bcd4f6bbb83fe18021e7f2cdef4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976bc8affd4cdbad0e811df548bdaed52846c73d01d9d9bcd4f6bbb83fe1802197824d4f4b88d3a3b572d8b8fc587c2883a938d197bb57d66bc1ed4a85a4b77e3d89321554b8da44696170cb34a7249565c15cabbccb3aee447eafc8fa7b0d173d7b2a2f187d066b3f3e5dc3170b255692b06131439e753c78d4f292e238326d76a5208	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaukvrqumfv\4b574d54 = 3976b58affd4cdbad0e810955485deeb5d846c7299189198c846698d8545ed416d4389537d276fd8b1ef013bd2db549dae1d5384331fedaaec715788550589fce16cdf0e5d494f697f07476833aa08fdd1077f38fbdcbaab1d03ed08c808a4fc42e664a753fd37c7977d1d94df5e69e508997648fff4299ba150d9	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2936	rundll32.exe
2936	rundll32.exe
1784	regsvr32.exe
1784	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2936	rundll32.exe
1784	regsvr32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 2936	4000	rundll32.exe	69
PID 4000 wrote to memory of 2936	4000	rundll32.exe	69
PID 4000 wrote to memory of 2936	4000	rundll32.exe	69
PID 2936 wrote to memory of 508	2936	rundll32.exe	71
PID 2936 wrote to memory of 508	2936	rundll32.exe	71
PID 2936 wrote to memory of 508	2936	rundll32.exe	71
PID 2936 wrote to memory of 508	2936	rundll32.exe	71
PID 2936 wrote to memory of 508	2936	rundll32.exe	71
PID 508 wrote to memory of 2812	508	explorer.exe	72
PID 508 wrote to memory of 2812	508	explorer.exe	72
PID 508 wrote to memory of 2812	508	explorer.exe	72
PID 1520 wrote to memory of 1784	1520	regsvr32.exe	77
PID 1520 wrote to memory of 1784	1520	regsvr32.exe	77
PID 1520 wrote to memory of 1784	1520	regsvr32.exe	77
PID 1784 wrote to memory of 952	1784	regsvr32.exe	78
PID 1784 wrote to memory of 952	1784	regsvr32.exe	78
PID 1784 wrote to memory of 952	1784	regsvr32.exe	78
PID 1784 wrote to memory of 952	1784	regsvr32.exe	78
PID 1784 wrote to memory of 952	1784	regsvr32.exe	78
PID 952 wrote to memory of 1060	952	explorer.exe	79
PID 952 wrote to memory of 1060	952	explorer.exe	79
PID 952 wrote to memory of 3564	952	explorer.exe	81
PID 952 wrote to memory of 3564	952	explorer.exe	81
PID 3468 wrote to memory of 3176	3468	regsvr32.exe	85
PID 3468 wrote to memory of 3176	3468	regsvr32.exe	85
PID 3468 wrote to memory of 3176	3468	regsvr32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hslebksywe /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll\"" /SC ONCE /Z /ST 09:07 /ET 09:19
      4⤵
      Creates scheduled task(s)
      PID:2812

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ymkfq" /d "0"
      4⤵
      PID:1060
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pedzlfaytfep" /d "0"
      4⤵
      PID:3564

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll"
  2⤵
  PID:3176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-125-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/508-126-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/508-127-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download
memory/952-140-0x00000000008D0000-0x00000000008F1000-memory.dmp

Filesize
132KB

Download
memory/952-138-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/952-139-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1784-131-0x0000000072CF0000-0x0000000072EA5000-memory.dmp

Filesize
1.7MB

Download
memory/1784-132-0x0000000072CF0000-0x0000000072D11000-memory.dmp

Filesize
132KB

Download
memory/1784-133-0x0000000072CF0000-0x0000000072EA5000-memory.dmp

Filesize
1.7MB

Download
memory/1784-134-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2936-122-0x0000000000780000-0x000000000082E000-memory.dmp

Filesize
696KB

Download
memory/2936-121-0x0000000074020000-0x00000000741D5000-memory.dmp

Filesize
1.7MB

Download
memory/2936-120-0x0000000074020000-0x0000000074041000-memory.dmp

Filesize
132KB

Download
memory/2936-119-0x0000000074020000-0x00000000741D5000-memory.dmp

Filesize
1.7MB

Download