qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll
Size

833KB
MD5

5f00035c9fb5b740abaee795979b82ed
SHA1

6c980a4d7cc1461645acd4c763a86b9c4e896707
SHA256

a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4
SHA512

92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Score

10^/10

qakbot tr 1633597626 banker evasion persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633597626

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 4 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid process

1512 regsvr32.exe
2276 regsvr32.exe
1484 regsvr32.exe
3652 regsvr32.exe

pid	process
1512	regsvr32.exe
2276	regsvr32.exe
1484	regsvr32.exe
3652	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ebcgmjiwfc = "regsvr32.exe -s \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Qxejgzftttyl\\gpyboptheqas.dll\""	explorer.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

948 schtasks.exe
1144 schtasks.exe
3236 schtasks.exe

pid	process
948	schtasks.exe
1144	schtasks.exe
3236	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\b7d37c7a = af105e0c3ba05dd634627784ad5a55da0cedb268dded878aa6ef942226e28ea138f9b12d70f1ecb685789b654c01c5ce255310	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d772ff58490c0127cbc1fe6b15c7ab7ffdc390ecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\d2e3b63 = 10b9c2e5c8f9968d8514d1479bb9dda40e27a78d58d939218b31577c7457fccc20ccebb58a60c326cbce33ff75f1e6da592af5165ef6cb61ba6bdb4bbf323bd4d68c23387e603070e0794267a856bd223dca39bc3ca09ce12d3db24cd6763183dfd54be16693b152c6729fecc91bed0a063c6f207e9d816cd399d120b5156592e53c7dbe1270d54b604d79bc35613d41b167b9178c82678c065891cb68c580217844fd057f625382e37303c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\b5925c06 = 2e791ba6f8829bda1925b89cb01eaa24244a7b8eed1f5807979c566f69447f0195333c3a70fe5747a867e84df9d43e9a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d477f559490c0127cbc1fe6b15c7ab7ffdce9be0b21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d472f358490c0127cbc1fe6b15c7ab7ffec295eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d777f053490c0127cbc1fe6b15c7ab7ffdc796eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d674f555490c0127cbc1fe6b15c7ab7ffcc59ae1b21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\b5925c06 = 2e791ba6f882ab181b25b89cb01eaa24244a7b8eed1f5807979c566f69447f0195333c3a70fe5747a867e84df9d43e9a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d673f350490c0127cbc1fe6b15c7ab7ffcc194efb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bde1d270ff52490c0127cbc1fe6b15c7a87ef8ce92ebb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee3df7ff756490c0127cbc1fe6b15c7ab7cf5ce92eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d674f555490c0127cbc1fe6b15c7ab7ffcc395eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d477f559490c0127cbc1fe6b15c7ab7ffec49aecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\47f884db = 86dfcd7f3c77cb5e9a662c66733be116147ed917454846be286833a4f21fa56a319fed6d924efb85e734bcdf741b79b51e625f1c53186bbc4091147e49068607f67e1096a9f25e141b858b8b44e7a9aa14c034b5169925f7ea0c2be65487	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\47f884db = 86dfcd7f3c771f579a662c66733be116147ed917454846be286833a4f21fa56a319fed6d924efb85e734bcdf741b79b51e625f1c53186bbc4091147e49068607f67e1096a9f25e141b858b8b44e7a9aa14c034b5169925f7ea0c2be65487	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee3df7ff756490c0127cbc1fe6b15c7ab7ffcc79befb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\72675495 = c8f546e5c8c90a6206b880330a96d78bfe65929cb676ab552e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075db9f086424ea566b7f11758e30050c9d91356eac1993bd59695da776e0de	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d472f358490c0127cbc1fe6b15c7ab7ffec49aecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075cc9f086411241d3ae75902f7b9e7dd77f152000a0f2ccfc8f65dd388f4e1f8b3e06261048fcb1122a144c1974fd43d1c4fcdb9	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d67ef254490c0127cbc1fe6b15c7ab7ffdc796eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d777f053490c0127cbc1fe6b15c7ab7ffdc390ecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d772ff58490c0127cbc1fe6b15c7ab7ffdc193edb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d77ef757490c0127cbc1fe6b15c7ab7ffdcf92efb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\f6f1b1f = 227740df14d86265742cb2bf2c8888f904b340682723c2a708f66ea53475309eae213ff585	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d674f555490c0127cbc1fe6b15c7ab7ffcc79befb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d67ef254490c0127cbc1fe6b15c7ab7ffccf97ecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rundll32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid process

3828 rundll32.exe
3828 rundll32.exe
1512 regsvr32.exe
1512 regsvr32.exe
2276 regsvr32.exe
2276 regsvr32.exe
3652 regsvr32.exe
3652 regsvr32.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

rundll32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid process

3828 rundll32.exe
1512 regsvr32.exe
2276 regsvr32.exe
3652 regsvr32.exe

pid	process
3828	rundll32.exe
3828	rundll32.exe
1512	regsvr32.exe
1512	regsvr32.exe
2276	regsvr32.exe
2276	regsvr32.exe
3652	regsvr32.exe
3652	regsvr32.exe

pid	process
3828	rundll32.exe
1512	regsvr32.exe
2276	regsvr32.exe
3652	regsvr32.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exeexplorer.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2892 wrote to memory of 3828	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 3828	2892	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 3828	2892	rundll32.exe	rundll32.exe
PID 3828 wrote to memory of 892	3828	rundll32.exe	explorer.exe
PID 3828 wrote to memory of 892	3828	rundll32.exe	explorer.exe
PID 3828 wrote to memory of 892	3828	rundll32.exe	explorer.exe
PID 3828 wrote to memory of 892	3828	rundll32.exe	explorer.exe
PID 3828 wrote to memory of 892	3828	rundll32.exe	explorer.exe
PID 892 wrote to memory of 1144	892	explorer.exe	schtasks.exe
PID 892 wrote to memory of 1144	892	explorer.exe	schtasks.exe
PID 892 wrote to memory of 1144	892	explorer.exe	schtasks.exe
PID 1992 wrote to memory of 1512	1992	regsvr32.exe	regsvr32.exe
PID 1992 wrote to memory of 1512	1992	regsvr32.exe	regsvr32.exe
PID 1992 wrote to memory of 1512	1992	regsvr32.exe	regsvr32.exe
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	explorer.exe
PID 1796 wrote to memory of 1784	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 1784	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 2012	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 2012	1796	explorer.exe	reg.exe
PID 3656 wrote to memory of 3232	3656	regsvr32.exe	regsvr32.exe
PID 3656 wrote to memory of 3232	3656	regsvr32.exe	regsvr32.exe
PID 3656 wrote to memory of 3232	3656	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 3236	1796	explorer.exe	schtasks.exe
PID 1796 wrote to memory of 3236	1796	explorer.exe	schtasks.exe
PID 1796 wrote to memory of 3236	1796	explorer.exe	schtasks.exe
PID 1796 wrote to memory of 2276	1796	explorer.exe	regsvr32.exe
PID 1796 wrote to memory of 2276	1796	explorer.exe	regsvr32.exe
PID 1796 wrote to memory of 2276	1796	explorer.exe	regsvr32.exe
PID 892 wrote to memory of 1484	892	explorer.exe	regsvr32.exe
PID 892 wrote to memory of 1484	892	explorer.exe	regsvr32.exe
PID 892 wrote to memory of 1484	892	explorer.exe	regsvr32.exe
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	explorer.exe
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	explorer.exe
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	explorer.exe
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	explorer.exe
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	explorer.exe
PID 3792 wrote to memory of 1212	3792	explorer.exe	schtasks.exe
PID 3792 wrote to memory of 1212	3792	explorer.exe	schtasks.exe
PID 3792 wrote to memory of 1212	3792	explorer.exe	schtasks.exe
PID 3732 wrote to memory of 948	3732	explorer.exe	schtasks.exe
PID 3732 wrote to memory of 948	3732	explorer.exe	schtasks.exe
PID 3732 wrote to memory of 948	3732	explorer.exe	schtasks.exe
PID 1708 wrote to memory of 3652	1708	regsvr32.exe	regsvr32.exe
PID 1708 wrote to memory of 3652	1708	regsvr32.exe	regsvr32.exe
PID 1708 wrote to memory of 3652	1708	regsvr32.exe	regsvr32.exe
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zdebjizaw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll\"" /SC ONCE /Z /ST 02:05 /ET 02:17
      4⤵
      Creates scheduled task(s)
      PID:1144
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll"
      4⤵
      Loads dropped DLL
      PID:1484
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mfesgrwbu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll\"" /SC ONCE /Z /ST 10:07 /ET 10:19
        6⤵
        Creates scheduled task(s)
        
        PID:948

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uotnuabg" /d "0"
      4⤵
      PID:1784
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl" /d "0"
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN 2415919104 /TR "regsvr32.exe -s "C:\ProgramData\Microsoft\Uotnuabg\xfylwslksvzslla.dll"" /NP /F
      4⤵
      Creates scheduled task(s)
      PID:3236
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe -s "C:\ProgramData\Microsoft\Uotnuabg\xfylwslksvzslla.dll"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3792
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Delete /F /TN 2415919104
        6⤵
        
        PID:1212

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
  2⤵
  PID:3232

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Uotnuabg\xfylwslksvzslla.dll

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll

MD5
6ebeb38673e450f52b193ee9869eab57

SHA1
a254c9b349cdc83b5db8a6e32b90e65c27595043

SHA256
9b85041efff94d82356a34560c828af70565dad52037301dd7f7a1f93fc81e72

SHA512
9c918ab9e6373d6a5ac7530c42571af492b01c30fffde476eb6b5292fc93f301f8216d7a8b6b61f1cb6d01f4ef4f24256346c95d3499605d18266fb206cffe46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll

MD5
1e7e16b8cb7b27f07b632bbc0e367e5c

SHA1
913ddc9d687a121257cfd2216d2da0307771d57d

SHA256
190fcacda3bb2e1272b864aca0ff5a34f8c66540db9f088ef3038e053e6d2805

SHA512
c61ceef8d258ed96571a474150f244029ca0b105df16e56e209e24382ca8b997c6afae5a698d587e8b08ce49006f8af73e19329535a8baeb6ddda2c24457a3ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\Microsoft\Uotnuabg\xfylwslksvzslla.dll

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
memory/892-124-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/892-123-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/892-121-0x0000000000530000-0x0000000000551000-memory.dmp

Filesize
132KB

Download
memory/892-120-0x0000000000000000-mapping.dmp

Download
memory/892-145-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/948-160-0x0000000000000000-mapping.dmp

Download
memory/1144-122-0x0000000000000000-mapping.dmp

Download
memory/1212-155-0x0000000000000000-mapping.dmp

Download
memory/1484-146-0x0000000000000000-mapping.dmp

Download
memory/1512-129-0x0000000072EF0000-0x0000000072F11000-memory.dmp

Filesize
132KB

Download
memory/1512-126-0x0000000000000000-mapping.dmp

Download
memory/1512-128-0x0000000072EF0000-0x0000000073061000-memory.dmp

Filesize
1.4MB

Download
memory/1512-130-0x0000000072EF0000-0x0000000073061000-memory.dmp

Filesize
1.4MB

Download
memory/1512-131-0x0000000002690000-0x000000000273E000-memory.dmp

Filesize
696KB

Download
memory/1784-133-0x0000000000000000-mapping.dmp

Download
memory/1796-132-0x0000000000000000-mapping.dmp

Download
memory/1796-135-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1796-136-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1796-140-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1796-137-0x0000000002FB0000-0x0000000002FD1000-memory.dmp

Filesize
132KB

Download
memory/1952-171-0x0000000000170000-0x0000000000191000-memory.dmp

Filesize
132KB

Download
memory/1952-170-0x0000000000000000-mapping.dmp

Download
memory/2012-134-0x0000000000000000-mapping.dmp

Download
memory/2276-142-0x0000000000000000-mapping.dmp

Download
memory/2276-148-0x0000000072960000-0x0000000072AD1000-memory.dmp

Filesize
1.4MB

Download
memory/2276-149-0x0000000072960000-0x0000000072981000-memory.dmp

Filesize
132KB

Download
memory/2276-150-0x0000000072960000-0x0000000072AD1000-memory.dmp

Filesize
1.4MB

Download
memory/2276-152-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3232-139-0x0000000000000000-mapping.dmp

Download
memory/3236-141-0x0000000000000000-mapping.dmp

Download
memory/3652-164-0x0000000000000000-mapping.dmp

Download
memory/3652-169-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3652-168-0x0000000072A10000-0x0000000072B81000-memory.dmp

Filesize
1.4MB

Download
memory/3652-167-0x0000000072A10000-0x0000000072A31000-memory.dmp

Filesize
132KB

Download
memory/3652-166-0x0000000072A10000-0x0000000072B81000-memory.dmp

Filesize
1.4MB

Download
memory/3732-161-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3732-162-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3792-156-0x0000000003A60000-0x0000000003A61000-memory.dmp

Filesize
4KB

Download
memory/3792-158-0x0000000002FB0000-0x0000000002FD1000-memory.dmp

Filesize
132KB

Download
memory/3792-157-0x0000000003A60000-0x0000000003A61000-memory.dmp

Filesize
4KB

Download
memory/3792-153-0x0000000000000000-mapping.dmp

Download
memory/3828-118-0x0000000074190000-0x0000000074301000-memory.dmp

Filesize
1.4MB

Download
memory/3828-116-0x0000000074190000-0x0000000074301000-memory.dmp

Filesize
1.4MB

Download
memory/3828-117-0x0000000074190000-0x00000000741B1000-memory.dmp

Filesize
132KB

Download
memory/3828-119-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download
memory/3828-115-0x0000000000000000-mapping.dmp

Download