qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll
Size

833KB
MD5

5f00035c9fb5b740abaee795979b82ed
SHA1

6c980a4d7cc1461645acd4c763a86b9c4e896707
SHA256

a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4
SHA512

92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Score

10^/10

qakbot tr 1633597626 banker evasion persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633597626

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 4 IoCs

pid	Process
1512	regsvr32.exe
2276	regsvr32.exe
1484	regsvr32.exe
3652	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ebcgmjiwfc = "regsvr32.exe -s \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Qxejgzftttyl\\gpyboptheqas.dll\""	explorer.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
948	schtasks.exe
1144	schtasks.exe
3236	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\b7d37c7a = af105e0c3ba05dd634627784ad5a55da0cedb268dded878aa6ef942226e28ea138f9b12d70f1ecb685789b654c01c5ce255310	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d772ff58490c0127cbc1fe6b15c7ab7ffdc390ecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\d2e3b63 = 10b9c2e5c8f9968d8514d1479bb9dda40e27a78d58d939218b31577c7457fccc20ccebb58a60c326cbce33ff75f1e6da592af5165ef6cb61ba6bdb4bbf323bd4d68c23387e603070e0794267a856bd223dca39bc3ca09ce12d3db24cd6763183dfd54be16693b152c6729fecc91bed0a063c6f207e9d816cd399d120b5156592e53c7dbe1270d54b604d79bc35613d41b167b9178c82678c065891cb68c580217844fd057f625382e37303c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\b5925c06 = 2e791ba6f8829bda1925b89cb01eaa24244a7b8eed1f5807979c566f69447f0195333c3a70fe5747a867e84df9d43e9a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d477f559490c0127cbc1fe6b15c7ab7ffdce9be0b21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d472f358490c0127cbc1fe6b15c7ab7ffec295eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d777f053490c0127cbc1fe6b15c7ab7ffdc796eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d674f555490c0127cbc1fe6b15c7ab7ffcc59ae1b21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\b5925c06 = 2e791ba6f882ab181b25b89cb01eaa24244a7b8eed1f5807979c566f69447f0195333c3a70fe5747a867e84df9d43e9a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d673f350490c0127cbc1fe6b15c7ab7ffcc194efb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bde1d270ff52490c0127cbc1fe6b15c7a87ef8ce92ebb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee3df7ff756490c0127cbc1fe6b15c7ab7cf5ce92eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d674f555490c0127cbc1fe6b15c7ab7ffcc395eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d477f559490c0127cbc1fe6b15c7ab7ffec49aecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\47f884db = 86dfcd7f3c77cb5e9a662c66733be116147ed917454846be286833a4f21fa56a319fed6d924efb85e734bcdf741b79b51e625f1c53186bbc4091147e49068607f67e1096a9f25e141b858b8b44e7a9aa14c034b5169925f7ea0c2be65487	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\47f884db = 86dfcd7f3c771f579a662c66733be116147ed917454846be286833a4f21fa56a319fed6d924efb85e734bcdf741b79b51e625f1c53186bbc4091147e49068607f67e1096a9f25e141b858b8b44e7a9aa14c034b5169925f7ea0c2be65487	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee3df7ff756490c0127cbc1fe6b15c7ab7ffcc79befb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\72675495 = c8f546e5c8c90a6206b880330a96d78bfe65929cb676ab552e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075db9f086424ea566b7f11758e30050c9d91356eac1993bd59695da776e0de	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d472f358490c0127cbc1fe6b15c7ab7ffec49aecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075cc9f086411241d3ae75902f7b9e7dd77f152000a0f2ccfc8f65dd388f4e1f8b3e06261048fcb1122a144c1974fd43d1c4fcdb9	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d67ef254490c0127cbc1fe6b15c7ab7ffdc796eeb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d777f053490c0127cbc1fe6b15c7ab7ffdc390ecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d772ff58490c0127cbc1fe6b15c7ab7ffdc193edb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d77ef757490c0127cbc1fe6b15c7ab7ffdcf92efb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\f6f1b1f = 227740df14d86265742cb2bf2c8888f904b340682723c2a708f66ea53475309eae213ff585	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d674f555490c0127cbc1fe6b15c7ab7ffcc79befb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xsifioiuy\38b1eb2d = c075c59f086411241d3ae61302f9bee0d67ef254490c0127cbc1fe6b15c7ab7ffccf97ecb21b2ef7ed4d7625fc0306a96bc990200d6844409ba64193ea7b	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3828	rundll32.exe
3828	rundll32.exe
1512	regsvr32.exe
1512	regsvr32.exe
2276	regsvr32.exe
2276	regsvr32.exe
3652	regsvr32.exe
3652	regsvr32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3828	rundll32.exe
1512	regsvr32.exe
2276	regsvr32.exe
3652	regsvr32.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 3828	2892	rundll32.exe	68
PID 2892 wrote to memory of 3828	2892	rundll32.exe	68
PID 2892 wrote to memory of 3828	2892	rundll32.exe	68
PID 3828 wrote to memory of 892	3828	rundll32.exe	73
PID 3828 wrote to memory of 892	3828	rundll32.exe	73
PID 3828 wrote to memory of 892	3828	rundll32.exe	73
PID 3828 wrote to memory of 892	3828	rundll32.exe	73
PID 3828 wrote to memory of 892	3828	rundll32.exe	73
PID 892 wrote to memory of 1144	892	explorer.exe	74
PID 892 wrote to memory of 1144	892	explorer.exe	74
PID 892 wrote to memory of 1144	892	explorer.exe	74
PID 1992 wrote to memory of 1512	1992	regsvr32.exe	79
PID 1992 wrote to memory of 1512	1992	regsvr32.exe	79
PID 1992 wrote to memory of 1512	1992	regsvr32.exe	79
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	80
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	80
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	80
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	80
PID 1512 wrote to memory of 1796	1512	regsvr32.exe	80
PID 1796 wrote to memory of 1784	1796	explorer.exe	81
PID 1796 wrote to memory of 1784	1796	explorer.exe	81
PID 1796 wrote to memory of 2012	1796	explorer.exe	83
PID 1796 wrote to memory of 2012	1796	explorer.exe	83
PID 3656 wrote to memory of 3232	3656	regsvr32.exe	87
PID 3656 wrote to memory of 3232	3656	regsvr32.exe	87
PID 3656 wrote to memory of 3232	3656	regsvr32.exe	87
PID 1796 wrote to memory of 3236	1796	explorer.exe	88
PID 1796 wrote to memory of 3236	1796	explorer.exe	88
PID 1796 wrote to memory of 3236	1796	explorer.exe	88
PID 1796 wrote to memory of 2276	1796	explorer.exe	90
PID 1796 wrote to memory of 2276	1796	explorer.exe	90
PID 1796 wrote to memory of 2276	1796	explorer.exe	90
PID 892 wrote to memory of 1484	892	explorer.exe	91
PID 892 wrote to memory of 1484	892	explorer.exe	91
PID 892 wrote to memory of 1484	892	explorer.exe	91
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	92
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	92
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	92
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	92
PID 2276 wrote to memory of 3792	2276	regsvr32.exe	92
PID 3792 wrote to memory of 1212	3792	explorer.exe	93
PID 3792 wrote to memory of 1212	3792	explorer.exe	93
PID 3792 wrote to memory of 1212	3792	explorer.exe	93
PID 3732 wrote to memory of 948	3732	explorer.exe	97
PID 3732 wrote to memory of 948	3732	explorer.exe	97
PID 3732 wrote to memory of 948	3732	explorer.exe	97
PID 1708 wrote to memory of 3652	1708	regsvr32.exe	100
PID 1708 wrote to memory of 3652	1708	regsvr32.exe	100
PID 1708 wrote to memory of 3652	1708	regsvr32.exe	100
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	101
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	101
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	101
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	101
PID 3652 wrote to memory of 1952	3652	regsvr32.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zdebjizaw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll\"" /SC ONCE /Z /ST 02:05 /ET 02:17
      4⤵
      Creates scheduled task(s)
      PID:1144
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll"
      4⤵
      Loads dropped DLL
      PID:1484
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mfesgrwbu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll\"" /SC ONCE /Z /ST 10:07 /ET 10:19
        6⤵
        Creates scheduled task(s)
        
        PID:948

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uotnuabg" /d "0"
      4⤵
      PID:1784
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl" /d "0"
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN 2415919104 /TR "regsvr32.exe -s "C:\ProgramData\Microsoft\Uotnuabg\xfylwslksvzslla.dll"" /NP /F
      4⤵
      Creates scheduled task(s)
      PID:3236
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe -s "C:\ProgramData\Microsoft\Uotnuabg\xfylwslksvzslla.dll"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3792
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Delete /F /TN 2415919104
        6⤵
        
        PID:1212

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll"
  2⤵
  PID:3232

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Roaming\Microsoft\Qxejgzftttyl\gpyboptheqas.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-124-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/892-123-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/892-121-0x0000000000530000-0x0000000000551000-memory.dmp

Filesize
132KB

Download
memory/892-145-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1512-129-0x0000000072EF0000-0x0000000072F11000-memory.dmp

Filesize
132KB

Download
memory/1512-128-0x0000000072EF0000-0x0000000073061000-memory.dmp

Filesize
1.4MB

Download
memory/1512-130-0x0000000072EF0000-0x0000000073061000-memory.dmp

Filesize
1.4MB

Download
memory/1512-131-0x0000000002690000-0x000000000273E000-memory.dmp

Filesize
696KB

Download
memory/1796-135-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1796-136-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1796-140-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1796-137-0x0000000002FB0000-0x0000000002FD1000-memory.dmp

Filesize
132KB

Download
memory/1952-171-0x0000000000170000-0x0000000000191000-memory.dmp

Filesize
132KB

Download
memory/2276-148-0x0000000072960000-0x0000000072AD1000-memory.dmp

Filesize
1.4MB

Download
memory/2276-149-0x0000000072960000-0x0000000072981000-memory.dmp

Filesize
132KB

Download
memory/2276-150-0x0000000072960000-0x0000000072AD1000-memory.dmp

Filesize
1.4MB

Download
memory/2276-152-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3652-169-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3652-168-0x0000000072A10000-0x0000000072B81000-memory.dmp

Filesize
1.4MB

Download
memory/3652-167-0x0000000072A10000-0x0000000072A31000-memory.dmp

Filesize
132KB

Download
memory/3652-166-0x0000000072A10000-0x0000000072B81000-memory.dmp

Filesize
1.4MB

Download
memory/3732-161-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3732-162-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3792-156-0x0000000003A60000-0x0000000003A61000-memory.dmp

Filesize
4KB

Download
memory/3792-158-0x0000000002FB0000-0x0000000002FD1000-memory.dmp

Filesize
132KB

Download
memory/3792-157-0x0000000003A60000-0x0000000003A61000-memory.dmp

Filesize
4KB

Download
memory/3828-118-0x0000000074190000-0x0000000074301000-memory.dmp

Filesize
1.4MB

Download
memory/3828-116-0x0000000074190000-0x0000000074301000-memory.dmp

Filesize
1.4MB

Download
memory/3828-117-0x0000000074190000-0x00000000741B1000-memory.dmp

Filesize
132KB

Download
memory/3828-119-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download