qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
Size

448KB
MD5

879628efe6fb566fc83cb019a4d90f5d
SHA1

b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA256

b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
SHA512

4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1632817399

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1300 regsvr32.exe

pid	process
1300	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3188 schtasks.exe

pid	process
3188	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb7f28d29909d649be2264960aa4ec495a723f70806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb762fd69909d649be2264960aa4ec495a78307d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\e0fc21c8 = fbb304a5601ad13a90cc16a4b260f3281671be3c6eba7eeacdf87c4259ff3e61bccd5367484e85dbdafd45a7a5ac01781cf441272fd121141e0d7934610b806f53f203c8dedc2439ce0343380fb6f98c91351c3dd4e44b67edad890664dfb827959f757a4cf655ebadddf16f36cbc06317452a2f9c4a1d2053c58bc2a56ce91c9717ccb625aa3facede5f2cc90dc71ceda49e8d4000bae8e450df0bf93ac1713f10f3f520ffd995c0464e2c975cdd5049d163a90cb707f35f94a4d89ffd752ea18	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be772ad19909d649be2264960aa4ec495c70377c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc7c2eda9909d649be2264960aa4ec495d71337c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc762ad19909d649be2264960aa4ec495a71367e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb7a27d59909d649be2264960aa4ec495a743e7f806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd772fd39909d649be2264960aa4ec495c79307d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be772ad19909d649be2264960aa4ec495f78347d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be782cd49909d649be2264960aa4ec495f76357e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd772fd39909d649be2264960aa4ec495c77317b806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be772ad19909d649be2264960aa4ec495c72367e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf409e89390d4bc2a4d4be7d21baf2b47f29d1d00cda4abb2d62a0f0384971a8b74790c583c3ea5c60bb7efeb161bc485726c6cf0d2a73c47d4a28b7998e68ef9d3e83	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf579e893938b95a0ceb04b95b5086aafe70575cdd4976cb3c626912cd8d771fb76bbf9777af834b8655408a2f84	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\5a0166d1 = b823a419bef4dc108df7001484dde4c95a3640f2e07dd51b38ef48d92ce8674c90474079863faf05942b044e6453	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc7b2cd09909d649be2264960aa4ec495d77347c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf409e89390d4bc2a4d4be7d21baf2b47f29d1d00cda4abd2c60a0f0384971a8b74790c583c3ea5c60bb7efeb161bc485726c6cf0d2a73c47d4a28b7998e68ef9d3e83	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc762ad19909d649be2264960aa4ec495d77347c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb762fd69909d649be2264960aa4ec495a76317e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\584046ad = 4379a809c9574cf24e958129506dc7fad509d7c8a8925890eac91d625d89ff8f4ff73b5ba56fa642455bb86bfa3b79469333b51a2ce2bd761b0a372446e459a45582b5e36b88436d44d5766e2a02c418eb	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\2709295b = 50b627f900fdb6c192c931bcf6a3b47459ec2474aa8ed70ed68533734b94d7dcfdcda38fa2ff1db5bdca75570b2a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\9fb54e3e = 7233ff5d273a89acb3bbf87c2c27e843b080834c7f9b996d3dac834ed24734c8b8f47070928d908f1681402fac2ec849b6618ca14b61bf18c9e6d7991cfa87a4e4f34aa90ee296118ef36b8d220c9d3079a50359c6b5c63b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\aa2a9e70 = 814d4d433a7eaac77952df4ec9b3ac3d31	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd7b27d69909d649be2264960aa4ec495c753e7c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd7c29d59909d649be2264960aa4ec495c733f7d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd772fd39909d649be2264960aa4ec495d71337c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4188 rundll32.exe
4188 rundll32.exe
1300 regsvr32.exe
1300 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4188 rundll32.exe
1300 regsvr32.exe

pid	process
4188	rundll32.exe
4188	rundll32.exe
1300	regsvr32.exe
1300	regsvr32.exe

pid	process
4188	rundll32.exe
1300	regsvr32.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 3676 wrote to memory of 4188	3676	rundll32.exe	rundll32.exe
PID 3676 wrote to memory of 4188	3676	rundll32.exe	rundll32.exe
PID 3676 wrote to memory of 4188	3676	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 3808	4188	rundll32.exe	explorer.exe
PID 4188 wrote to memory of 3808	4188	rundll32.exe	explorer.exe
PID 4188 wrote to memory of 3808	4188	rundll32.exe	explorer.exe
PID 4188 wrote to memory of 3808	4188	rundll32.exe	explorer.exe
PID 4188 wrote to memory of 3808	4188	rundll32.exe	explorer.exe
PID 3808 wrote to memory of 3188	3808	explorer.exe	schtasks.exe
PID 3808 wrote to memory of 3188	3808	explorer.exe	schtasks.exe
PID 3808 wrote to memory of 3188	3808	explorer.exe	schtasks.exe
PID 1164 wrote to memory of 1300	1164	regsvr32.exe	regsvr32.exe
PID 1164 wrote to memory of 1300	1164	regsvr32.exe	regsvr32.exe
PID 1164 wrote to memory of 1300	1164	regsvr32.exe	regsvr32.exe
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	explorer.exe
PID 1604 wrote to memory of 1824	1604	explorer.exe	reg.exe
PID 1604 wrote to memory of 1824	1604	explorer.exe	reg.exe
PID 1604 wrote to memory of 1492	1604	explorer.exe	reg.exe
PID 1604 wrote to memory of 1492	1604	explorer.exe	reg.exe
PID 4952 wrote to memory of 4960	4952	regsvr32.exe	regsvr32.exe
PID 4952 wrote to memory of 4960	4952	regsvr32.exe	regsvr32.exe
PID 4952 wrote to memory of 4960	4952	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qowstpbbfc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll\"" /SC ONCE /Z /ST 09:07 /ET 09:19
4⤵
- Creates scheduled task(s)
PID:3188

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oiwnyqbp" /d "0"
4⤵
PID:1824

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mcyoljovzvy" /d "0"
4⤵
PID:1492

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
2⤵
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
MD5
879628efe6fb566fc83cb019a4d90f5d

SHA1
b4eb4da4ed99f50c0e02b12c23b2ea65dceed706

SHA256
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7

SHA512
4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
MD5
e88ede8da1b7264dae4c24de0ca1a1f2

SHA1
8f05873f55112d85281c9c52f380ad7b8b63787b

SHA256
be40aa7e665454ff1d6c38f792df2015ed05a7899f07e3874923a7e0e15e581f

SHA512
3a4952082ddb34b50becd5f90935ba32d5f348883e34278e0e8bcc3b8430417ac2131b40512e3fd68fa58fc9290368ff97db938db51a902ec9604027e45976b9

Download Submit
\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
MD5
879628efe6fb566fc83cb019a4d90f5d

SHA1
b4eb4da4ed99f50c0e02b12c23b2ea65dceed706

SHA256
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7

SHA512
4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c

Download Submit
memory/1300-134-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1300-133-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/1300-131-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/1300-129-0x0000000000000000-mapping.dmp

Download
memory/1492-137-0x0000000000000000-mapping.dmp

Download
memory/1604-138-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/1604-139-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/1604-135-0x0000000000000000-mapping.dmp

Download
memory/1604-140-0x0000000003250000-0x0000000003271000-memory.dmp

Filesize
132KB

Download
memory/1824-136-0x0000000000000000-mapping.dmp

Download
memory/3188-124-0x0000000000000000-mapping.dmp

Download
memory/3808-125-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/3808-127-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3808-126-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/3808-123-0x0000000000000000-mapping.dmp

Download
memory/4188-120-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4188-118-0x0000000000000000-mapping.dmp

Download
memory/4188-121-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/4188-122-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/4188-119-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/4960-142-0x0000000000000000-mapping.dmp

Download