qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
Size

448KB
MD5

879628efe6fb566fc83cb019a4d90f5d
SHA1

b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA256

b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
SHA512

4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1632817399

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1300	regsvr32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3188	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb7f28d29909d649be2264960aa4ec495a723f70806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb762fd69909d649be2264960aa4ec495a78307d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\e0fc21c8 = fbb304a5601ad13a90cc16a4b260f3281671be3c6eba7eeacdf87c4259ff3e61bccd5367484e85dbdafd45a7a5ac01781cf441272fd121141e0d7934610b806f53f203c8dedc2439ce0343380fb6f98c91351c3dd4e44b67edad890664dfb827959f757a4cf655ebadddf16f36cbc06317452a2f9c4a1d2053c58bc2a56ce91c9717ccb625aa3facede5f2cc90dc71ceda49e8d4000bae8e450df0bf93ac1713f10f3f520ffd995c0464e2c975cdd5049d163a90cb707f35f94a4d89ffd752ea18	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be772ad19909d649be2264960aa4ec495c70377c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc7c2eda9909d649be2264960aa4ec495d71337c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc762ad19909d649be2264960aa4ec495a71367e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb7a27d59909d649be2264960aa4ec495a743e7f806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd772fd39909d649be2264960aa4ec495c79307d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be772ad19909d649be2264960aa4ec495f78347d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be782cd49909d649be2264960aa4ec495f76357e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd772fd39909d649be2264960aa4ec495c77317b806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4be772ad19909d649be2264960aa4ec495c72367e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf409e89390d4bc2a4d4be7d21baf2b47f29d1d00cda4abb2d62a0f0384971a8b74790c583c3ea5c60bb7efeb161bc485726c6cf0d2a73c47d4a28b7998e68ef9d3e83	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf579e893938b95a0ceb04b95b5086aafe70575cdd4976cb3c626912cd8d771fb76bbf9777af834b8655408a2f84	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\5a0166d1 = b823a419bef4dc108df7001484dde4c95a3640f2e07dd51b38ef48d92ce8674c90474079863faf05942b044e6453	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc7b2cd09909d649be2264960aa4ec495d77347c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf409e89390d4bc2a4d4be7d21baf2b47f29d1d00cda4abd2c60a0f0384971a8b74790c583c3ea5c60bb7efeb161bc485726c6cf0d2a73c47d4a28b7998e68ef9d3e83	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bc762ad19909d649be2264960aa4ec495d77347c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bb762fd69909d649be2264960aa4ec495a76317e806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\584046ad = 4379a809c9574cf24e958129506dc7fad509d7c8a8925890eac91d625d89ff8f4ff73b5ba56fa642455bb86bfa3b79469333b51a2ce2bd761b0a372446e459a45582b5e36b88436d44d5766e2a02c418eb	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\2709295b = 50b627f900fdb6c192c931bcf6a3b47459ec2474aa8ed70ed68533734b94d7dcfdcda38fa2ff1db5bdca75570b2a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\9fb54e3e = 7233ff5d273a89acb3bbf87c2c27e843b080834c7f9b996d3dac834ed24734c8b8f47070928d908f1681402fac2ec849b6618ca14b61bf18c9e6d7991cfa87a4e4f34aa90ee296118ef36b8d220c9d3079a50359c6b5c63b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\aa2a9e70 = 814d4d433a7eaac77952df4ec9b3ac3d31	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd7b27d69909d649be2264960aa4ec495c753e7c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd7c29d59909d649be2264960aa4ec495c733f7d806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hamoyymigaqn\d563f186 = 10cf499e89390d4bc2a4d5f47d2fbef4bd772fd39909d649be2264960aa4ec495d71337c806fda16e61fab9b2bb0613beec9c3766271993b04a3b0a8e632a0961813f392701563ee69e9c3b53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4188	rundll32.exe
4188	rundll32.exe
1300	regsvr32.exe
1300	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4188	rundll32.exe
1300	regsvr32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4188	3676	rundll32.exe	68
PID 3676 wrote to memory of 4188	3676	rundll32.exe	68
PID 3676 wrote to memory of 4188	3676	rundll32.exe	68
PID 4188 wrote to memory of 3808	4188	rundll32.exe	73
PID 4188 wrote to memory of 3808	4188	rundll32.exe	73
PID 4188 wrote to memory of 3808	4188	rundll32.exe	73
PID 4188 wrote to memory of 3808	4188	rundll32.exe	73
PID 4188 wrote to memory of 3808	4188	rundll32.exe	73
PID 3808 wrote to memory of 3188	3808	explorer.exe	74
PID 3808 wrote to memory of 3188	3808	explorer.exe	74
PID 3808 wrote to memory of 3188	3808	explorer.exe	74
PID 1164 wrote to memory of 1300	1164	regsvr32.exe	79
PID 1164 wrote to memory of 1300	1164	regsvr32.exe	79
PID 1164 wrote to memory of 1300	1164	regsvr32.exe	79
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	80
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	80
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	80
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	80
PID 1300 wrote to memory of 1604	1300	regsvr32.exe	80
PID 1604 wrote to memory of 1824	1604	explorer.exe	81
PID 1604 wrote to memory of 1824	1604	explorer.exe	81
PID 1604 wrote to memory of 1492	1604	explorer.exe	83
PID 1604 wrote to memory of 1492	1604	explorer.exe	83
PID 4952 wrote to memory of 4960	4952	regsvr32.exe	87
PID 4952 wrote to memory of 4960	4952	regsvr32.exe	87
PID 4952 wrote to memory of 4960	4952	regsvr32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qowstpbbfc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll\"" /SC ONCE /Z /ST 09:07 /ET 09:19
      4⤵
      Creates scheduled task(s)
      PID:3188

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oiwnyqbp" /d "0"
      4⤵
      PID:1824
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mcyoljovzvy" /d "0"
      4⤵
      PID:1492

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll"
  2⤵
  PID:4960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-134-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1300-133-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/1300-131-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/1604-138-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/1604-139-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/1604-140-0x0000000003250000-0x0000000003271000-memory.dmp

Filesize
132KB

Download
memory/3808-125-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/3808-127-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3808-126-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4188-120-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4188-121-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/4188-122-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/4188-119-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download