qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll
Size

1.0MB
MD5

10c150a949585ba3603cce27707331f0
SHA1

9eeb1747902951835245545b7b3b1e6408c708c2
SHA256

260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840
SHA512

668ea267488635b88ef6a929501f8f6b34a02ccb2fa01a311caf89f5c683f0dd6877d8714ddf8b6b24e7a447c40f2cf5c42698638a52ff7b27e6c47ce4f4578b

Score

10^/10

qakbot tr 1633334141 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633334141

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
608	regsvr32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3948	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b312639a89833586a82ee61e84b8ec7f5a4d8d99e4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b302634a69833586a82ee61e84b8ec7f5a5d6de944955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b312639a89833586a82ee61e84b8ec7f5a3d0d89d4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\7c78058b = 262c9e0b14822d5b645fc726f67a9fc33bdc61d6ae37cc22e02fff130a93700130f1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b302b3aa59833586a82ee61e84b8ec7f5a5d4df994955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154293a0d2d755e97afac47a83dc5d392f3ba3d136546981e166dedf4e780141f64bffde4fa3101b37b5781d70921de8ba2423b0b5fe061497427e22570533c1c2d29589960cb2cb76f7c7f23de1a8078578ccbf3302ddb0a27da79aaef5d30c3e9fde6ad946a114	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b33283fa79833586a82ee61e84b8ec7f5a6d7da9b4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b332739a49833586a82ee61e84b8ec7f5a5d1d8994955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b312b3ea49833586a82ee61e84b8ec7f5a4d6da9f4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b362934a99833586a82ee61e84b8ec7f5a3d9de9c4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\3316a7d = bbc595a7d2d8c1660784d9da1ca8501b1f0a6459d612329966bbeadea63a08c41de6a2278084b949afcddd8867f4924880390cd5f40f4e41a42c39109fe172e026930097b68f655ffcc64d3d56af30c416cb06a66565aa032a7b8b2b3c0a4d5b3dd6c80bb635a6cf7ce9	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b302c38a89833586a82ee61e84b8ec7f5a5d0d19b4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b312c3ca79833586a82ee61e84b8ec7f5a4d2dc9e4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\b9cc2d64 = 663ffe4c144cfd1a690beedc997999932ec36af445fe6a3d7be63c3e67ea2c54fcb72f9b7b36ca5f293af53d8ff5712f6978bc65df80ef007300d3c5d90363	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b302634a69833586a82ee61e84b8ec7f5a5d8de9c4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b362934a99833586a82ee61e84b8ec7f5a3d7df9d4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b362f3ba59833586a82ee61e84b8ec7f5a3d0d89d4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\1704a01 = 54f414db3db69a717e5a6b3cf7d7e2b33d4ed4aaa1bdfc1122ef9082b0ed0d79ab8593579986eb8e38486680645b7e9288ce	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b362f3ba59833586a82ee61e84b8ec7f5a3d3d19f4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b332739a49833586a82ee61e84b8ec7f5a6d9d99a4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b312639a89833586a82ee61e84b8ec7f5a4d6da9f4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\c4c462ee = 8559aca92cf15b4b4b89525f1fea68ac22744a118bef2b7f1aa7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b302c38a89833586a82ee61e84b8ec7f5a5d2d09a4955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\8e12dd56 = 1a154b93a0d2d755e97afb8e7a8dd85b312b3ea49833586a82ee61e84b8ec7f5a4d4db984955e5fc21a088984a0e34da1a8ec3a92b01bf9057d66763426ea03f78b260c7e504a32f7fa3aa9e4792b2e662ac6666b7c49b0ded2c2c027795d11be32b33357b5cf343a09d0bbacfa2bb2e7c77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rnfvhbqvhwqv\f15bb2a0 = 20c2268f2f589ac40b18c12fe388019d7d5649cff6404e7ccebf6cd06f7b5c91d80993ada2e470171fdbcaeae748940d4a247a496c21	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1312	rundll32.exe
1312	rundll32.exe
608	regsvr32.exe
608	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1312	rundll32.exe
608	regsvr32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1312	364	rundll32.exe	69
PID 364 wrote to memory of 1312	364	rundll32.exe	69
PID 364 wrote to memory of 1312	364	rundll32.exe	69
PID 1312 wrote to memory of 3364	1312	rundll32.exe	71
PID 1312 wrote to memory of 3364	1312	rundll32.exe	71
PID 1312 wrote to memory of 3364	1312	rundll32.exe	71
PID 1312 wrote to memory of 3364	1312	rundll32.exe	71
PID 1312 wrote to memory of 3364	1312	rundll32.exe	71
PID 3364 wrote to memory of 3948	3364	explorer.exe	72
PID 3364 wrote to memory of 3948	3364	explorer.exe	72
PID 3364 wrote to memory of 3948	3364	explorer.exe	72
PID 1084 wrote to memory of 608	1084	regsvr32.exe	77
PID 1084 wrote to memory of 608	1084	regsvr32.exe	77
PID 1084 wrote to memory of 608	1084	regsvr32.exe	77
PID 608 wrote to memory of 424	608	regsvr32.exe	78
PID 608 wrote to memory of 424	608	regsvr32.exe	78
PID 608 wrote to memory of 424	608	regsvr32.exe	78
PID 608 wrote to memory of 424	608	regsvr32.exe	78
PID 608 wrote to memory of 424	608	regsvr32.exe	78
PID 424 wrote to memory of 1536	424	explorer.exe	79
PID 424 wrote to memory of 1536	424	explorer.exe	79
PID 424 wrote to memory of 1680	424	explorer.exe	81
PID 424 wrote to memory of 1680	424	explorer.exe	81
PID 2828 wrote to memory of 2912	2828	regsvr32.exe	85
PID 2828 wrote to memory of 2912	2828	regsvr32.exe	85
PID 2828 wrote to memory of 2912	2828	regsvr32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xdjevbp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll\"" /SC ONCE /Z /ST 09:07 /ET 09:19
      4⤵
      Creates scheduled task(s)
      PID:3948

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Torjb" /d "0"
      4⤵
      PID:1536
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gspumtmeynu" /d "0"
      4⤵
      PID:1680

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll"
  2⤵
  PID:2912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-137-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/424-138-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/424-139-0x0000000000C00000-0x0000000000C21000-memory.dmp

Filesize
132KB

Download
memory/608-130-0x0000000072190000-0x0000000072B9C000-memory.dmp

Filesize
10.0MB

Download
memory/608-131-0x0000000072190000-0x00000000721B1000-memory.dmp

Filesize
132KB

Download
memory/608-132-0x0000000072190000-0x0000000072B9C000-memory.dmp

Filesize
10.0MB

Download
memory/608-133-0x0000000003100000-0x000000000324A000-memory.dmp

Filesize
1.3MB

Download
memory/1312-122-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/1312-121-0x0000000073700000-0x000000007410C000-memory.dmp

Filesize
10.0MB

Download
memory/1312-120-0x0000000073700000-0x0000000073721000-memory.dmp

Filesize
132KB

Download
memory/1312-119-0x0000000073700000-0x000000007410C000-memory.dmp

Filesize
10.0MB

Download
memory/3364-126-0x0000000000720000-0x0000000000741000-memory.dmp

Filesize
132KB

Download
memory/3364-125-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download