qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Resubmissions

01/11/2021, 12:31 UTC

211101-pp5r3ahha4 10

31/10/2021, 09:03 UTC

211031-k1bwxacfaq 10

14/10/2021, 01:44 UTC

211014-b6aflafeg4 10

Analysis

max time kernel
207s
max time network
368s
platform
windows11_x64
resource
win11
submitted
01/11/2021, 12:31 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll
Size

605KB
MD5

b166029cc6b11b16e9d29b22db5398df
SHA1

899238df1e045ed91034fc589e32ea9d19d0c09b
SHA256

061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52
SHA512

aea6569743fc4d3d6180e93018e7a8184e4f657cc6807652840a48d9f269f534dc15072e94e27f28f40e6cedd65a0ecc4408db274b2a48854da38578ab500616

Score

10^/10

qakbot notset 1632819510 banker persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

notset

Campaign

1632819510

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3884 created 3440	3884	WerFault.exe	78

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	3440	WerFault.exe	78

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3440	rundll32.exe
3440	rundll32.exe
2876	WerFault.exe
2876	WerFault.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1424	svchost.exe
Token: SeCreatePagefilePrivilege	1424	svchost.exe
Token: SeShutdownPrivilege	1424	svchost.exe
Token: SeCreatePagefilePrivilege	1424	svchost.exe
Token: SeShutdownPrivilege	1424	svchost.exe
Token: SeCreatePagefilePrivilege	1424	svchost.exe
Token: SeRestorePrivilege	2876	WerFault.exe
Token: SeBackupPrivilege	2876	WerFault.exe
Token: SeShutdownPrivilege	1088	svchost.exe
Token: SeCreatePagefilePrivilege	1088	svchost.exe
Token: SeTakeOwnershipPrivilege	4872	WaaSMedicAgent.exe
Token: SeSecurityPrivilege	4872	WaaSMedicAgent.exe
Token: SeRestorePrivilege	4872	WaaSMedicAgent.exe
Token: SeBackupPrivilege	4872	WaaSMedicAgent.exe
Token: SeShutdownPrivilege	1424	svchost.exe
Token: SeCreatePagefilePrivilege	1424	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3440	3356	rundll32.exe	78
PID 3356 wrote to memory of 3440	3356	rundll32.exe	78
PID 3356 wrote to memory of 3440	3356	rundll32.exe	78
PID 3884 wrote to memory of 3440	3884	WerFault.exe	78
PID 3884 wrote to memory of 3440	3884	WerFault.exe	78
PID 1088 wrote to memory of 1464	1088	svchost.exe	87
PID 1088 wrote to memory of 1464	1088	svchost.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 564
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2876

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ecef0d2ad0d17b89a7c6e5cd685f4af3 4suDb+h180KS14yyOs5Czw.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3440 -ip 3440
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:1464

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ecef0d2ad0d17b89a7c6e5cd685f4af3 4suDb+h180KS14yyOs5Czw.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:3448

Network

DNS

slscr.update.microsoft.com

Remote address:

8.8.8.8:53

Request

slscr.update.microsoft.com

IN A

Response

slscr.update.microsoft.com

IN CNAME

sls.update.microsoft.com

sls.update.microsoft.com

IN CNAME

glb.sls.prod.dcat.dsp.trafficmanager.net

glb.sls.prod.dcat.dsp.trafficmanager.net

IN A

40.125.122.176
DNS

fe3cr.delivery.mp.microsoft.com

Remote address:

8.8.8.8:53

Request

fe3cr.delivery.mp.microsoft.com

IN A

Response

fe3cr.delivery.mp.microsoft.com

IN CNAME

fe3.delivery.mp.microsoft.com

fe3.delivery.mp.microsoft.com

IN CNAME

glb.cws.prod.dcat.dsp.trafficmanager.net

glb.cws.prod.dcat.dsp.trafficmanager.net

IN A

52.152.108.96
DNS

fe3cr.delivery.mp.microsoft.com

Remote address:

8.8.8.8:53

Request

fe3cr.delivery.mp.microsoft.com

IN A

Response

fe3cr.delivery.mp.microsoft.com

IN CNAME

fe3.delivery.mp.microsoft.com

fe3.delivery.mp.microsoft.com

IN CNAME

glb.cws.prod.dcat.dsp.trafficmanager.net

glb.cws.prod.dcat.dsp.trafficmanager.net

IN A

52.152.108.96
DNS

slscr.update.microsoft.com

Remote address:

8.8.8.8:53

Request

slscr.update.microsoft.com

IN A

Response

slscr.update.microsoft.com

IN CNAME

sls.update.microsoft.com

sls.update.microsoft.com

IN CNAME

glb.sls.prod.dcat.dsp.trafficmanager.net

glb.sls.prod.dcat.dsp.trafficmanager.net

IN A

52.242.101.226
DNS

settings-win.data.microsoft.com

Remote address:

8.8.8.8:53

Request

settings-win.data.microsoft.com

IN A

Response

settings-win.data.microsoft.com

IN CNAME

settingsfd-geo.trafficmanager.net

settingsfd-geo.trafficmanager.net

IN CNAME

settingsfd-prod-weu1-endpoint.trafficmanager.net

settingsfd-prod-weu1-endpoint.trafficmanager.net

IN A

51.124.78.146
DNS

ctldl.windowsupdate.com

Remote address:

8.8.8.8:53

Request

ctldl.windowsupdate.com

IN A

Response

ctldl.windowsupdate.com

IN CNAME

wu-shim.trafficmanager.net

wu-shim.trafficmanager.net

IN CNAME

download.windowsupdate.com.edgesuite.net

download.windowsupdate.com.edgesuite.net

IN CNAME

a767.dspw65.akamai.net

a767.dspw65.akamai.net

IN A

84.53.175.34
DNS

nexusrules.officeapps.live.com

Remote address:

8.8.8.8:53

Request

nexusrules.officeapps.live.com

IN A

Response

nexusrules.officeapps.live.com

IN CNAME

prod.nexusrules.live.com.akadns.net

prod.nexusrules.live.com.akadns.net

IN A

52.109.76.32
DNS

config.edge.skype.com

Remote address:

8.8.8.8:53

Request

config.edge.skype.com

IN A

Response

config.edge.skype.com

IN CNAME

config.edge.skype.com.trafficmanager.net

config.edge.skype.com.trafficmanager.net

IN CNAME

l-0007.config.skype.com

l-0007.config.skype.com

IN CNAME

config-edge-skype.l-0007.l-msedge.net

config-edge-skype.l-0007.l-msedge.net

IN CNAME

l-0007.l-msedge.net

l-0007.l-msedge.net

IN A

13.107.42.16
DNS

login.live.com

Remote address:

8.8.8.8:53

Request

login.live.com

IN A

Response

login.live.com

IN CNAME

login.msa.msidentity.com

login.msa.msidentity.com

IN CNAME

www.tm.lg.prod.aadmsa.trafficmanager.net

www.tm.lg.prod.aadmsa.trafficmanager.net

IN CNAME

prda.aadg.msidentity.com

prda.aadg.msidentity.com

IN CNAME

www.tm.a.prd.aadg.akadns.net

www.tm.a.prd.aadg.akadns.net

IN A

40.126.31.1

www.tm.a.prd.aadg.akadns.net

IN A

20.190.159.138

www.tm.a.prd.aadg.akadns.net

IN A

40.126.31.137

www.tm.a.prd.aadg.akadns.net

IN A

20.190.159.132

www.tm.a.prd.aadg.akadns.net

IN A

40.126.31.4

www.tm.a.prd.aadg.akadns.net

IN A

20.190.159.134

www.tm.a.prd.aadg.akadns.net

IN A

40.126.31.135

www.tm.a.prd.aadg.akadns.net

IN A

40.126.31.6
DNS

time.windows.com

Remote address:

8.8.8.8:53

Request

time.windows.com

IN A

Response

time.windows.com

IN CNAME

twc.trafficmanager.net

twc.trafficmanager.net

IN A

20.101.57.9
DNS

slscr.update.microsoft.com

Remote address:

8.8.8.8:53

Request

slscr.update.microsoft.com

IN A

Response

slscr.update.microsoft.com

IN CNAME

sls.update.microsoft.com

sls.update.microsoft.com

IN CNAME

glb.sls.prod.dcat.dsp.trafficmanager.net

glb.sls.prod.dcat.dsp.trafficmanager.net

IN A

40.125.122.176
DNS

ocsp.digicert.com

Remote address:

8.8.8.8:53

Request

ocsp.digicert.com

IN A

Response

ocsp.digicert.com

IN CNAME

cs9.wac.phicdn.net

cs9.wac.phicdn.net

IN A

93.184.220.29
DNS

fe3cr.delivery.mp.microsoft.com

Remote address:

8.8.8.8:53

Request

fe3cr.delivery.mp.microsoft.com

IN A

Response

fe3cr.delivery.mp.microsoft.com

IN CNAME

fe3.delivery.mp.microsoft.com

fe3.delivery.mp.microsoft.com

IN CNAME

glb.cws.prod.dcat.dsp.trafficmanager.net

glb.cws.prod.dcat.dsp.trafficmanager.net

IN A

52.152.108.96
DNS

fe3cr.delivery.mp.microsoft.com

Remote address:

8.8.8.8:53

Request

fe3cr.delivery.mp.microsoft.com

IN A

Response

fe3cr.delivery.mp.microsoft.com

IN CNAME

fe3.delivery.mp.microsoft.com

fe3.delivery.mp.microsoft.com

IN CNAME

glb.cws.prod.dcat.dsp.trafficmanager.net

glb.cws.prod.dcat.dsp.trafficmanager.net

IN A

52.152.108.96
DNS

slscr.update.microsoft.com

Remote address:

8.8.8.8:53

Request

slscr.update.microsoft.com

IN A

Response

slscr.update.microsoft.com

IN CNAME

sls.update.microsoft.com

sls.update.microsoft.com

IN CNAME

glb.sls.prod.dcat.dsp.trafficmanager.net

glb.sls.prod.dcat.dsp.trafficmanager.net

IN A

40.125.122.176
DNS

settings-win.data.microsoft.com

Remote address:

8.8.8.8:53

Request

settings-win.data.microsoft.com

IN A

Response

settings-win.data.microsoft.com

IN CNAME

settingsfd-geo.trafficmanager.net

settingsfd-geo.trafficmanager.net

IN A

51.124.78.146
DNS

fs.microsoft.com

Remote address:

8.8.8.8:53

Request

fs.microsoft.com

IN A

Response

fs.microsoft.com

IN CNAME

prod.fs.microsoft.com.akadns.net

prod.fs.microsoft.com.akadns.net

IN CNAME

fs-wildcard.microsoft.com.edgekey.net

fs-wildcard.microsoft.com.edgekey.net

IN CNAME

fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net

fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net

IN CNAME

e1723.g.akamaiedge.net

e1723.g.akamaiedge.net

IN A

104.80.224.57
DNS

ctldl.windowsupdate.com

Remote address:

8.8.8.8:53

Request

ctldl.windowsupdate.com

IN A

Response

ctldl.windowsupdate.com

IN CNAME

wu-shim.trafficmanager.net

wu-shim.trafficmanager.net

IN CNAME

download.windowsupdate.com.edgesuite.net

download.windowsupdate.com.edgesuite.net

IN CNAME

a767.dspw65.akamai.net

a767.dspw65.akamai.net

IN A

104.110.191.140

a767.dspw65.akamai.net

IN A

104.110.191.133
DNS

s2.symcb.com

Remote address:

8.8.8.8:53

Request

s2.symcb.com

IN A

Response

s2.symcb.com

IN CNAME

ocsp-ds.ws.symantec.com.edgekey.net

ocsp-ds.ws.symantec.com.edgekey.net

IN CNAME

e8218.dscb1.akamaiedge.net

e8218.dscb1.akamaiedge.net

IN A

23.51.123.27
DNS

sv.symcd.com

Remote address:

8.8.8.8:53

Request

sv.symcd.com

IN A

Response

sv.symcd.com

IN CNAME

ocsp-ds.ws.symantec.com.edgekey.net

ocsp-ds.ws.symantec.com.edgekey.net

IN CNAME

e8218.dscb1.akamaiedge.net

e8218.dscb1.akamaiedge.net

IN A

23.51.123.27
DNS

s.symcd.com

Remote address:

8.8.8.8:53

Request

s.symcd.com

IN A

Response

s.symcd.com

IN CNAME

ocsp-ds.ws.symantec.com.edgekey.net

ocsp-ds.ws.symantec.com.edgekey.net

IN CNAME

e8218.dscb1.akamaiedge.net

e8218.dscb1.akamaiedge.net

IN A

23.51.123.27
DNS

ts-ocsp.ws.symantec.com

Remote address:

8.8.8.8:53

Request

ts-ocsp.ws.symantec.com

IN A

Response

ts-ocsp.ws.symantec.com

IN CNAME

ocsp-ds.ws.symantec.com.edgekey.net

ocsp-ds.ws.symantec.com.edgekey.net

IN CNAME

e8218.dscb1.akamaiedge.net

e8218.dscb1.akamaiedge.net

IN A

23.51.123.27
DNS

ocsp.verisign.com

Remote address:

8.8.8.8:53

Request

ocsp.verisign.com

IN A

Response

ocsp.verisign.com

IN CNAME

ocsp-ds.ws.symantec.com.edgekey.net

ocsp-ds.ws.symantec.com.edgekey.net

IN CNAME

e8218.dscb1.akamaiedge.net

e8218.dscb1.akamaiedge.net

IN A

23.51.123.27
DNS

mrodevicemgr.officeapps.live.com

Remote address:

8.8.8.8:53

Request

mrodevicemgr.officeapps.live.com

IN A

Response

mrodevicemgr.officeapps.live.com

IN CNAME

prod.mrodevicemgr.live.com.akadns.net

prod.mrodevicemgr.live.com.akadns.net

IN A

52.109.88.44
DNS

tsfe.trafficshaping.dsp.mp.microsoft.com

Remote address:

8.8.8.8:53

Request

tsfe.trafficshaping.dsp.mp.microsoft.com

IN A

Response

tsfe.trafficshaping.dsp.mp.microsoft.com

IN CNAME

tsfe.trafficmanager.net

tsfe.trafficmanager.net

IN A

20.54.110.119
DNS

ctldl.windowsupdate.com

Remote address:

8.8.8.8:53

Request

ctldl.windowsupdate.com

IN A

Response

ctldl.windowsupdate.com

IN CNAME

wu-shim.trafficmanager.net

wu-shim.trafficmanager.net

IN CNAME

download.windowsupdate.com.edgesuite.net

download.windowsupdate.com.edgesuite.net

IN CNAME

a767.dspw65.akamai.net

a767.dspw65.akamai.net

IN A

84.53.175.107

a767.dspw65.akamai.net

IN A

84.53.175.34

40.125.122.176:443

slscr.update.microsoft.com

tls

1.3kB
3.3kB
12
9
52.152.108.96:443

fe3cr.delivery.mp.microsoft.com

tls

1.2kB
3.1kB
12
9
40.125.122.176:443

slscr.update.microsoft.com

tls

1.2kB
3.2kB
12
9
51.124.78.146:443

settings-win.data.microsoft.com

tls

1.5kB
9.2kB
14
14
40.125.122.176:443

slscr.update.microsoft.com

tls

1.3kB
3.3kB
12
9
40.125.122.176:443

slscr.update.microsoft.com

tls

1.3kB
3.3kB
12
9
52.152.108.96:443

fe3cr.delivery.mp.microsoft.com

tls

1.2kB
3.1kB
12
9
40.125.122.176:443

slscr.update.microsoft.com

tls

1.2kB
3.2kB
12
9
127.0.0.1:5985
51.124.78.146:443

settings-win.data.microsoft.com

tls, https

1.8kB
8.1kB
14
14
51.124.78.146:443

settings-win.data.microsoft.com

tls, https

MoUsoCoreWorker.exe

2.0kB
14.6kB
16
18
40.125.122.176:443

slscr.update.microsoft.com

tls, https

wuauserv

1.3kB
3.3kB
12
9
20.54.110.119:443

tsfe.trafficshaping.dsp.mp.microsoft.com

tls, https

wuauserv

2.7kB
6.0kB
14
13
20.86.173.234:80

46 B
1

8.8.8.8:53

slscr.update.microsoft.com

dns

1.8kB
4.6kB
26
26

DNS Request

slscr.update.microsoft.com

DNS Response

40.125.122.176

DNS Request

fe3cr.delivery.mp.microsoft.com

DNS Response

52.152.108.96

DNS Request

fe3cr.delivery.mp.microsoft.com

DNS Response

52.152.108.96

DNS Request

slscr.update.microsoft.com

DNS Response

52.242.101.226

DNS Request

settings-win.data.microsoft.com

DNS Response

51.124.78.146

DNS Request

ctldl.windowsupdate.com

DNS Response

84.53.175.34

DNS Request

nexusrules.officeapps.live.com

DNS Response

52.109.76.32

DNS Request

config.edge.skype.com

DNS Response

13.107.42.16

DNS Request

login.live.com

DNS Response

40.126.31.1

20.190.159.138

40.126.31.137

20.190.159.132

40.126.31.4

20.190.159.134

40.126.31.135

40.126.31.6

DNS Request

time.windows.com

DNS Response

20.101.57.9

DNS Request

slscr.update.microsoft.com

DNS Response

40.125.122.176

DNS Request

ocsp.digicert.com

DNS Response

93.184.220.29

DNS Request

fe3cr.delivery.mp.microsoft.com

DNS Response

52.152.108.96

DNS Request

fe3cr.delivery.mp.microsoft.com

DNS Response

52.152.108.96

DNS Request

slscr.update.microsoft.com

DNS Response

40.125.122.176

DNS Request

settings-win.data.microsoft.com

DNS Response

51.124.78.146

DNS Request

fs.microsoft.com

DNS Response

104.80.224.57

DNS Request

ctldl.windowsupdate.com

DNS Response

104.110.191.140

104.110.191.133

DNS Request

s2.symcb.com

DNS Response

23.51.123.27

DNS Request

sv.symcd.com

DNS Response

23.51.123.27

DNS Request

s.symcd.com

DNS Response

23.51.123.27

DNS Request

ts-ocsp.ws.symantec.com

DNS Response

23.51.123.27

DNS Request

ocsp.verisign.com

DNS Response

23.51.123.27

DNS Request

mrodevicemgr.officeapps.live.com

DNS Response

52.109.88.44

DNS Request

tsfe.trafficshaping.dsp.mp.microsoft.com

DNS Response

20.54.110.119

DNS Request

ctldl.windowsupdate.com

DNS Response

84.53.175.107

84.53.175.34
20.101.57.9:123

time.windows.com

ntp

76 B
1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-149-0x0000025C9CB20000-0x0000025C9CB30000-memory.dmp

Filesize
64KB

Download
memory/1424-150-0x0000025C9CBA0000-0x0000025C9CBB0000-memory.dmp

Filesize
64KB

Download
memory/1424-151-0x0000025C9F280000-0x0000025C9F284000-memory.dmp

Filesize
16KB

Download
memory/3440-147-0x00000000041F0000-0x000000000428C000-memory.dmp

Filesize
624KB

Download
memory/3440-148-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/3440-153-0x0000000005E60000-0x0000000005E81000-memory.dmp

Filesize
132KB

Download
memory/3440-152-0x0000000005E60000-0x0000000005E81000-memory.dmp

Filesize
132KB

Download
memory/3440-154-0x0000000005E30000-0x0000000005E51000-memory.dmp

Filesize
132KB

Download
memory/3440-155-0x0000000005E60000-0x0000000005E81000-memory.dmp

Filesize
132KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.