qakbot | d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

General

Target

d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
Size

945KB
MD5

bb17bf13123596ba3065efc74d625a3c
SHA1

b589b0dee84e30e205f242a8d429b1e231b5ec5b
SHA256

d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937
SHA512

40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Score

10^/10

qakbot cullinan 1639333530 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639333530

C2

65.100.174.110:443

173.21.10.71:2222

140.82.49.12:443

190.73.3.148:2222

76.25.142.196:443

71.74.12.34:443

31.215.98.160:443

93.48.80.198:995

45.9.20.200:2211

41.228.22.180:443

109.12.111.14:443

63.143.92.99:995

120.150.218.241:995

94.60.254.81:443

86.148.6.51:443

218.101.110.3:995

216.238.71.31:443

207.246.112.221:443

216.238.72.121:443

216.238.71.31:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1744 regsvr32.exe

pid	process
1744	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

560 schtasks.exe

pid	process
560	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{625E2E77-E7C1-4D67-AE1D-27E4FE0941FD}\WpadNetworkName = "Network 3"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-8c-f3-52-b0-c1\WpadDecisionTime = 109fb5286808d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff85fedcbbac90d9ad5143291d236cdbc0b66b1015cdc8cd358fc9c1a5dd9e873bc50a7e3d1b53fe1d8da7ad59baf713315f9f8701b8e6a4f4c774ebf32ed99fa4b01f0	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff85fedcbbac90d9ad5143291d236cdbc0b66b1015cdc8cd358fc9c1a5dd9e97ab652a4e3d1b53fe1d8da7ad59baf713315f9f8701b8e6a4f4c774ebf32ed99fa4b01f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\2cfe7d07 = 36f62bee7b8c509496c5b4d3e8c5dd850c6dfa55336c1a4fdd36ae9ae51275b222b5c4e031	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-8c-f3-52-b0-c1\WpadDecisionReason = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff856edcbbac90d9ad5157896db34cabe0366b54f5fd187d055ffaafff0e358cfb4a1551a176f549e9625fb46a06ec02434bb53fc18dc0d31cb33	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff85fedcbbac90d9ad5143291d236ccb50068b1015cdc8cd358fc9c1a5dd9e97ab652a4e3d1b53fe1d8da7ad59baf713315f9f8701b8e6a4f4c774ebf32ed99fa4b01f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff85fedcbbac90d9ad5143291d236ccb50068b1015cdc8cd358fc9c1a5dd9e97ab053a7e3d1b53fe1d8da7ad59baf713315f9f8701b8e6a4f4c774ebf32ed99fa4b01f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\51f6328d = 150e5abca9cf766cedd9ed4021a17a749a132dae3439da65ee6d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{625E2E77-E7C1-4D67-AE1D-27E4FE0941FD}\e2-8c-f3-52-b0-c1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff856edcbbac90d9ad5157896db34cabe0366b54f5fd187d656f9aafff0e358cfb4a1551a176f549e9625fb46a06ec02434bb53fc18dc0d31cb33	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{625E2E77-E7C1-4D67-AE1D-27E4FE0941FD}	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff85fedcbbac90d9ad5143291d236cdbc0b66b1015cdc8cd358fc9c1a5dd9e97ab451a6e3d1b53fe1d8da7ad59baf713315f9f8701b8e6a4f4c774ebf32ed99fa4b01f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0092000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-8c-f3-52-b0-c1\WpadDecision = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff841edcbbafce734e4a3819522c10292773178b6a0a4ea20b539dcf6e68d111d14d218129c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\94421a62 = f92b7aa0dbf7ae8641d9e542d062e226b957bf034eb28d7e4d7db44e75375788f069093bc6604b683870100b87dc52450c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\96033a1e = 5422d211305b0eaa7dc7fab3c12e41bb7d8dbc556acc7384f42fe92ba43cb501ed9739c53ea65e5c7929bdbb56ca4cf569476abad6afb2dd0faa854a792068ead73277e59caa720a0893d45fd60f026b1d73490cd08616	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{625E2E77-E7C1-4D67-AE1D-27E4FE0941FD}\WpadDecisionReason = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\2ebf5d7b = 734485a6d1dc84d7b68a2a589d73750823e3c5b845f3bb5a56e7ce234ae148ba195d54b3e565d30448fa7bf58de2828cf7c3920fece11e1c8cc1d16261fd5762f5b21ce5959e9ea73f0fa654014100392208577002214544976a1bf69c8393047a43434baf2b65144288	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\e94a55e8 = 3bc1e4a2ca3573bac12a4f27ad3e266a6b1ed3587802bade0f464499f84cc976	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Afjaevuizum\1b208d35 = 0ff85fedcbbac90d9ad5143291d236ccb50b61b5015cdc8cd358fc9c1a5dd9e97ab35babe3d1b53fe1d8da7ad59baf713315f9f8701b8e6a4f4c774ebf32ed99fa4b01f0	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1284 regsvr32.exe
1744 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1284 regsvr32.exe
1744 regsvr32.exe

pid	process
1284	regsvr32.exe
1744	regsvr32.exe

pid	process
1284	regsvr32.exe
1744	regsvr32.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 836 wrote to memory of 1284	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1284	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1284	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1284	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1284	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1284	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1284	836	regsvr32.exe	regsvr32.exe
PID 1284 wrote to memory of 516	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 516	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 516	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 516	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 516	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 516	1284	regsvr32.exe	explorer.exe
PID 516 wrote to memory of 560	516	explorer.exe	schtasks.exe
PID 516 wrote to memory of 560	516	explorer.exe	schtasks.exe
PID 516 wrote to memory of 560	516	explorer.exe	schtasks.exe
PID 516 wrote to memory of 560	516	explorer.exe	schtasks.exe
PID 1100 wrote to memory of 732	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 732	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 732	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 732	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 732	1100	taskeng.exe	regsvr32.exe
PID 732 wrote to memory of 1744	732	regsvr32.exe	regsvr32.exe
PID 732 wrote to memory of 1744	732	regsvr32.exe	regsvr32.exe
PID 732 wrote to memory of 1744	732	regsvr32.exe	regsvr32.exe
PID 732 wrote to memory of 1744	732	regsvr32.exe	regsvr32.exe
PID 732 wrote to memory of 1744	732	regsvr32.exe	regsvr32.exe
PID 732 wrote to memory of 1744	732	regsvr32.exe	regsvr32.exe
PID 732 wrote to memory of 1744	732	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1048	1744	regsvr32.exe	explorer.exe
PID 1744 wrote to memory of 1048	1744	regsvr32.exe	explorer.exe
PID 1744 wrote to memory of 1048	1744	regsvr32.exe	explorer.exe
PID 1744 wrote to memory of 1048	1744	regsvr32.exe	explorer.exe
PID 1744 wrote to memory of 1048	1744	regsvr32.exe	explorer.exe
PID 1744 wrote to memory of 1048	1744	regsvr32.exe	explorer.exe
PID 1048 wrote to memory of 1748	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 1748	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 1748	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 1748	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 1760	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 1760	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 1760	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 1760	1048	explorer.exe	reg.exe
PID 776 wrote to memory of 1952	776	taskeng.exe	regsvr32.exe
PID 776 wrote to memory of 1952	776	taskeng.exe	regsvr32.exe
PID 776 wrote to memory of 1952	776	taskeng.exe	regsvr32.exe
PID 776 wrote to memory of 1952	776	taskeng.exe	regsvr32.exe
PID 776 wrote to memory of 1952	776	taskeng.exe	regsvr32.exe
PID 1952 wrote to memory of 1156	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1156	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1156	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1156	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1156	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1156	1952	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1156	1952	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wfeabhiobd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll\"" /SC ONCE /Z /ST 10:21 /ET 10:33
4⤵
- Creates scheduled task(s)
PID:560

C:\Windows\system32\taskeng.exe
taskeng.exe {CCB268A1-D7A3-46CB-AFE2-5B1DF52AFCFF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Peasyh" /d "0"
5⤵
PID:1748

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eazjjvwehs" /d "0"
5⤵
PID:1760

C:\Windows\system32\taskeng.exe
taskeng.exe {DE4575C0-EC64-4C23-B0E5-2161E674596E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
3⤵
PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
MD5
bb17bf13123596ba3065efc74d625a3c

SHA1
b589b0dee84e30e205f242a8d429b1e231b5ec5b

SHA256
d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

SHA512
40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Download Submit
C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
MD5
f58a6fb126ea3c17a02fc8e8f453e859

SHA1
467f934d6a2306f193078aef9a8fc915d36a9f83

SHA256
413ad2a405327006a8e7cea99b48ed26d6880482f53124b894ae21d24e05a245

SHA512
1af40b449dd1e3f9b0f3833df9bf8f0e7494d11493ac3ed3911eace75d3009e4fdede9b4fecf078e8e59ba48cb1d3338d73bfba4234e874f9d627566a3db5754

Download Submit
\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
MD5
bb17bf13123596ba3065efc74d625a3c

SHA1
b589b0dee84e30e205f242a8d429b1e231b5ec5b

SHA256
d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

SHA512
40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Download Submit
memory/516-65-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/516-60-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/516-61-0x0000000000000000-mapping.dmp

Download
memory/516-63-0x0000000074561000-0x0000000074563000-memory.dmp

Filesize
8KB

Download
memory/560-64-0x0000000000000000-mapping.dmp

Download
memory/732-66-0x0000000000000000-mapping.dmp

Download
memory/836-55-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/1048-73-0x0000000000000000-mapping.dmp

Download
memory/1048-78-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1156-82-0x0000000000000000-mapping.dmp

Download
memory/1284-58-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1284-59-0x0000000010000000-0x00000000100F5000-memory.dmp

Filesize
980KB

Download
memory/1284-57-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download
memory/1284-56-0x0000000000000000-mapping.dmp

Download
memory/1744-69-0x0000000000000000-mapping.dmp

Download
memory/1748-76-0x0000000000000000-mapping.dmp

Download
memory/1760-77-0x0000000000000000-mapping.dmp

Download
memory/1952-79-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads