qakbot | d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

General

Target

d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
Size

945KB
MD5

bb17bf13123596ba3065efc74d625a3c
SHA1

b589b0dee84e30e205f242a8d429b1e231b5ec5b
SHA256

d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937
SHA512

40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Score

10^/10

qakbot cullinan 1639333530 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639333530

C2

65.100.174.110:443

173.21.10.71:2222

140.82.49.12:443

190.73.3.148:2222

76.25.142.196:443

71.74.12.34:443

31.215.98.160:443

93.48.80.198:995

45.9.20.200:2211

41.228.22.180:443

109.12.111.14:443

63.143.92.99:995

120.150.218.241:995

94.60.254.81:443

86.148.6.51:443

218.101.110.3:995

216.238.71.31:443

207.246.112.221:443

216.238.72.121:443

216.238.71.31:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1816 regsvr32.exe

pid	process
1816	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3920 schtasks.exe

pid	process
3920	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1aaf88b6275a2d50e7fe16e34c94747ac7897ad70a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1aa28ab3275a2d50e7fe16e34c94747ac6817adf0a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1aaf88b6275a2d50e7fe16e34c94747ac78778de0a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\7997d1b6 = 9eed7b98cd277ffecb6dfdb97d3422aeeea38d605631dd46b580a097ed828821ee64d7b1c5bc227798b00038990b8b2f2a8bfb	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\8bfd096b = 433d00a38d5b36fb729f37e6f4167baf52a25619e1ed56ef904c70000332bbc89ac620915be98ccaea5292da056b029759bb68fd	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1aa28ab3275a2d50e7fe16e34c94747ac7897ad70a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1bab84b0275a2d50e7fe16e34c94747ac68073de0a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\31004e72 = 0f89ced29b996fa9a4b69f5a9abefbee735b6883ea80ddc2be1b981e79c61b300082db769eb646069faf	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1aa889b2275a2d50e7fe16e34c94747ac7837edc0a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\89bc2917 = 052f13c204ae8d373ad2088dc582c092e65d61a90c93b8cb2f15b9ae7463f596885cfc9084d56a576ebacd5898e0c9d288896998aee2bda80cbef309267e8429a4b03f337ec031d021fe8f77407fb9106b5aee4ec8a706226d00018ccf48fd	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e06563e2394d70c1c47a4040a20e04ca5912c7b904406d3fa5b49ef3ff0242d404de2c28df59ee6c6b3cce19cfe0fec5e35eb762c9bac51cf8bee02d8c78d08434cce56477678b61ad8394770548c5885fcacff1257440b57d11a846c4af000d19914870e8	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\f4b4669d = ae5b928e00559e07d66ebae5aa88b5230ded849546028c9a6707a805c779be87	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1aaf88b6275a2d50e7fe16e34c94747ac78579df0a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1baf8db7275a2d50e7fe16e34c94747ac6827dd70a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07263e23978190da545a833011f9919ab8bb36258255ae6f017d52d501f466bf1d2cda63de146abfdb86917a6459297b59cd60c7e83c5e1c5eed6c1bdf13589e2990af775cab6f6f96e5f967934e4f49bcf02fc4c22f4a7661282858eb22c34275fdb5fb373f12627c2c2833d18281873a1ce0bb2b299980019	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\4c0801f8 = 3e7a1ebe20eb387ff2e71cb9147d1f2e50ea164d4a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07b63e23978190da544e233031c9b1bab84b0275a2d50e7fe16e34c94747ac6827dd70a87dfb3e38b95a73be3cdc2737e2cfc515adf31b0ac68ff8136ae69ec213bc5736b9052396df353c7b9326429561b637c24ca3ed747e244d5337f8aa67870a3532fed7467612200817e5e1ff12d5b77d7adc16370091d6eec58ed0a7c0ebb9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fzjyyuozyoho\6debe40 = c8e07263e23978190da545a833011f9919ab8bb362582555eef316d52d501f466bf1d2cda63de146abfdb86917a6459297b59cd60c7e83c5e1c5eed6c1bdf13589e2990af775cab6f6f96e5f967934e4f49bcf02fc4c22f4a7661282858eb22c34275fdb5fb373f12627c2c2833d18281873a1ce0bb2b299980019	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1996 regsvr32.exe
1996 regsvr32.exe
1816 regsvr32.exe
1816 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1996 regsvr32.exe
1816 regsvr32.exe

pid	process
1996	regsvr32.exe
1996	regsvr32.exe
1816	regsvr32.exe
1816	regsvr32.exe

pid	process
1996	regsvr32.exe
1816	regsvr32.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 668 wrote to memory of 1996	668	regsvr32.exe	regsvr32.exe
PID 668 wrote to memory of 1996	668	regsvr32.exe	regsvr32.exe
PID 668 wrote to memory of 1996	668	regsvr32.exe	regsvr32.exe
PID 1996 wrote to memory of 2904	1996	regsvr32.exe	explorer.exe
PID 1996 wrote to memory of 2904	1996	regsvr32.exe	explorer.exe
PID 1996 wrote to memory of 2904	1996	regsvr32.exe	explorer.exe
PID 1996 wrote to memory of 2904	1996	regsvr32.exe	explorer.exe
PID 1996 wrote to memory of 2904	1996	regsvr32.exe	explorer.exe
PID 2904 wrote to memory of 3920	2904	explorer.exe	schtasks.exe
PID 2904 wrote to memory of 3920	2904	explorer.exe	schtasks.exe
PID 2904 wrote to memory of 3920	2904	explorer.exe	schtasks.exe
PID 756 wrote to memory of 1816	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1816	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1816	756	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 2608	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2608	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2608	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2608	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2608	1816	regsvr32.exe	explorer.exe
PID 2608 wrote to memory of 2044	2608	explorer.exe	reg.exe
PID 2608 wrote to memory of 2044	2608	explorer.exe	reg.exe
PID 2608 wrote to memory of 900	2608	explorer.exe	reg.exe
PID 2608 wrote to memory of 900	2608	explorer.exe	reg.exe
PID 3032 wrote to memory of 2928	3032	regsvr32.exe	regsvr32.exe
PID 3032 wrote to memory of 2928	3032	regsvr32.exe	regsvr32.exe
PID 3032 wrote to memory of 2928	3032	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rcfnnvaygf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:3920

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ndhftampeame" /d "0"
4⤵
PID:2044

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ejloaimdezu" /d "0"
4⤵
PID:900

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll"
2⤵
PID:2928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
MD5
bb17bf13123596ba3065efc74d625a3c

SHA1
b589b0dee84e30e205f242a8d429b1e231b5ec5b

SHA256
d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

SHA512
40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Download Submit
C:\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
MD5
4c83d45f2decd3833920f922ffaf4136

SHA1
9275e9488b09d6cc187140332c2fe9438911829e

SHA256
368a6a700d64eac807255d1fa312b12f5522a3a56bc31b831804a9d1bbb7b174

SHA512
b9d27b805a81687b77f0d80ce63b3550d82bac0c0aa8d89b825b37a6241155fe0c34d955d34c2a1e06bfe93cf1d0becbfd9ddbeeb39ebe52f8ae506da6400db5

Download Submit
\Users\Admin\AppData\Local\Temp\d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937.exe.dll
MD5
bb17bf13123596ba3065efc74d625a3c

SHA1
b589b0dee84e30e205f242a8d429b1e231b5ec5b

SHA256
d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

SHA512
40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Download Submit
memory/900-129-0x0000000000000000-mapping.dmp

Download
memory/1816-126-0x0000000002F20000-0x0000000002F21000-memory.dmp

Filesize
4KB

Download
memory/1816-124-0x0000000000000000-mapping.dmp

Download
memory/1996-117-0x0000000010000000-0x00000000100F5000-memory.dmp

Filesize
980KB

Download
memory/1996-116-0x0000000002D30000-0x0000000002E7A000-memory.dmp

Filesize
1.3MB

Download
memory/1996-115-0x0000000000000000-mapping.dmp

Download
memory/2044-128-0x0000000000000000-mapping.dmp

Download
memory/2608-130-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2608-127-0x0000000000000000-mapping.dmp

Download
memory/2608-131-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2608-132-0x00000000028D0000-0x00000000028F1000-memory.dmp

Filesize
132KB

Download
memory/2904-122-0x00000000028D0000-0x00000000028F1000-memory.dmp

Filesize
132KB

Download
memory/2904-121-0x0000000004480000-0x0000000004481000-memory.dmp

Filesize
4KB

Download
memory/2904-120-0x0000000004480000-0x0000000004481000-memory.dmp

Filesize
4KB

Download
memory/2904-118-0x0000000000000000-mapping.dmp

Download
memory/2928-134-0x0000000000000000-mapping.dmp

Download
memory/3920-119-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads