qakbot | b83f24c6503b8ca75beea28f0992d819ff195463c8629bb5c69b82e6c03aa4c3

General

Target

24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll
Size

644KB
MD5

259bda03244a5c9077b39d0632ba829e
SHA1

24f1a3db1a108d35950cb15bd93dd13c4455f13b
SHA256

b83f24c6503b8ca75beea28f0992d819ff195463c8629bb5c69b82e6c03aa4c3
SHA512

f1053c863125f918accd1e2fb5211773313defc6a2dec607eca4041e73f7307058193e6291fc7c2c66125ebc3ee61e451e217148f463b7bfdcebcd3125cc05a7

Score

10^/10

qakbot cullinan 1640168876 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1904 regsvr32.exe

pid	process
1904	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1380 schtasks.exe

pid	process
1380	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadNetworkName = "Network 3"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6f-aa-e9-dd-ef	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6f-aa-e9-dd-ef\WpadDecisionReason = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6f-aa-e9-dd-ef\WpadDetectedUrl	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\8929898e = a23142c75660344c135d9bb2d3b89db9c94170101ac59155db9492cac9a8a2bf373fc7a1d585c4596d7b85cd1e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0169000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\c3ff3636 = 05a04852b662dd75f4559b180537ed28922c0c6a3848ba3c0ec803f3d445ab0b0b348fa2e3a9e3650cdef85864517965	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadDecisionTime = 10134f174e0dd801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadDecisionTime = 30997b164f0dd801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0169000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6f-aa-e9-dd-ef\WpadDecisionTime = 10100de24f0dd801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\8929898e = a23142c75660344c135d9bb2d3b89db9c84d73171ac59155db9492cac9a8a2bf3635c5a0d585c4596d7b85cd1e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\8929898e = a23142c75660344c135d9bb2d3b89db9c94b74131ac59155db9492cac9a8a2bf3734c1aad585c4596d7b85cd1e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadDecisionReason = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\8929898e = a2314bc75660344c135d9af8d4b199b8ca48721454c09a50d29d91fc1571b44b07168e53	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\c6-6f-aa-e9-dd-ef	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\8929898e = a23142c75660344c135d9bb2d3b89db9c94c76131ac59155db9492cac9a8a2bf3731c6afd585c4596d7b85cd1e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadDecisionTime = 105a7430500dd801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\7b435153 = 8cec12cb3305e3c2237681019689611c418b41c7a98ce15e4bf90ab7ab088eb28b25cd7f624d779b2816c96780112bb57afe4c05e356be6cb617c2778cf53f4bdfc93a7f76cdde4fc30bc9d98a6b98171fb846110f809a2032a6ed56b95930cebdd940243de054c9b8078c140f3f8a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\40a3ea5 = 5e8792a01cf20ef3d2f3dac5d9c99169bd35b94543954f57	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6f-aa-e9-dd-ef\WpadDecisionTime = d04156e44e0dd801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0169000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6f-aa-e9-dd-ef\WpadDecisionTime = f0232d564f0dd801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zlnyayinswvmtm	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadDecisionTime = f0f3dc404e0dd801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadDecisionTime = d04156e44e0dd801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8494497A-BFBF-494C-89FC-B6E42562246F}\WpadDecisionTime = 90c381c14f0dd801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000b000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0169000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\8929898e = a2315cc75660019fc9466e8cf7f561	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zlnyayinswvmtm\f660e678 = a492e519dbe5342ddb1b5bc68403ee82b494d33df05bec27c03f784d91648824cc91dd24fe9f85a1f5f959b917e705a6a8d95a58fb3c1ec2eea55ea2	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6f-aa-e9-dd-ef\WpadDecision = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1096 rundll32.exe
1904 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1096 rundll32.exe
1904 regsvr32.exe

pid	process
1096	rundll32.exe
1904	regsvr32.exe

pid	process
1096	rundll32.exe
1904	regsvr32.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1096	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1096	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1096	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1096	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1096	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1096	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1096	1724	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 268	1096	rundll32.exe	explorer.exe
PID 1096 wrote to memory of 268	1096	rundll32.exe	explorer.exe
PID 1096 wrote to memory of 268	1096	rundll32.exe	explorer.exe
PID 1096 wrote to memory of 268	1096	rundll32.exe	explorer.exe
PID 1096 wrote to memory of 268	1096	rundll32.exe	explorer.exe
PID 1096 wrote to memory of 268	1096	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1380	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 1380	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 1380	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 1380	268	explorer.exe	schtasks.exe
PID 1768 wrote to memory of 1060	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1060	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1060	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1060	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1060	1768	taskeng.exe	regsvr32.exe
PID 1060 wrote to memory of 1904	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1904	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1904	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1904	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1904	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1904	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1904	1060	regsvr32.exe	regsvr32.exe
PID 1904 wrote to memory of 2028	1904	regsvr32.exe	explorer.exe
PID 1904 wrote to memory of 2028	1904	regsvr32.exe	explorer.exe
PID 1904 wrote to memory of 2028	1904	regsvr32.exe	explorer.exe
PID 1904 wrote to memory of 2028	1904	regsvr32.exe	explorer.exe
PID 1904 wrote to memory of 2028	1904	regsvr32.exe	explorer.exe
PID 1904 wrote to memory of 2028	1904	regsvr32.exe	explorer.exe
PID 2028 wrote to memory of 1748	2028	explorer.exe	reg.exe
PID 2028 wrote to memory of 1748	2028	explorer.exe	reg.exe
PID 2028 wrote to memory of 1748	2028	explorer.exe	reg.exe
PID 2028 wrote to memory of 1748	2028	explorer.exe	reg.exe
PID 2028 wrote to memory of 1604	2028	explorer.exe	reg.exe
PID 2028 wrote to memory of 1604	2028	explorer.exe	reg.exe
PID 2028 wrote to memory of 1604	2028	explorer.exe	reg.exe
PID 2028 wrote to memory of 1604	2028	explorer.exe	reg.exe
PID 1248 wrote to memory of 1744	1248	taskeng.exe	regsvr32.exe
PID 1248 wrote to memory of 1744	1248	taskeng.exe	regsvr32.exe
PID 1248 wrote to memory of 1744	1248	taskeng.exe	regsvr32.exe
PID 1248 wrote to memory of 1744	1248	taskeng.exe	regsvr32.exe
PID 1248 wrote to memory of 1744	1248	taskeng.exe	regsvr32.exe
PID 1744 wrote to memory of 1152	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1152	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1152	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1152	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1152	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1152	1744	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 1152	1744	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ruebdwp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll\"" /SC ONCE /Z /ST 15:57 /ET 16:09
4⤵
- Creates scheduled task(s)
PID:1380

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:824

C:\Windows\system32\taskeng.exe
taskeng.exe {385BA619-4781-4352-AC20-4820469A6780} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fxeycgzg" /d "0"
5⤵
PID:1748

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Vyqifkzufa" /d "0"
5⤵
PID:1604

C:\Windows\system32\taskeng.exe
taskeng.exe {510DEE15-411D-4535-957B-EF59B731E8AE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll"
3⤵
PID:1152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll
MD5
259bda03244a5c9077b39d0632ba829e

SHA1
24f1a3db1a108d35950cb15bd93dd13c4455f13b

SHA256
b83f24c6503b8ca75beea28f0992d819ff195463c8629bb5c69b82e6c03aa4c3

SHA512
f1053c863125f918accd1e2fb5211773313defc6a2dec607eca4041e73f7307058193e6291fc7c2c66125ebc3ee61e451e217148f463b7bfdcebcd3125cc05a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll
MD5
01b8a974f93befd9725b5f7f5b27e029

SHA1
91eca55d0a72e1fa3e4d28df748f029da44dc03c

SHA256
90a59ab0372737c3d1536ed00213d96cd23f1fd5209843f1d2539fb493da588c

SHA512
2d2a1a254e4628fe1ddd15b63f16896033430f6fb9631dee1f76f51acfe00ae35e4c67f57af82770d33acf6454fe88ef58cad0c228f978b4f3791f6a2fa10d30

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\24f1a3db1a108d35950cb15bd93dd13c4455f13b.dll
MD5
259bda03244a5c9077b39d0632ba829e

SHA1
24f1a3db1a108d35950cb15bd93dd13c4455f13b

SHA256
b83f24c6503b8ca75beea28f0992d819ff195463c8629bb5c69b82e6c03aa4c3

SHA512
f1053c863125f918accd1e2fb5211773313defc6a2dec607eca4041e73f7307058193e6291fc7c2c66125ebc3ee61e451e217148f463b7bfdcebcd3125cc05a7

Download Submit
memory/268-62-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/268-65-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/268-64-0x0000000075121000-0x0000000075123000-memory.dmp

Filesize
8KB

Download
memory/824-66-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download
memory/1096-60-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/1096-56-0x00000000003C0000-0x0000000000403000-memory.dmp

Filesize
268KB

Download
memory/1096-54-0x0000000076491000-0x0000000076493000-memory.dmp

Filesize
8KB

Download
memory/1096-59-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/1096-58-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/1096-57-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/1096-55-0x00000000001F0000-0x0000000000290000-memory.dmp

Filesize
640KB

Download
memory/1096-61-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/1904-73-0x00000000004D0000-0x00000000004F1000-memory.dmp

Filesize
132KB

Download
memory/1904-75-0x00000000004D0000-0x00000000004F1000-memory.dmp

Filesize
132KB

Download
memory/1904-74-0x00000000004D0000-0x00000000004F1000-memory.dmp

Filesize
132KB

Download
memory/1904-72-0x00000000004D0000-0x00000000004F1000-memory.dmp

Filesize
132KB

Download
memory/1904-81-0x00000000004D0000-0x00000000004F1000-memory.dmp

Filesize
132KB

Download
memory/1904-80-0x0000000000390000-0x00000000003D3000-memory.dmp

Filesize
268KB

Download
memory/1904-71-0x0000000000430000-0x00000000004D0000-memory.dmp

Filesize
640KB

Download
memory/2028-82-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads