qakbot | ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b

General

Target

ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
Size

1.6MB
MD5

6317f9ae495c49ab7b5e5b501a5639ef
SHA1

2d49c0f32a441d09ddee7c3b2b019ae8904ea1e7
SHA256

ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b
SHA512

bd9c6df8b2d91959580c6227a990882625c029528c0e53a600de8f6cc970e95fbb26108f3ae7f1bc8ef18d2b4b429490ec4ae5f6935e47c6c44dbf06c21be4f1

Score

10^/10

qakbot obama152 1643019304 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama152

Campaign

1643019304

C2

96.80.109.57:995

209.210.95.228:32100

180.233.150.134:995

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

83.110.2.97:443

78.87.44.54:995

86.108.46.251:443

74.15.2.252:2222

102.65.38.67:443

37.203.225.248:443

75.139.7.190:2083

24.53.49.240:443

80.14.196.176:2222

94.60.254.81:443

86.98.32.228:443

130.164.129.3:443

176.67.56.94:443

31.167.160.170:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1104 regsvr32.exe

pid	process
1104	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1800 schtasks.exe

pid	process
1800	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e6254a0eee0a121e793bab5bb530311de8069ee7051ff5c117c68a418b64b02cc0bd50f91919dcd236bc2e4330c38c7b91f5fb9a42b3281cfd9300e633741fd948268ff19112799acc4a0934bb7e927347c827d828d1b8e2562b113c41759c13	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = 00d98f835011d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\6cb3704e = 22e52ca6c8c1db981e8e038a48ebaa14a21b9cc46e5e51a3a888	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = 80c40a9e4f11d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-0a-9c-46-06-df\WpadDecisionTime = 80c40a9e4f11d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e6254a0eee0a121e793bab5bb530311de8069ee7051ff5c117c68a418b64b02cc0b353ff1919dcd236bc2e4330c38c7b91f5fb9a42b3281cfd9300e633741fd948268ff19112799acc4a0934bb7e927347c827d828d1b8e2562b113c41759c13	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e6254a0eee0a121e793bab5bb530311de80990e7051ff5c117c68a418b64b02cc1b955fc1919dcd236bc2e4330c38c7b91f5fb9a42b3281cfd9300e633741fd948268ff19112799acc4a0934bb7e927347c827d828d1b8e2562b113c41759c13	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadNetworkName = "ネットワーク 2"	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-0a-9c-46-06-df\WpadDetectedUrl	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = 8010e9635011d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-0a-9c-46-06-df\WpadDecisionTime = 6074eefc4f11d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\d40f172b = c5602211191a8a77654603457c4a5e7edd04ec17918fd2247cff60f6d2f48a9d433211210ea0316ffb3c04f0f40f357b37725fef68acc0dc1cdd24699a7cd32ccd1af804b37ad910c024e890b0abbc2a27a3016f2a877ae7165012536a62f70af98c30cc6f45a035be6d6d95ab69888e6fbb81dee02eaf07f91fd236e5791ce0331d42c9f179367bc94f6bdd6041a32d4adedea8702d313a4ec4308d5996287201c33679506e7e673e06	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\9ed9a893 = bcca5faa827f35d42b96b060b6ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e625430eee0a121e793baa11b2383318eb019ee04a1cfacb12ca8f774fe057c88f501ea7b351a49db7e6d1373d88ac1ba86ce4f0ccf229510d1f3472b8b2dbea3ee4719f8050c7e43f88e217783d8a602916494f9200d2	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = e0c790d15011d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e6254a0eee0a121e793bab5bb530311de90398e4051ff5c117c68a418b64b02cc1bf54f21919dcd236bc2e4330c38c7b91f5fb9a42b3281cfd9300e633741fd948268ff19112799acc4a0934bb7e927347c827d828d1b8e2562b113c41759c13	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\13fa1fb8 = 2b6f6d0f99351c9ae8624b648e0fa7eec94343759a29702185cd067f961d96fbea46bf1e335b7769b4e1e48d0ab0c1fe8f33210533595a650c956be5b50e9a6eac20f0338a44a4d71704f50a79210f56725e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-0a-9c-46-06-df\WpadDecisionTime = 60a598c74f11d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e6254a0eee0a121e793bab5bb530311de80990e7051ff5c117c68a418b64b02cc0b353ff1919dcd236bc2e4330c38c7b91f5fb9a42b3281cfd9300e633741fd948268ff19112799acc4a0934bb7e927347c827d828d1b8e2562b113c41759c13	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = 80b305755211d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\6ef25032 = 6c52268a2c6253e5d415af0d3fb73e88cc64030664f50cc19e8e33f250a26741a15d24371a98f98dbfc5c3536b293cb01649a2298de9010930f07f1402115ebb9401c6f4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-0a-9c-46-06-df	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\6CF876C7\LanguageList = 6a0061002d004a00500000006a006100000065006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-0a-9c-46-06-df\WpadDecisionTime = a01544015111d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e625430eee0a121e793baa11b2383318eb019ee04a1cfacb14c589774fe057c88f501ea7b351a49db7e6d1373d88ac1ba86ce4f0ccf229510d1f3472b8b2dbea3ee4719f8050c7e43f88e217783d8a602916494f9200d2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = 60a598c74f11d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecision = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = 6074eefc4f11d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DD3421AB-AC17-4DA4-8136-DEB3A05134DD}\WpadDecisionTime = e0fa7ab45011d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e6254a0eee0a121e793bab5bb530311de9099be0051ff5c117c68a418b64b02cc1b25ff21919dcd236bc2e4330c38c7b91f5fb9a42b3281cfd9300e633741fd948268ff19112799acc4a0934bb7e927347c827d828d1b8e2562b113c41759c13	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rkzkeutocojz\e190c765 = e625540eee0a27d5ffd74a1a5a7b6c8368ff30855408c293c76514d67765ce9ad96bb3953415cdc0a22e2698c0baa6038e5e4d9e2fa539d5a6ad212183f9df731de7	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

668 rundll32.exe
1104 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

668 rundll32.exe
1104 regsvr32.exe

pid	process
668	rundll32.exe
1104	regsvr32.exe

pid	process
668	rundll32.exe
1104	regsvr32.exe

Suspicious use of WriteProcessMemory 58 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exetaskeng.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 764 wrote to memory of 668	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 668	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 668	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 668	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 668	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 668	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 668	764	rundll32.exe	rundll32.exe
PID 668 wrote to memory of 1696	668	rundll32.exe	explorer.exe
PID 668 wrote to memory of 1696	668	rundll32.exe	explorer.exe
PID 668 wrote to memory of 1696	668	rundll32.exe	explorer.exe
PID 668 wrote to memory of 1696	668	rundll32.exe	explorer.exe
PID 668 wrote to memory of 1696	668	rundll32.exe	explorer.exe
PID 668 wrote to memory of 1696	668	rundll32.exe	explorer.exe
PID 1696 wrote to memory of 1800	1696	explorer.exe	schtasks.exe
PID 1696 wrote to memory of 1800	1696	explorer.exe	schtasks.exe
PID 1696 wrote to memory of 1800	1696	explorer.exe	schtasks.exe
PID 1696 wrote to memory of 1800	1696	explorer.exe	schtasks.exe
PID 992 wrote to memory of 1676	992	taskeng.exe	regsvr32.exe
PID 992 wrote to memory of 1676	992	taskeng.exe	regsvr32.exe
PID 992 wrote to memory of 1676	992	taskeng.exe	regsvr32.exe
PID 992 wrote to memory of 1676	992	taskeng.exe	regsvr32.exe
PID 992 wrote to memory of 1676	992	taskeng.exe	regsvr32.exe
PID 1676 wrote to memory of 1104	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1104	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1104	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1104	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1104	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1104	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1104	1676	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1708	1104	regsvr32.exe	explorer.exe
PID 1104 wrote to memory of 1708	1104	regsvr32.exe	explorer.exe
PID 1104 wrote to memory of 1708	1104	regsvr32.exe	explorer.exe
PID 1104 wrote to memory of 1708	1104	regsvr32.exe	explorer.exe
PID 1104 wrote to memory of 1708	1104	regsvr32.exe	explorer.exe
PID 1104 wrote to memory of 1708	1104	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 1160	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1160	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1160	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1160	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 456	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 456	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 456	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 456	1708	explorer.exe	reg.exe
PID 1992 wrote to memory of 1936	1992	taskeng.exe	default-browser-agent.exe
PID 1992 wrote to memory of 1936	1992	taskeng.exe	default-browser-agent.exe
PID 1992 wrote to memory of 1936	1992	taskeng.exe	default-browser-agent.exe
PID 788 wrote to memory of 1332	788	taskeng.exe	regsvr32.exe
PID 788 wrote to memory of 1332	788	taskeng.exe	regsvr32.exe
PID 788 wrote to memory of 1332	788	taskeng.exe	regsvr32.exe
PID 788 wrote to memory of 1332	788	taskeng.exe	regsvr32.exe
PID 788 wrote to memory of 1332	788	taskeng.exe	regsvr32.exe
PID 1332 wrote to memory of 1796	1332	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1796	1332	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1796	1332	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1796	1332	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1796	1332	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1796	1332	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1796	1332	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn injfdlnru /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll\"" /SC ONCE /Z /ST 18:18 /ET 18:30
4⤵
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\taskeng.exe
taskeng.exe {FAB88E55-97D5-4094-8732-F9909DE0B9C5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xeldj" /d "0"
5⤵
PID:1160

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pwqzvsoi" /d "0"
5⤵
PID:456

C:\Windows\system32\taskeng.exe
taskeng.exe {F592F01E-3355-4240-AE59-C7A98D832DE7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
3⤵
PID:1796

C:\Windows\system32\taskeng.exe
taskeng.exe {0189424C-DC71-4D93-A9E4-473233A0B84E} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
MD5
6317f9ae495c49ab7b5e5b501a5639ef

SHA1
2d49c0f32a441d09ddee7c3b2b019ae8904ea1e7

SHA256
ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b

SHA512
bd9c6df8b2d91959580c6227a990882625c029528c0e53a600de8f6cc970e95fbb26108f3ae7f1bc8ef18d2b4b429490ec4ae5f6935e47c6c44dbf06c21be4f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
MD5
1541f27105940bdcd76efa63db34c826

SHA1
0c89b0dc2aa4a0f4202d888360bfb31b149feab0

SHA256
93c1a5ba2016ef2cbd1cd2dfca85aa0ce5d02de6e45471135637ac2da15706c9

SHA512
032ef3914d9427c8a4c7f2513929fbc2f0bdd7f82d4c69b080ae4d10da05e84e06ce2af9fd19d4cbbde18ba2f51f9c098d2e234909cdd3cde86f2976c3091c3f

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
MD5
6317f9ae495c49ab7b5e5b501a5639ef

SHA1
2d49c0f32a441d09ddee7c3b2b019ae8904ea1e7

SHA256
ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b

SHA512
bd9c6df8b2d91959580c6227a990882625c029528c0e53a600de8f6cc970e95fbb26108f3ae7f1bc8ef18d2b4b429490ec4ae5f6935e47c6c44dbf06c21be4f1

Download Submit
memory/668-56-0x0000000000830000-0x00000000009D8000-memory.dmp

Filesize
1.7MB

Download
memory/668-58-0x00000000002E0000-0x0000000000301000-memory.dmp

Filesize
132KB

Download
memory/668-57-0x00000000002E0000-0x0000000000301000-memory.dmp

Filesize
132KB

Download
memory/668-59-0x00000000002E0000-0x0000000000301000-memory.dmp

Filesize
132KB

Download
memory/668-60-0x00000000002E0000-0x0000000000301000-memory.dmp

Filesize
132KB

Download
memory/668-61-0x0000000000790000-0x00000000007D3000-memory.dmp

Filesize
268KB

Download
memory/668-62-0x00000000002E0000-0x0000000000301000-memory.dmp

Filesize
132KB

Download
memory/668-55-0x0000000076671000-0x0000000076673000-memory.dmp

Filesize
8KB

Download
memory/1104-73-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/1104-71-0x0000000000A70000-0x0000000000C18000-memory.dmp

Filesize
1.7MB

Download
memory/1104-72-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/1104-75-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/1104-74-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/1104-76-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/1676-67-0x000007FEFC3F1000-0x000007FEFC3F3000-memory.dmp

Filesize
8KB

Download
memory/1696-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1696-65-0x00000000750F1000-0x00000000750F3000-memory.dmp

Filesize
8KB

Download
memory/1696-63-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1708-81-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads