qakbot | ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b

General

Target

ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
Size

1.6MB
MD5

6317f9ae495c49ab7b5e5b501a5639ef
SHA1

2d49c0f32a441d09ddee7c3b2b019ae8904ea1e7
SHA256

ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b
SHA512

bd9c6df8b2d91959580c6227a990882625c029528c0e53a600de8f6cc970e95fbb26108f3ae7f1bc8ef18d2b4b429490ec4ae5f6935e47c6c44dbf06c21be4f1

Score

10^/10

qakbot obama152 1643019304 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama152

Campaign

1643019304

C2

96.80.109.57:995

209.210.95.228:32100

180.233.150.134:995

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

83.110.2.97:443

78.87.44.54:995

86.108.46.251:443

74.15.2.252:2222

102.65.38.67:443

37.203.225.248:443

75.139.7.190:2083

24.53.49.240:443

80.14.196.176:2222

94.60.254.81:443

86.98.32.228:443

130.164.129.3:443

176.67.56.94:443

31.167.160.170:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

856 regsvr32.exe

pid	process
856	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1872 schtasks.exe
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

1484 net.exe
1636 net.exe
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exeipconfig.exenetstat.exe

pid process

1180 ipconfig.exe
1120 netstat.exe
1864 ipconfig.exe
904 netstat.exe

pid	process
1872	schtasks.exe

pid	process
1484	net.exe
1636	net.exe

pid	process
1180	ipconfig.exe
1120	netstat.exe
1864	ipconfig.exe
904	netstat.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD8D107A-B29D-45C4-B9AB-C1726E093DF1}	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD8D107A-B29D-45C4-B9AB-C1726E093DF1}\WpadDecisionReason = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-7d-b1-38-36-fb\WpadDecisionTime = 00fe111eeb11d801	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbed601fe2c83e41c91f45574abf946ee630aa36b0d7f68a788ca8834fd2a7673927a74ae3c51732b177a92812f0f76c8632f3bb6368adf3ec1c08c5a0363b9a12d4eeac6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbed601fe2c83e41c91f45574abf946ed6404a66b0d7f68a788ca8834fd2a7670947875ae3c51732b177a92812f0f76c8632f3bb6368adf3ec1c08c5a0363b9a12d4eeac6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\fb4e8c58 = 326322709f75b2b25446d23b7e68cba715675eb41d78c657283d4868	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\f334cb91 = 378ddf1a1de848911256ca8619271139530982487a8d83fa0996958e44f929d0bdd78205fe91d47d1221e653c08d358c70263e5fede04029a8a13dfa1ffa18329fc9bb6008c30645e12312cb901e667404127996c091dc498038	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbed601fe2c83e41c91f45574abf946ee6702a06b0d7f68a788ca8834fd2a767397727fae3c51732b177a92812f0f76c8632f3bb6368adf3ec1c08c5a0363b9a12d4eeac6	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbed601fe2c83e41c91f45574abf946ed6706a96b0d7f68a788ca8834fd2a7670947875ae3c51732b177a92812f0f76c8632f3bb6368adf3ec1c08c5a0363b9a12d4eeac6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\e181647f = 0ed56f5fde7539d980e11d7bc5687e9c320c7fdcc7c60a96a575689f74194d387ea495cd228431d0779c59a29030f6757d4f44a326ddc2a9e4407c29185c0ca8e6f0c4f593e22aa2f85140627919a7b11e2b2b470eba134240ae5a3f8aa3e98ad65a60cee4f6ccee3de8e88d9808a05431da29c2f4ca	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD8D107A-B29D-45C4-B9AB-C1726E093DF1}\WpadDecisionTime = 00fe111eeb11d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD8D107A-B29D-45C4-B9AB-C1726E093DF1}\ee-7d-b1-38-36-fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbedf01fe2c83e41c91f51f73a3fa46e36204a4240f756fa685cebe9e5778c644eb514736a32acdf9d8cc1b16a6e0e21934c7b088336ca00136297f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-7d-b1-38-36-fb	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-7d-b1-38-36-fb\WpadDecision = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\dc64f3f8 = 9d8591297b82b1476e9af6d6d0e8091d2befdba687457c070746e95447934288710cd73bc847e40d23bd6a93136e7dfb2a148a0f4b68760af0051999d87bd6824286d54c3decb6d872dee947b795dd8214d75f90993d7763fc3180545ad8b7d1412f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\2c4f0b59 = f0615242df6dd7ef5927c20c4560fa3d0d125b7fd2eaa819504a6ac054cacbb05b5a4b9e735f99a9c660078b372391234df9ca2f5c923a8ebceaab28d8a4e32eace2be	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbedf01fe2c83e41c91f51f73a3fa46e36204a4240f756fa486ccbe9e5778c644eb514736a32acdf9d8cc1b16a6e0e21934c7b088336ca00136297f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbed601fe2c83e41c91f45574abf946ee630aa36b0d7f68a788ca8834fd2a7673907a7cae3c51732b177a92812f0f76c8632f3bb6368adf3ec1c08c5a0363b9a12d4eeac6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbed601fe2c83e41c91f45574abf946ed6404a66b0d7f68a788ca8834fd2a7673927a74ae3c51732b177a92812f0f76c8632f3bb6368adf3ec1c08c5a0363b9a12d4eeac6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\6CF876C7\LanguageList = 6a0061002d004a00500000006a006100000065006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbed601fe2c83e41c91f45574abf946ee6400a06b0d7f68a788ca8834fd2a767397727fae3c51732b177a92812f0f76c8632f3bb6368adf3ec1c08c5a0363b9a12d4eeac6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\530664af = afbec801fe2cb641b4c944620982c2efd9b1efc3d9c1d7c7875d8db204e86feadd55da04554f1d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\6699b4e1 = e1ec155b13deed7cc70da5a4c70b40b72f75e2b673c51281503cbcb5ddda26ecafd08d7600621318f3859c592e99f2bac3d681e5a338856e3ba76527cd90710ccbfb200abb24e820746e8df4b76894d09dd2597d9101696659b2150f959155cb1cfed199b0f94834e830bed34ba8086211f87c9621cf4b285ef70f3954476f1037cf311bec4d62198cedf8e30983f1bc087270abe898b6950d960a36e8c6e0115dc18b03	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\64d8949d = 9ee6d4dcfa5c7557cd7d9994b7711dc0aab6fe56dea571b316e74324bd75bdc9f89ccf3757b54c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\19d0db17 = 913bf601c571f4787958654f117c5cc05b53117018d7d49e1de9978d4c2ce7184e6bcb726e97d7bb04342abc6a3841fa42762a64be4e0a3621b07fdf3ecd6d254a60496013ccc3a9e1b5c1f3c05188242e91910fb6de59059c29cf1b715ae460f8443a9c74fc03fbf896357a6361a6a9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouaznewx\de25d384 = 4c4bda69804b88366c019782e5ce1f7a0f03a9b99a5251bc279d779ccd78d32c2d267c98d8adb4b96ace529ff14bfba4df27b2ccee94e68447385f6c4bae0a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exeexplorer.exeexplorer.exe

pid process

696 rundll32.exe
856 regsvr32.exe
648 explorer.exe
1072 explorer.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

696 rundll32.exe
856 regsvr32.exe

pid	process
696	rundll32.exe
856	regsvr32.exe
648	explorer.exe
1072	explorer.exe

pid	process
696	rundll32.exe
856	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

whoami.exenetstat.exemsiexec.exewhoami.exe

description	pid	process
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	1772	whoami.exe
Token: SeDebugPrivilege	904	netstat.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeSecurityPrivilege	1344	msiexec.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe
Token: SeDebugPrivilege	1712	whoami.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 644 wrote to memory of 696	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 696	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 696	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 696	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 696	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 696	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 696	644	rundll32.exe	rundll32.exe
PID 696 wrote to memory of 648	696	rundll32.exe	explorer.exe
PID 696 wrote to memory of 648	696	rundll32.exe	explorer.exe
PID 696 wrote to memory of 648	696	rundll32.exe	explorer.exe
PID 696 wrote to memory of 648	696	rundll32.exe	explorer.exe
PID 696 wrote to memory of 648	696	rundll32.exe	explorer.exe
PID 696 wrote to memory of 648	696	rundll32.exe	explorer.exe
PID 648 wrote to memory of 1872	648	explorer.exe	schtasks.exe
PID 648 wrote to memory of 1872	648	explorer.exe	schtasks.exe
PID 648 wrote to memory of 1872	648	explorer.exe	schtasks.exe
PID 648 wrote to memory of 1872	648	explorer.exe	schtasks.exe
PID 1004 wrote to memory of 1576	1004	taskeng.exe	regsvr32.exe
PID 1004 wrote to memory of 1576	1004	taskeng.exe	regsvr32.exe
PID 1004 wrote to memory of 1576	1004	taskeng.exe	regsvr32.exe
PID 1004 wrote to memory of 1576	1004	taskeng.exe	regsvr32.exe
PID 1004 wrote to memory of 1576	1004	taskeng.exe	regsvr32.exe
PID 1576 wrote to memory of 856	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 856	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 856	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 856	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 856	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 856	1576	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 856	1576	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1072	856	regsvr32.exe	explorer.exe
PID 856 wrote to memory of 1072	856	regsvr32.exe	explorer.exe
PID 856 wrote to memory of 1072	856	regsvr32.exe	explorer.exe
PID 856 wrote to memory of 1072	856	regsvr32.exe	explorer.exe
PID 856 wrote to memory of 1072	856	regsvr32.exe	explorer.exe
PID 856 wrote to memory of 1072	856	regsvr32.exe	explorer.exe
PID 1072 wrote to memory of 2044	1072	explorer.exe	reg.exe
PID 1072 wrote to memory of 2044	1072	explorer.exe	reg.exe
PID 1072 wrote to memory of 2044	1072	explorer.exe	reg.exe
PID 1072 wrote to memory of 2044	1072	explorer.exe	reg.exe
PID 1072 wrote to memory of 932	1072	explorer.exe	reg.exe
PID 1072 wrote to memory of 932	1072	explorer.exe	reg.exe
PID 1072 wrote to memory of 932	1072	explorer.exe	reg.exe
PID 1072 wrote to memory of 932	1072	explorer.exe	reg.exe
PID 648 wrote to memory of 1772	648	explorer.exe	whoami.exe
PID 648 wrote to memory of 1772	648	explorer.exe	whoami.exe
PID 648 wrote to memory of 1772	648	explorer.exe	whoami.exe
PID 648 wrote to memory of 1772	648	explorer.exe	whoami.exe
PID 648 wrote to memory of 1084	648	explorer.exe	cmd.exe
PID 648 wrote to memory of 1084	648	explorer.exe	cmd.exe
PID 648 wrote to memory of 1084	648	explorer.exe	cmd.exe
PID 648 wrote to memory of 1084	648	explorer.exe	cmd.exe
PID 648 wrote to memory of 1160	648	explorer.exe	arp.exe
PID 648 wrote to memory of 1160	648	explorer.exe	arp.exe
PID 648 wrote to memory of 1160	648	explorer.exe	arp.exe
PID 648 wrote to memory of 1160	648	explorer.exe	arp.exe
PID 648 wrote to memory of 1864	648	explorer.exe	ipconfig.exe
PID 648 wrote to memory of 1864	648	explorer.exe	ipconfig.exe
PID 648 wrote to memory of 1864	648	explorer.exe	ipconfig.exe
PID 648 wrote to memory of 1864	648	explorer.exe	ipconfig.exe
PID 648 wrote to memory of 1484	648	explorer.exe	net.exe
PID 648 wrote to memory of 1484	648	explorer.exe	net.exe
PID 648 wrote to memory of 1484	648	explorer.exe	net.exe
PID 648 wrote to memory of 1484	648	explorer.exe	net.exe
PID 648 wrote to memory of 1848	648	explorer.exe	nslookup.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gpxnstms /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll\"" /SC ONCE /Z /ST 12:51 /ET 13:03
4⤵
- Creates scheduled task(s)
PID:1872

C:\Windows\SysWOW64\whoami.exe
whoami /all
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\SysWOW64\cmd.exe
cmd /c set
4⤵
PID:1084

C:\Windows\SysWOW64\arp.exe
arp -a
4⤵
PID:1160

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
4⤵
- Gathers network information
PID:1864

C:\Windows\SysWOW64\net.exe
net view /all
4⤵
- Discovers systems in the same network
PID:1484

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.WORKGROUP
4⤵
PID:1848

C:\Windows\SysWOW64\net.exe
net share
4⤵
PID:1752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
5⤵
PID:736

C:\Windows\SysWOW64\route.exe
route print
4⤵
PID:576

C:\Windows\SysWOW64\netstat.exe
netstat -nao
4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\SysWOW64\net.exe
net localgroup
4⤵
PID:1652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
5⤵
PID:188

C:\Windows\system32\taskeng.exe
taskeng.exe {D750E743-7746-4DCB-81D2-15B5DAD40227} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lqoos" /d "0"
5⤵
PID:2044

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ppidt" /d "0"
5⤵
PID:932

C:\Windows\SysWOW64\whoami.exe
whoami /all
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /c set
5⤵
PID:1440

C:\Windows\SysWOW64\arp.exe
arp -a
5⤵
PID:108

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
5⤵
- Gathers network information
PID:1180

C:\Windows\SysWOW64\net.exe
net view /all
5⤵
- Discovers systems in the same network
PID:1636

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.WORKGROUP
5⤵
PID:1732

C:\Windows\SysWOW64\net.exe
net share
5⤵
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
6⤵
PID:1104

C:\Windows\SysWOW64\route.exe
route print
5⤵
PID:316

C:\Windows\SysWOW64\netstat.exe
netstat -nao
5⤵
- Gathers network information
PID:1120

C:\Windows\SysWOW64\net.exe
net localgroup
5⤵
PID:860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
6⤵
PID:1692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\system32\taskeng.exe
taskeng.exe {75D1C40D-90F4-4808-8905-20C12F92AB55} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1948

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
2⤵
PID:1612

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll"
3⤵
PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {989BCDDF-2058-4980-B7FC-1A74FC87E69D} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
1⤵
PID:1732

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:1132

C:\Windows\system32\taskeng.exe
taskeng.exe {AD7E1A99-A824-4DF4-BFF8-67B364EE851C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Command-Line Interface

1

T1059

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
MD5
6317f9ae495c49ab7b5e5b501a5639ef

SHA1
2d49c0f32a441d09ddee7c3b2b019ae8904ea1e7

SHA256
ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b

SHA512
bd9c6df8b2d91959580c6227a990882625c029528c0e53a600de8f6cc970e95fbb26108f3ae7f1bc8ef18d2b4b429490ec4ae5f6935e47c6c44dbf06c21be4f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
MD5
1541f27105940bdcd76efa63db34c826

SHA1
0c89b0dc2aa4a0f4202d888360bfb31b149feab0

SHA256
93c1a5ba2016ef2cbd1cd2dfca85aa0ce5d02de6e45471135637ac2da15706c9

SHA512
032ef3914d9427c8a4c7f2513929fbc2f0bdd7f82d4c69b080ae4d10da05e84e06ce2af9fd19d4cbbde18ba2f51f9c098d2e234909cdd3cde86f2976c3091c3f

Download Submit
\Users\Admin\AppData\Local\Temp\ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b.dll
MD5
6317f9ae495c49ab7b5e5b501a5639ef

SHA1
2d49c0f32a441d09ddee7c3b2b019ae8904ea1e7

SHA256
ba7e9131dd5aa9f2e7e0050c688d2830787dd01e8d58aef364a878b61156b35b

SHA512
bd9c6df8b2d91959580c6227a990882625c029528c0e53a600de8f6cc970e95fbb26108f3ae7f1bc8ef18d2b4b429490ec4ae5f6935e47c6c44dbf06c21be4f1

Download Submit
memory/648-63-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/648-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/648-65-0x0000000074A11000-0x0000000074A13000-memory.dmp

Filesize
8KB

Download
memory/696-60-0x00000000001F0000-0x0000000000211000-memory.dmp

Filesize
132KB

Download
memory/696-58-0x00000000001F0000-0x0000000000211000-memory.dmp

Filesize
132KB

Download
memory/696-61-0x0000000000880000-0x00000000008C3000-memory.dmp

Filesize
268KB

Download
memory/696-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download
memory/696-59-0x00000000001F0000-0x0000000000211000-memory.dmp

Filesize
132KB

Download
memory/696-56-0x0000000000950000-0x0000000000AF8000-memory.dmp

Filesize
1.7MB

Download
memory/696-57-0x00000000001F0000-0x0000000000211000-memory.dmp

Filesize
132KB

Download
memory/696-62-0x00000000001F0000-0x0000000000211000-memory.dmp

Filesize
132KB

Download
memory/856-71-0x00000000009C0000-0x0000000000B68000-memory.dmp

Filesize
1.7MB

Download
memory/856-73-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/856-72-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/856-74-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/856-75-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/856-78-0x00000000002F0000-0x0000000000311000-memory.dmp

Filesize
132KB

Download
memory/1072-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1576-67-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads