qakbot | 9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a

General

Target

9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
Size

232KB
MD5

17d871a5ff47e98e7b52769bcf28a7dd
SHA1

579ba71ba0fb5ad8fb99920870f9c2901be841e8
SHA256

9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a
SHA512

55afe0d880144e1b16ca603359dba009a29c2b8befc1eea4d27401f4c91bb8a7aaac982fcd964ba45f866bfbc10b75e04f836e23523136e43d57982d201e5a86

Score

10^/10

qakbot notset 1618398961 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

notset

Campaign

1618398961

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3516 created 1952 3516 WerFault.exe regsvr32.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1952 regsvr32.exe

description	pid	process	target process
PID 3516 created 1952	3516	WerFault.exe	regsvr32.exe

pid	process
1952	regsvr32.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3508 1952 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
3508	1952	WerFault.exe	regsvr32.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeMusNotifyIcon.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3144 schtasks.exe

pid	process
3144	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 55 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4048"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.685887"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4304"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4108"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.255989"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132895022563198220"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4248"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

3860 regsvr32.exe
3860 regsvr32.exe
3508 WerFault.exe
3508 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3860 regsvr32.exe

pid	process
3860	regsvr32.exe
3860	regsvr32.exe
3508	WerFault.exe
3508	WerFault.exe

pid	process
3860	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe

description	pid	process
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe
Token: SeRestorePrivilege	1968	TiWorker.exe
Token: SeSecurityPrivilege	1968	TiWorker.exe
Token: SeBackupPrivilege	1968	TiWorker.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeWerFault.exe

description	pid	process	target process
PID 2364 wrote to memory of 3860	2364	regsvr32.exe	regsvr32.exe
PID 2364 wrote to memory of 3860	2364	regsvr32.exe	regsvr32.exe
PID 2364 wrote to memory of 3860	2364	regsvr32.exe	regsvr32.exe
PID 3860 wrote to memory of 2884	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2884	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2884	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2884	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2884	3860	regsvr32.exe	explorer.exe
PID 2884 wrote to memory of 3144	2884	explorer.exe	schtasks.exe
PID 2884 wrote to memory of 3144	2884	explorer.exe	schtasks.exe
PID 2884 wrote to memory of 3144	2884	explorer.exe	schtasks.exe
PID 752 wrote to memory of 1952	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1952	752	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 1952	752	regsvr32.exe	regsvr32.exe
PID 3516 wrote to memory of 1952	3516	WerFault.exe	regsvr32.exe
PID 3516 wrote to memory of 1952	3516	WerFault.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qqhtbztn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll\"" /SC ONCE /Z /ST 16:26 /ET 16:38
4⤵
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2448

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll"
2⤵
- Loads dropped DLL
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 584
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1952 -ip 1952
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
MD5
33cca7a6122a6f2c932037f39ca59b43

SHA1
e26b0e6030a2f985644969ed901c36ff8416cf1b

SHA256
c17a708cfa05595c15ec1a99b8da76c6aeb854766ffd6a96756a1b7372320d8a

SHA512
ff89d1c9ab3581c118ca9859048cc2939b313e13f0fec8dd7f220a77a2e621e5d152ce62c62ad838115770a8a5e44adf56f0a251aeb562401457d621771f27d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9e55e4173e82fd800097eeff77fcbb81ab6a41d9081a5ab81ff20539ca942b5a.dll
MD5
33cca7a6122a6f2c932037f39ca59b43

SHA1
e26b0e6030a2f985644969ed901c36ff8416cf1b

SHA256
c17a708cfa05595c15ec1a99b8da76c6aeb854766ffd6a96756a1b7372320d8a

SHA512
ff89d1c9ab3581c118ca9859048cc2939b313e13f0fec8dd7f220a77a2e621e5d152ce62c62ad838115770a8a5e44adf56f0a251aeb562401457d621771f27d9

Download Submit
memory/2884-132-0x00000000007A3000-0x00000000007A4000-memory.dmp

Filesize
4KB

Download
memory/2884-133-0x0000000002F80000-0x0000000002FBA000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads