qakbot | 35b11704a872d0c20717c4d9fd89d1b92fc9f6dae87e3695e248b0aba96d9d32

General

Target

7533.dll
Size

663KB
MD5

31779d2bf4f5db7efb378fd1db702052
SHA1

e654de30b56447a8a680d2fbb5f4a0b9fd3d7d4a
SHA256

35b11704a872d0c20717c4d9fd89d1b92fc9f6dae87e3695e248b0aba96d9d32
SHA512

e2bf4b229c23596459d586534670f12e4e1c39a0521e186af691e8c69e96121fb605597d090e983d0e0d0a2b39d054afe644ba89b91ea6a1e29456907c09f44d

Score

10^/10

qakbot obama201 1657815129 banker stealer suricata trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama201

Campaign

1657815129

C2

70.46.220.114:443

179.111.8.52:32101

208.107.221.224:443

176.45.218.138:995

24.158.23.166:995

24.54.48.11:443

89.101.97.139:443

24.55.67.176:443

24.139.72.117:443

120.150.218.241:995

174.69.215.101:443

38.70.253.226:2222

41.228.22.180:443

217.165.157.202:995

172.115.177.204:2222

173.21.10.71:2222

69.14.172.24:443

47.23.89.60:993

104.34.212.7:32103

66.230.104.103:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
suricata: ET MALWARE Win32/Qbot CnC Activity M2
suricata: ET MALWARE Win32/Qbot CnC Activity M2
suricata
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

432 regsvr32.exe

pid	process
432	regsvr32.exe

Drops file in System32 directory 7 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2016 schtasks.exe
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

1768 net.exe

pid	process
2016	schtasks.exe

pid	process
1768	net.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-d6-71-f5-31-47\WpadDecisionReason = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\b8854726 = 48b64e97ed8a8d7ee9f7e38069d5fa7326b720a482cb78e1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7330385F-AA3F-4A8D-8D62-1302EF61930B}\e2-d6-71-f5-31-47	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b0abecb44e98d801	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7330385F-AA3F-4A8D-8D62-1302EF61930B}	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7330385F-AA3F-4A8D-8D62-1302EF61930B}\WpadDecision = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7330385F-AA3F-4A8D-8D62-1302EF61930B}\WpadNetworkName = "Network 2"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\7d316fc9 = 75b790800f398439941692c0ca9877d369e6da923916a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\4aef9ffb = d132924cc862220e5a7efd86dc3886bdba628b002e61fc6cfa58e1fde8ccfcf27db020e4a3d726b3e3d9e0f123f869e236795f265a29eeca1dd8eb5e0d87a038a0bf3e085c1c73c0637eb2b3e3a4ccd2e40158b2ad9f58daa3aeec19fff06eb5e67df6cef07b59f92f3be3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7330385F-AA3F-4A8D-8D62-1302EF61930B}\WpadDecisionReason = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\35a6f00d = 7e1eee83f5b6291cc7b99e93b16f0e207be5909afdab11a7	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\c58d08ac = 642a00fab056adec398e6620c247fab099e57c2f0c3e4bdf0d02086ac260e2e9857b7afdb07d1406fa0b77ef36db9f9d547c31d5a859b859dfcc6a0648f6f299300bc4f0d0f9f80380f8efe76472960d34366480ced4c356ffbeedd0d227b1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\c7cc28d0 = 59ab44f6181887c6c87b347814568a9af9d359eb32b2175e01ae5acb9146b5861eef3561d5cc6524ca7f69c77d8ecb2dbf9089ab08a0137d6e5a5d561da53775798f30c180fc20	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\4aef9ffb = d132924cc862220e5a7efd86dc3886bdba628b002e61fc6cf45ee7fde8ccfcf27db020e4a3d726b3e3d9e0f123f869e236795f265a29eeca1dd8eb5e0d87a038a0bf3e085c1c73c0637eb2b3e3a4ccd2e40158b2ad9f58daa3aeec19fff06eb5e67df6cef07b59f92f3be3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-d6-71-f5-31-47	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-d6-71-f5-31-47\WpadDecisionTime = 503229ba4f98d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Varqiyvignoi\4aef9ffb = d1329b4cc862220e5a7efcccda348cb5b3628c06656afe6ff251e7cba01e509fd962707426a49a628abd0fda93692fbe4ed7d972fc8999c3cd1dc074f4e7ecac809ad11ab6809cda0de9e0588456862c2dccbc8b3ada550fb434e408f403b6de1744d4404dbdef47c93b13683277b6b5fb3a34fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7330385F-AA3F-4A8D-8D62-1302EF61930B}\WpadDecisionTime = 503229ba4f98d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	explorer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exepowershell.exe

pid	process
1632	rundll32.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
876	powershell.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe
1804	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1632 rundll32.exe
432 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 876 powershell.exe

description	pid	process
Token: SeDebugPrivilege	876	powershell.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1836 wrote to memory of 1632	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1632	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1632	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1632	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1632	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1632	1836	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1632	1836	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1804	1632	rundll32.exe	explorer.exe
PID 1632 wrote to memory of 1804	1632	rundll32.exe	explorer.exe
PID 1632 wrote to memory of 1804	1632	rundll32.exe	explorer.exe
PID 1632 wrote to memory of 1804	1632	rundll32.exe	explorer.exe
PID 1632 wrote to memory of 1804	1632	rundll32.exe	explorer.exe
PID 1632 wrote to memory of 1804	1632	rundll32.exe	explorer.exe
PID 1804 wrote to memory of 2016	1804	explorer.exe	schtasks.exe
PID 1804 wrote to memory of 2016	1804	explorer.exe	schtasks.exe
PID 1804 wrote to memory of 2016	1804	explorer.exe	schtasks.exe
PID 1804 wrote to memory of 2016	1804	explorer.exe	schtasks.exe
PID 1312 wrote to memory of 876	1312	taskeng.exe	powershell.exe
PID 1312 wrote to memory of 876	1312	taskeng.exe	powershell.exe
PID 1312 wrote to memory of 876	1312	taskeng.exe	powershell.exe
PID 876 wrote to memory of 588	876	powershell.exe	regsvr32.exe
PID 876 wrote to memory of 588	876	powershell.exe	regsvr32.exe
PID 876 wrote to memory of 588	876	powershell.exe	regsvr32.exe
PID 876 wrote to memory of 588	876	powershell.exe	regsvr32.exe
PID 876 wrote to memory of 588	876	powershell.exe	regsvr32.exe
PID 588 wrote to memory of 432	588	regsvr32.exe	regsvr32.exe
PID 588 wrote to memory of 432	588	regsvr32.exe	regsvr32.exe
PID 588 wrote to memory of 432	588	regsvr32.exe	regsvr32.exe
PID 588 wrote to memory of 432	588	regsvr32.exe	regsvr32.exe
PID 588 wrote to memory of 432	588	regsvr32.exe	regsvr32.exe
PID 588 wrote to memory of 432	588	regsvr32.exe	regsvr32.exe
PID 588 wrote to memory of 432	588	regsvr32.exe	regsvr32.exe
PID 432 wrote to memory of 1496	432	regsvr32.exe	explorer.exe
PID 432 wrote to memory of 1496	432	regsvr32.exe	explorer.exe
PID 432 wrote to memory of 1496	432	regsvr32.exe	explorer.exe
PID 432 wrote to memory of 1496	432	regsvr32.exe	explorer.exe
PID 432 wrote to memory of 1496	432	regsvr32.exe	explorer.exe
PID 432 wrote to memory of 1496	432	regsvr32.exe	explorer.exe
PID 1496 wrote to memory of 1768	1496	explorer.exe	net.exe
PID 1496 wrote to memory of 1768	1496	explorer.exe	net.exe
PID 1496 wrote to memory of 1768	1496	explorer.exe	net.exe
PID 1496 wrote to memory of 1768	1496	explorer.exe	net.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7533.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7533.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 13:28 /tn odbadqyan /ET 13:39 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANwA1ADMAMwAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\taskeng.exe
taskeng.exe {3EEED010-FC3C-49C3-AC4A-5FE053833D40} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANwA1ADMAMwAuAGQAbABsACIA
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\7533.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\7533.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\net.exe
net view
6⤵
- Discovers systems in the same network
PID:1768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7533.dll
Filesize
663KB

MD5
31779d2bf4f5db7efb378fd1db702052

SHA1
e654de30b56447a8a680d2fbb5f4a0b9fd3d7d4a

SHA256
35b11704a872d0c20717c4d9fd89d1b92fc9f6dae87e3695e248b0aba96d9d32

SHA512
e2bf4b229c23596459d586534670f12e4e1c39a0521e186af691e8c69e96121fb605597d090e983d0e0d0a2b39d054afe644ba89b91ea6a1e29456907c09f44d

Download Submit
\Users\Admin\AppData\Local\Temp\7533.dll
Filesize
663KB

MD5
31779d2bf4f5db7efb378fd1db702052

SHA1
e654de30b56447a8a680d2fbb5f4a0b9fd3d7d4a

SHA256
35b11704a872d0c20717c4d9fd89d1b92fc9f6dae87e3695e248b0aba96d9d32

SHA512
e2bf4b229c23596459d586534670f12e4e1c39a0521e186af691e8c69e96121fb605597d090e983d0e0d0a2b39d054afe644ba89b91ea6a1e29456907c09f44d

Download Submit
memory/432-92-0x0000000000390000-0x00000000003B2000-memory.dmp

Filesize
136KB

Download
memory/432-88-0x0000000000390000-0x00000000003B2000-memory.dmp

Filesize
136KB

Download
memory/432-87-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/432-85-0x0000000000390000-0x00000000003B2000-memory.dmp

Filesize
136KB

Download
memory/432-86-0x0000000000390000-0x00000000003B2000-memory.dmp

Filesize
136KB

Download
memory/432-84-0x0000000000390000-0x00000000003B2000-memory.dmp

Filesize
136KB

Download
memory/432-83-0x0000000000A70000-0x0000000000B1C000-memory.dmp

Filesize
688KB

Download
memory/432-80-0x0000000000000000-mapping.dmp

Download
memory/588-75-0x0000000000000000-mapping.dmp

Download
memory/876-72-0x000007FEF3220000-0x000007FEF3D7D000-memory.dmp

Filesize
11.4MB

Download
memory/876-78-0x00000000010EB000-0x000000000110A000-memory.dmp

Filesize
124KB

Download
memory/876-69-0x0000000000000000-mapping.dmp

Download
memory/876-70-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download
memory/876-71-0x000007FEF3D80000-0x000007FEF47A3000-memory.dmp

Filesize
10.1MB

Download
memory/876-73-0x00000000010E4000-0x00000000010E7000-memory.dmp

Filesize
12KB

Download
memory/876-74-0x00000000010EB000-0x000000000110A000-memory.dmp

Filesize
124KB

Download
memory/876-77-0x00000000010E4000-0x00000000010E7000-memory.dmp

Filesize
12KB

Download
memory/1496-94-0x0000000000310000-0x0000000000332000-memory.dmp

Filesize
136KB

Download
memory/1496-93-0x0000000000310000-0x0000000000332000-memory.dmp

Filesize
136KB

Download
memory/1496-89-0x0000000000000000-mapping.dmp

Download
memory/1632-57-0x0000000000810000-0x0000000000832000-memory.dmp

Filesize
136KB

Download
memory/1632-58-0x0000000000810000-0x0000000000832000-memory.dmp

Filesize
136KB

Download
memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1632-61-0x0000000000810000-0x0000000000832000-memory.dmp

Filesize
136KB

Download
memory/1632-60-0x00000000007A0000-0x00000000007C9000-memory.dmp

Filesize
164KB

Download
memory/1632-59-0x0000000000810000-0x0000000000832000-memory.dmp

Filesize
136KB

Download
memory/1632-65-0x0000000000810000-0x0000000000832000-memory.dmp

Filesize
136KB

Download
memory/1632-56-0x00000000006A0000-0x000000000074C000-memory.dmp

Filesize
688KB

Download
memory/1768-95-0x0000000000000000-mapping.dmp

Download
memory/1804-66-0x0000000000350000-0x0000000000372000-memory.dmp

Filesize
136KB

Download
memory/1804-62-0x0000000000000000-mapping.dmp

Download
memory/1804-64-0x00000000742E1000-0x00000000742E3000-memory.dmp

Filesize
8KB

Download
memory/1804-68-0x0000000000350000-0x0000000000372000-memory.dmp

Filesize
136KB

Download
memory/2016-67-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads