qakbot | ffa93d9fbfdc46b9ffcad627b918ad86a3bbced0796e09e627f8c8b619875643

General

Target

SCANS_EE5164.html
Size

1.5MB
MD5

6d9354a5ce7ae0a22599f56309eea47f
SHA1

f7bf653fe03810ddc89fe9842acf6e459ff28950
SHA256

ffa93d9fbfdc46b9ffcad627b918ad86a3bbced0796e09e627f8c8b619875643
SHA512

5d1ed95cb64d4156eff0edd2186b3fac1fcae52f4be7ff1b21fc5227e5f5bd7753cb3a5d7424144b9cef606597ee198f7a544003e276fb3a7b295dec54b3b20b
SSDEEP

24576:5cEyMGTCmlO13OxIZGrntxnDrB3GdSNn9IkCTdZQO3sferBmT:eB8eDnt5p19IksHQVfeG

Score

10^/10

qakbot azd 1670585125 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

azd

Campaign

1670585125

C2

172.90.139.138:2222

90.116.219.167:2222

173.239.94.212:443

91.169.12.198:32100

74.66.134.24:443

66.191.69.18:995

182.75.189.42:995

78.69.251.252:2222

98.145.23.67:443

103.71.21.107:443

197.94.219.133:443

91.68.227.219:443

12.172.173.82:993

86.176.83.127:2222

64.121.161.102:443

41.98.21.114:443

92.154.17.149:2222

151.65.67.211:443

89.129.109.27:2222

76.11.14.249:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

File opened (read-only) \??\E: cmd.exe

description	ioc	process
File opened (read-only)	\??\E:	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exerundll32.exewermgr.exe

pid	process
4800	chrome.exe
4800	chrome.exe
3448	chrome.exe
3448	chrome.exe
4596	chrome.exe
4596	chrome.exe
944	chrome.exe
944	chrome.exe
3516	chrome.exe
3516	chrome.exe
3256	chrome.exe
3256	chrome.exe
3992	chrome.exe
3992	chrome.exe
3216	chrome.exe
3216	chrome.exe
3864	chrome.exe
3864	chrome.exe
536	rundll32.exe
536	rundll32.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe
4392	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

536 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

3448 chrome.exe
3448 chrome.exe
3448 chrome.exe
3448 chrome.exe

pid	process
536	rundll32.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3448 wrote to memory of 968	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 968	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4264	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4800	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4800	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe
PID 3448 wrote to memory of 4420	3448	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Users\Admin\AppData\Local\Temp\SCANS_EE5164.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99e1d4f50,0x7ff99e1d4f60,0x7ff99e1d4f70
2⤵
PID:968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1664 /prefetch:2
2⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8
2⤵
PID:4420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
2⤵
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
2⤵
PID:2268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
2⤵
PID:2816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3392 /prefetch:8
2⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:8
2⤵
PID:4736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:8
2⤵
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5516 /prefetch:8
2⤵
PID:976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
2⤵
PID:1876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5600 /prefetch:8
2⤵
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
2⤵
PID:2504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1564 /prefetch:8
2⤵
PID:2784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3784 /prefetch:8
2⤵
PID:1580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3824 /prefetch:8
2⤵
PID:4564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2540 /prefetch:2
2⤵
PID:3556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,1270309650173879414,13991991443117004825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
2⤵
PID:2784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c Pays\PayInfo.cmd A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9
1⤵
- Enumerates connected drives
PID:4012

C:\Windows\system32\rundll32.exe
rundll32 /s newinvoice.new,DrawThemeIcon
2⤵
PID:3992

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s newinvoice.new,DrawThemeIcon
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:536

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

Peripheral Device Discovery

2

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\pipe\crashpad_3448_SICCPXYXPKCCCOUK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/536-134-0x0000000000000000-mapping.dmp

Download
memory/536-135-0x00000000027A0000-0x00000000028CF000-memory.dmp

Filesize
1.2MB

Download
memory/536-136-0x0000000004340000-0x000000000436A000-memory.dmp

Filesize
168KB

Download
memory/536-137-0x00000000042B0000-0x0000000004307000-memory.dmp

Filesize
348KB

Download
memory/536-138-0x0000000004340000-0x000000000436A000-memory.dmp

Filesize
168KB

Download
memory/536-141-0x0000000004340000-0x000000000436A000-memory.dmp

Filesize
168KB

Download
memory/3992-133-0x0000000000000000-mapping.dmp

Download
memory/4392-139-0x0000000000000000-mapping.dmp

Download
memory/4392-140-0x0000000000530000-0x000000000055A000-memory.dmp

Filesize
168KB

Download
memory/4392-142-0x0000000000530000-0x000000000055A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads