qakbot | 93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-02-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f.msi
Size

1.9MB
MD5

82b8bd90e500fb0bf878d6f430c5abec
SHA1

f004c09428f2f18a145212a9e55eef3615858f9c
SHA256

93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f
SHA512

82b2e997bf5bc0d08ab8dd921aef3e8d620a61c26f86b6f481845ad694d7b97f65dfa42e1c18b83f0f827cad9df69a409b75d96793e5bd7124c26bc7cb07f881
SSDEEP

49152:Ksjitd+vszAlozTy4g5r8+5eNBABxGNvXreD68f:rihTyfcXreO8f

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Detect Qakbot Payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2600-309-0x00000000002C0000-0x00000000002EF000-memory.dmp	family_qakbot_v5
behavioral1/memory/2600-313-0x0000000180000000-0x000000018002E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2600-314-0x0000000000290000-0x00000000002BD000-memory.dmp	family_qakbot_v5
behavioral1/memory/2600-315-0x0000000180000000-0x000000018002E000-memory.dmp	family_qakbot_v5
behavioral1/memory/1504-317-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/1504-324-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2600-338-0x0000000180000000-0x000000018002E000-memory.dmp	family_qakbot_v5
behavioral1/memory/1504-339-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/1504-340-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/1504-342-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/1504-345-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/1504-346-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

3 2408 msiexec.exe
5 2408 msiexec.exe
7 1980 msiexec.exe

flow	pid	process
3	2408	msiexec.exe
5	2408	msiexec.exe
7	1980	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI983A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f769167.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f769167.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B39.tmp	msiexec.exe
File created	C:\Windows\Installer\f769168.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f769168.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0B6.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSIA0B6.tmp

pid process

2172 MSIA0B6.tmp

pid	process
2172	MSIA0B6.tmp

Loads dropped DLL 11 IoCs

Processes:

MsiExec.exeMsiExec.exerundll32.exe

pid	process
2192	MsiExec.exe
2192	MsiExec.exe
2192	MsiExec.exe
2192	MsiExec.exe
2192	MsiExec.exe
2912	MsiExec.exe
2912	MsiExec.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 12 IoCs

Processes:

wermgr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\b48437db = 04dbf4b6db16ea286cc4a60348aac52559ddec9c894142c8755ecf8e2977a30f4efbdd9265aec65c2a82711bf57763d78766a164385595d6fe1c5b0a843c09580c383a0f3b82465f109d7e86b7bfa8c4dc30593f9d9c25387f71f6e7dc206186dd7bc9ec3906f2e172e4a72210803160d244a87299f2ecd51a0b3c559b6ce6340c3e1224fb97bd694e4caacfa4b868fe8350f7008d4dee82b9b60cffec61fc0f987ecb0b41f5352d7c27145a5827b12abfca61ff00878d0691cbb206047e299374feca5064d3b153eee35eafa821eee24b	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\aa4c7177 = 47a2cf180f9320381fe5d9714fa55686928cca75c29dd91a1bfe3b694af04ccdfb55da4076ce6174da4905e4b03327ee5a428978c7a34f167b27f079e02a67bd4798575e98333e7167d5246b00a8de5db6	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\ddb514c2 = 24900ac395fd57d8f8b91f704f8fbb8774ae34b049d9f468735b9b85f042502b99d56d1f355dd20c9cfbdb7af3efcf4314083142c25af94808fc169493b9d93e17cbab33650d79c98ac01f2cd350ee390196dd19eb0718cd67331b62609816d037bebad938595be83b740d71d66c1b2774	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\782e3745 = 253d4c663514bf94b7ced15a472fa8abd7092ac5c6f02f6b02802a05150a44c604cf1db8379300ae91dd4e6b639901853f112055f7d9885787dba190e12f6f6fcd7a2321054096d0e310f4bfc18d7ab937f8ce98a0f5b69123219c96eecbd3a73b	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\b5036a5c = 64833541943a98404b3b2bb915285934f0d8106a0ee4b717c94c619fd90de7b4dcebd8f4b37f40e9997b014d47eb3b85ddb6956c6c9611d8f260e28f59275311ac0508c1a07015fecb0f69ce909da9c3aa1d2fbbaaa2dad10f48f02898a6b94b69266d69935a5105feded64060c4057bf2c1ae945ae5ae66b21f55b46bae234f993e0cfb09fbc397d9578a6ccf15ef2c37	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\e32b2294 = c73a7ab76a069d751459fa937e75a8597f9083c564023893a0e11e6d86bf6ce84a282bf9d203c316c97a082a349b59c39a0cc88b64b14f4a142b0b1997863f940a1ba436267689e7bdbae1b0370f30ac5332de7e435d84bd7df6eb57199b017fb34f03b306cba73e535715a9ce200c1dd0f3a2df5ad589fc196c47d99b4ea5fd441362cd955e1ca53fa42419ec99598bb1	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\e2ac7f13 = 8531d68e795cdc2d2dbd2f8d3540ee38caf0f00a37d672d58b3c91f195b4eddc4a86c2857794b6cf1a067ed4eebe6c01e0509281f5b4e1819495777cecbf31f8aa649c52ebd882baf14d5fb58cab3c304ce350fa08227018a79d386f912a48019d	wermgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\e2ac7f13 = a6536a44d702d472f27d3b12101c2002de1d21b37cc488b9642851d6e2d9ab141601163c43779fd96608b11cd5badcd55e1b27c03b8565ad3673c688dd507ba17f08c4cb346bfe95f0628911dec468abe2	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\66e671e9 = c6d64202958f532673113af1b419b1fe46da43e07e51c54274cd6558d8449ded977fed951a6f95fc43496d5a167c0452d7d29c0e0f1fe80ee58941ee05b5d13143696acded148dfb547181dc9d278851dbf80f791b879e01f4852f385a059a8157fda4bc7d3ab0139c1f2ff2cdd47c9dbf629532ab8c8f8faef0381c31e23b93ae	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\72eb3e5c = 4653b503640e6d565acaedb883a8e9953171da58c6e6ddafad77a66cb27d3b40db62b0c877c662b7461a5ba24eb7353f609fbaeb69c0c8cf7808487be2d533805fbd0a11129aa5cb25f6b9b3ef6909fd3e532604e250cc83c5577a392b943063d3940c272406b1c16b7bfcf329eca097eb	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\zjnukejuajyi\79a96ac2 = c6b2d30a7613fe86146b75ad34afdeedc6f06da1640134a1effedadf44b69b2fb4ae76ceb8df5e4c968a9f4ca1793ee1925f5ae0c6746c90f37577720b3616039105b3d229bd7803b26032b88a0b49149b2b8364b2327b6ab0b9ac74d83eb1cf92a331bef3d69acbe35f36d81f13056415	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeMSIA0B6.tmprundll32.exewermgr.exe

pid	process
1980	msiexec.exe
1980	msiexec.exe
2172	MSIA0B6.tmp
2600	rundll32.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	1980	msiexec.exe
Token: SeTakeOwnershipPrivilege	1980	msiexec.exe
Token: SeSecurityPrivilege	1980	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2408	msiexec.exe
Token: SeLockMemoryPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeMachineAccountPrivilege	2408	msiexec.exe
Token: SeTcbPrivilege	2408	msiexec.exe
Token: SeSecurityPrivilege	2408	msiexec.exe
Token: SeTakeOwnershipPrivilege	2408	msiexec.exe
Token: SeLoadDriverPrivilege	2408	msiexec.exe
Token: SeSystemProfilePrivilege	2408	msiexec.exe
Token: SeSystemtimePrivilege	2408	msiexec.exe
Token: SeProfSingleProcessPrivilege	2408	msiexec.exe
Token: SeIncBasePriorityPrivilege	2408	msiexec.exe
Token: SeCreatePagefilePrivilege	2408	msiexec.exe
Token: SeCreatePermanentPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2408	msiexec.exe
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeDebugPrivilege	2408	msiexec.exe
Token: SeAuditPrivilege	2408	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2408	msiexec.exe
Token: SeChangeNotifyPrivilege	2408	msiexec.exe
Token: SeRemoteShutdownPrivilege	2408	msiexec.exe
Token: SeUndockPrivilege	2408	msiexec.exe
Token: SeSyncAgentPrivilege	2408	msiexec.exe
Token: SeEnableDelegationPrivilege	2408	msiexec.exe
Token: SeManageVolumePrivilege	2408	msiexec.exe
Token: SeImpersonatePrivilege	2408	msiexec.exe
Token: SeCreateGlobalPrivilege	2408	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2408	msiexec.exe
Token: SeLockMemoryPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeMachineAccountPrivilege	2408	msiexec.exe
Token: SeTcbPrivilege	2408	msiexec.exe
Token: SeSecurityPrivilege	2408	msiexec.exe
Token: SeTakeOwnershipPrivilege	2408	msiexec.exe
Token: SeLoadDriverPrivilege	2408	msiexec.exe
Token: SeSystemProfilePrivilege	2408	msiexec.exe
Token: SeSystemtimePrivilege	2408	msiexec.exe
Token: SeProfSingleProcessPrivilege	2408	msiexec.exe
Token: SeIncBasePriorityPrivilege	2408	msiexec.exe
Token: SeCreatePagefilePrivilege	2408	msiexec.exe
Token: SeCreatePermanentPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2408	msiexec.exe
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeDebugPrivilege	2408	msiexec.exe
Token: SeAuditPrivilege	2408	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2408	msiexec.exe
Token: SeChangeNotifyPrivilege	2408	msiexec.exe
Token: SeRemoteShutdownPrivilege	2408	msiexec.exe
Token: SeUndockPrivilege	2408	msiexec.exe
Token: SeSyncAgentPrivilege	2408	msiexec.exe
Token: SeEnableDelegationPrivilege	2408	msiexec.exe
Token: SeManageVolumePrivilege	2408	msiexec.exe
Token: SeImpersonatePrivilege	2408	msiexec.exe
Token: SeCreateGlobalPrivilege	2408	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2408 msiexec.exe
2408 msiexec.exe

pid	process
2408	msiexec.exe
2408	msiexec.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

msiexec.exerundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 2192	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2192	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2192	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2192	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2192	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2192	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2192	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2912	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2912	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2912	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2912	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2912	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2912	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2912	1980	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 2172	1980	msiexec.exe	MSIA0B6.tmp
PID 1980 wrote to memory of 2172	1980	msiexec.exe	MSIA0B6.tmp
PID 1980 wrote to memory of 2172	1980	msiexec.exe	MSIA0B6.tmp
PID 1980 wrote to memory of 2172	1980	msiexec.exe	MSIA0B6.tmp
PID 1980 wrote to memory of 2172	1980	msiexec.exe	MSIA0B6.tmp
PID 1980 wrote to memory of 2172	1980	msiexec.exe	MSIA0B6.tmp
PID 1980 wrote to memory of 2172	1980	msiexec.exe	MSIA0B6.tmp
PID 2600 wrote to memory of 1504	2600	rundll32.exe	wermgr.exe
PID 2600 wrote to memory of 1504	2600	rundll32.exe	wermgr.exe
PID 2600 wrote to memory of 1504	2600	rundll32.exe	wermgr.exe
PID 2600 wrote to memory of 1504	2600	rundll32.exe	wermgr.exe
PID 2600 wrote to memory of 1504	2600	rundll32.exe	wermgr.exe
PID 2600 wrote to memory of 1504	2600	rundll32.exe	wermgr.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2408

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DBC95F271871F15424A843AA766EE274 C
2⤵
- Loads dropped DLL
PID:2192

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 918F8520D027E9A8AD153156F51951FD
2⤵
- Loads dropped DLL
PID:2912

C:\Windows\Installer\MSIA0B6.tmp
"C:\Windows\Installer\MSIA0B6.tmp" /HideWindow rundll32 C:\Users\Admin\AppData\Roaming\KROST.dll,hvsi
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2568

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003FC" "00000000000005AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1352

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\KROST.dll,hvsi
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\System32\wermgr.exe
C:\Windows\System32\wermgr.exe
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f769169.rbs
Filesize
1KB

MD5
e081e70472d4a28e883ead9b33a88d1f

SHA1
28ebc93be9ced3b53ec1b690c5827fc38d1608a2

SHA256
1d13a80f2ed0cf5b6d244a729f02d4cef8a816b3c595a20d499b5297af10f708

SHA512
8921a4618e25b806da1ad165eddd2612da581e153a7d19855487eddc13cd2799a994ee0ff37881df0f9cf1359161c8710a120b454906dce9a35336a2c0d6356f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8555326CC9661C9937DC5053B6C38763
Filesize
1KB

MD5
866912c070f1ecacacc2d5bca55ba129

SHA1
b7ab3308d1ea4477ba1480125a6fbda936490cbb

SHA256
85666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69

SHA512
f91e855e0346ac8c3379129154e01488bb22cff7f6a6df2a80f1671e43c5df8acae36fdf5ee0eb2320f287a681a326b6f1df36e8e37aa5597c4797dd6b43b7cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8555326CC9661C9937DC5053B6C38763
Filesize
326B

MD5
71a221d8e6e872d018e5c7ad1a364c80

SHA1
98458d075cd60765ea5d3251e2fa1f1149496863

SHA256
23c9a9fbcb05ed8b5e13bdb5eb0483a198330a521ebdace0918311271162e3be

SHA512
7de131434f674974d23d9d3951691e32627fbd2766b1e1702670468925cd466a38fa279b3856840d5a62b5029d34413389de8c1b6f9a9f184c766c79f727b8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
de5371ec5630cb6fb76a440956c191b0

SHA1
4d34b1a725873aaa55b7515a5971355ce307e37c

SHA256
67d6c2be19d5c9d00972bf0834e95c283684e16a13688059579a203648081de4

SHA512
0bcf847b2de78379155ca673b16fe1a1d8cc9280a71d36d4d8f51d607e02faa1df7b6ca0f4317e01bba3378c20fc6ba93d53c44d56ae594b43a98bf0d4216116

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3027.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI38B9.tmp
Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3049.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\KROST.dll
Filesize
459KB

MD5
0a29918110937641bbe4a2d5ee5e4272

SHA1
7d4a6976c1ece81e01d1f16ac5506266d5210734

SHA256
780be7a70ce3567ef268f6c768fc5a3d2510310c603bf481ebffd65e4fe95ff3

SHA512
998a6ee2fa6b345aeea72afaa91add8433e986a2678dbb8995ead786c30bdc00704c39c4857935b20669005b292736d50e1c6ad38901aa1f29db7b6a597fae3f

Download Submit
C:\Windows\Installer\MSIA0B6.tmp
Filesize
397KB

MD5
b41e1b0ae2ec215c568c395b0dbb738a

SHA1
90d8e50176a1f4436604468279f29a128723c64b

SHA256
a97e782c5612c1a9c8a56c56a943f6190fa7a73c346566860b519ef02efd0dca

SHA512
828d00ea08aa5c5d28b2e513687ee1ff910670f49f938064682e56da05544ba9d73ba9244f77b5df8acaeeb7b756d62f67e5acbc95bae86b4706f6324c4ccaba

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1504-324-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1504-339-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1504-346-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1504-345-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1504-342-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1504-316-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/1504-317-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/1504-340-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2172-301-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2600-315-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download
memory/2600-338-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download
memory/2600-307-0x0000000069140000-0x00000000691BE000-memory.dmp

Filesize
504KB

Download
memory/2600-309-0x00000000002C0000-0x00000000002EF000-memory.dmp

Filesize
188KB

Download
memory/2600-314-0x0000000000290000-0x00000000002BD000-memory.dmp

Filesize
180KB

Download
memory/2600-313-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download