Malware Analysis Report

2024-11-30 13:29

Sample ID 241122-lznpraylft
Target ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.exe
SHA256 ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6
Tags
qakbot tr 1634541613 banker discovery evasion stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6

Threat Level: Known bad

The file ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.exe was found to be: Known bad.

Malicious Activity Summary

qakbot tr 1634541613 banker discovery evasion stealer trojan

Qakbot family

Windows security bypass

Qakbot/Qbot

Loads dropped DLL

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Modifies data under HKEY_USERS

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-22 09:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-22 09:58

Reported

2024-11-22 10:00

Platform

win7-20241023-en

Max time kernel

105s

Max time network

16s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll,#1

Signatures

Qakbot family

qakbot

Qakbot/Qbot

trojan banker stealer qakbot

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\system32\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Gfxtnpysnylx = "0" C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\system32\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Xpkxnnwi = "0" C:\Windows\system32\reg.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\bd9589cc = 033f1af5e768c9d1c6c85bce828a53b03878f57ca49ac17d29d4adec62c1080f2b78e89f36097ec34900a71697fd C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\8a4b79fe = 7dae046eb267de16e191c57a109b67206dd1f32467080b05fbaf817835807f153b9498a89554801236a88fa0b8ea8f286babdbe7318035637aa02de49e6d375bf5863dd35fe25553c0604802e1bff576b1bfc50b C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\30b63ee7 = 1682f3e71ef13f4aec8893017d5f98 C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\c2dce63a = f518abf09583725c90f7d47d7ffb7e2764fba778e001e42bff9bd838935b2d641724b0b5e573b11a04d31184b7687aa219a32dee12b7df737d91b4703baa4c790f73bcc193 C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\bd9589cc = 033f0df5e768fc148f3a81ce0ac6f9e33b6348db46430ad7e9666b16602548f1ac94f899077828431c82c89daabd14c6753dab183a06b4fcaae86acc47797dec88e833 C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Utskfylh C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\880a5982 = c3640642c7871c9073cf6ee98b8dd38af67c82658bafe1b6576acf8a7ae37b946b5914d7cc72fdc88d569663c424945c3848fb2a8df8971518a8878b8908c8c1488d49905fb83c95e788f76a2bfdd694a8f983ac9d2acfcf7eb4b3eaf3d22ff0d61ca37d954b7af10ea0288f40b5152d4d29ecd5 C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\32f71e9b = a0ee5f37416e8e7531e5a3dcad21d3e500ffe18c05c11889f61198d0df2e660cbf130969255d7cc5dff7762ea38fa008a1361b6f8e54e59ea4038e0e18741ab9e2719bcb3ef6b3edebae6f290924686bd0eb3402908321b68880fdb93f709734bb3d987e2ee092e1736f C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\4fff5111 = 17fa99c3f2bf9267674c983dee3e62c3bb3f122c3c0bf98a4b94c7fd75ee037e2ed0dc6cde74cac6c2b849b5d51e2f2fbe9b3f7393dfc02794379288fa0b7801f79264828a1ef92d6329b66b22a30df42f C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Utskfylh\f7433674 = ea12c582630d851043fd31a06d063a6da0bb8170c057cd888c762c7c46c72cb0454a9b44 C:\Windows\SysWOW64\explorer.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2084 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2084 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2084 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2084 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2084 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2084 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2644 wrote to memory of 2516 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 2644 wrote to memory of 2516 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 2644 wrote to memory of 2516 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 2644 wrote to memory of 2516 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 2644 wrote to memory of 2516 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 2644 wrote to memory of 2516 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 2516 wrote to memory of 2304 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 2516 wrote to memory of 2304 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 2516 wrote to memory of 2304 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 2516 wrote to memory of 2304 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 2952 wrote to memory of 1816 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\regsvr32.exe
PID 2952 wrote to memory of 1816 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\regsvr32.exe
PID 2952 wrote to memory of 1816 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\regsvr32.exe
PID 2952 wrote to memory of 1816 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\regsvr32.exe
PID 2952 wrote to memory of 1816 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\regsvr32.exe
PID 1816 wrote to memory of 2152 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1816 wrote to memory of 2152 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1816 wrote to memory of 2152 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1816 wrote to memory of 2152 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1816 wrote to memory of 2152 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1816 wrote to memory of 2152 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1816 wrote to memory of 2152 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2152 wrote to memory of 2172 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 2152 wrote to memory of 2172 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 2152 wrote to memory of 2172 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 2152 wrote to memory of 2172 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 2152 wrote to memory of 2172 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 2152 wrote to memory of 2172 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 2172 wrote to memory of 2944 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 2944 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 2944 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 2944 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 2364 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 2364 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 2364 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 2172 wrote to memory of 2364 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll,#1

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qvlfjqkzwg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll\"" /SC ONCE /Z /ST 10:00 /ET 10:12

C:\Windows\system32\taskeng.exe

taskeng.exe {9BCA5A4F-365B-4188-B185-ACD2CBF55478} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\system32\regsvr32.exe

regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll"

C:\Windows\SysWOW64\regsvr32.exe

-s "C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Gfxtnpysnylx" /d "0"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xpkxnnwi" /d "0"

Network

N/A

Files

memory/2644-1-0x0000000074E60000-0x000000007500B000-memory.dmp

memory/2644-4-0x0000000074E60000-0x000000007500B000-memory.dmp

memory/2644-3-0x0000000074FF0000-0x0000000074FF6000-memory.dmp

memory/2644-0-0x0000000074E60000-0x000000007500B000-memory.dmp

memory/2516-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

memory/2516-6-0x0000000000080000-0x00000000000A1000-memory.dmp

memory/2644-7-0x0000000074E60000-0x000000007500B000-memory.dmp

memory/2516-10-0x0000000000080000-0x00000000000A1000-memory.dmp

memory/2516-11-0x0000000000080000-0x00000000000A1000-memory.dmp

memory/2516-12-0x0000000000080000-0x00000000000A1000-memory.dmp

memory/2516-13-0x0000000000080000-0x00000000000A1000-memory.dmp

memory/2516-14-0x0000000000080000-0x00000000000A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll

MD5 1a08c65ed3d2e8d3f85cd07b1c7d645d
SHA1 ef75bb2f2db20c678f9b4b2c8af75a7f645368c1
SHA256 ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6
SHA512 06894f16a7a2691c6ef78c1c352441cdabbf791778bdb55a50e524a066374cffc2f55c02d0d4ce44aab5c673c8e4e3811d0c9794aa6e47e3e59c7b6e0fa0db63

memory/2152-20-0x00000000745B0000-0x000000007475B000-memory.dmp

memory/2152-19-0x00000000745B0000-0x000000007475B000-memory.dmp

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2152-24-0x00000000745B0000-0x000000007475B000-memory.dmp

memory/2172-26-0x0000000000080000-0x00000000000A1000-memory.dmp

memory/2172-28-0x0000000000080000-0x00000000000A1000-memory.dmp

memory/2172-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-22 09:58

Reported

2024-11-22 10:00

Platform

win10v2004-20241007-en

Max time kernel

105s

Max time network

94s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll,#1

Signatures

Qakbot family

qakbot

Qakbot/Qbot

trojan banker stealer qakbot

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Aelzk = "0" C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\system32\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ufbrmyfrbxsy = "0" C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\system32\reg.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\b3caa9df = 053fea781c23480eaa528003e0cabf8382412797a12b71d93e187579ad1607ebaf7b4f880f1597e02e34220bc5cceb8ce9f97ec08f C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\743fa14c = 633104a3dbb88041ede8c7cfa7857ebf68 C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\f91c1667 = 38edf353bb926ed18fa3f8cdb9aca241ba573bd7111483c4eb27ab780fafafa4bb2b5e08cd617f77f2038563b417c3090f20950829bdb8834773b609344ab26169afccf47661c5fe43f695d8c24056156f5292e8f83ac209c491b17a C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\f91c1667 = 38ede453bb925b08e36a2361491b7d012afe5aa96cbe584f27994214cdd48e2a4b11f64ff471e0180c22f39c3f9567ed73802fc6e4b2e26628dd9d1689a42a1fb3dfc74891ab5e C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\cc83c629 = 0b385aa72486c9bd3fb660b3f74f8fd48075aca0fbef72ba405d74df6744250c05ee2f57b4dd2c2a29b58d4228dbc25a5769bd580131a3fae5e91ea0b6329a233d2ec2ac8339e3c29cc58683fe4eeffe49bcc3a906137e850d2e74422578f6374280bc0da00ceb659d81cf951ce4d0eaf3bf1c468ea0133eb68b1422e305b4398e895efbb1f50ceecde40fd740192e695a0ebdf8fc847464ca3bd1a3f5a035c8836f59e80835cf98aed2645f65cb5423f3fd0b24e7b4defae4bcf03e37088f81b9f5b5ae1e3bc05f C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\cec2e655 = d7d940b759cb0694bd25dac2cd6a9ed9322962f848792271bd15ca163de28f5ef759d1dda819c5e0d27436b51376b3f59be5a21bf436512149f134babca7aba331d45d52460d332bbfa6eb6055b9a672b2e5a689d6225b69cb2f70556cdd19 C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\767e8130 = 45013649aa1dbe55355c97c996865c2b C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\b76ceba = 14dc8bf783dd19505827b2584108b52b551a98ee094df2cdf0ce6682dde18be2b0c2444af21716e8326c8734c775ca1055d8849db8546983e5d2c699f4972d6b291965bf4a3674785c793495929287149f3d2f C:\Windows\SysWOW64\explorer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gldrcrvhoyyeuy\86557991 = 7bba56ac3cb64787fa8821bbe47f4aa171852e3cef1281e2216e9e5bc358fb758cda6285c708b5a53200e150c62d79b266 C:\Windows\SysWOW64\explorer.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 964 wrote to memory of 4872 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 964 wrote to memory of 4872 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 964 wrote to memory of 4872 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4872 wrote to memory of 3800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 4872 wrote to memory of 3800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 4872 wrote to memory of 3800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 4872 wrote to memory of 3800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 4872 wrote to memory of 3800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\explorer.exe
PID 3800 wrote to memory of 1220 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 3800 wrote to memory of 1220 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 3800 wrote to memory of 1220 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\schtasks.exe
PID 4820 wrote to memory of 4892 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4820 wrote to memory of 4892 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4820 wrote to memory of 4892 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4892 wrote to memory of 3064 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 4892 wrote to memory of 3064 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 4892 wrote to memory of 3064 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 4892 wrote to memory of 3064 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 4892 wrote to memory of 3064 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\explorer.exe
PID 3064 wrote to memory of 2100 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2100 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2120 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe
PID 3064 wrote to memory of 2120 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\system32\reg.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll,#1

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vxbhjyps /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll\"" /SC ONCE /Z /ST 10:00 /ET 10:12

C:\Windows\system32\regsvr32.exe

regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll"

C:\Windows\SysWOW64\regsvr32.exe

-s "C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ufbrmyfrbxsy" /d "0"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aelzk" /d "0"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.206.16.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/4872-1-0x00000000752B0000-0x00000000752B6000-memory.dmp

memory/4872-0-0x0000000075120000-0x00000000752CB000-memory.dmp

memory/4872-2-0x0000000075120000-0x00000000752CB000-memory.dmp

memory/4872-3-0x0000000075120000-0x00000000752CB000-memory.dmp

memory/3800-5-0x0000000000200000-0x0000000000221000-memory.dmp

memory/4872-6-0x0000000075120000-0x00000000752CB000-memory.dmp

memory/3800-9-0x0000000000200000-0x0000000000221000-memory.dmp

memory/3800-11-0x0000000000200000-0x0000000000221000-memory.dmp

memory/3800-10-0x0000000000200000-0x0000000000221000-memory.dmp

memory/3800-13-0x0000000000200000-0x0000000000221000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6.dll

MD5 1a08c65ed3d2e8d3f85cd07b1c7d645d
SHA1 ef75bb2f2db20c678f9b4b2c8af75a7f645368c1
SHA256 ba6275b5a96e023334f2e5e3a02b1afea4543071eb867bbc170782926f7ed6c6
SHA512 06894f16a7a2691c6ef78c1c352441cdabbf791778bdb55a50e524a066374cffc2f55c02d0d4ce44aab5c673c8e4e3811d0c9794aa6e47e3e59c7b6e0fa0db63

memory/4892-17-0x0000000073980000-0x0000000073B2B000-memory.dmp

memory/4892-18-0x0000000073980000-0x0000000073B2B000-memory.dmp

memory/4892-20-0x0000000073980000-0x0000000073B2B000-memory.dmp

memory/3064-22-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

memory/3064-23-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

memory/3064-25-0x0000000000AC0000-0x0000000000AE1000-memory.dmp