Analysis
-
max time kernel
116s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 19:12
Static task
static1
Behavioral task
behavioral1
Sample
Notification_71823.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Notification_71823.xls
Resource
win10v20201028
General
-
Target
Notification_71823.xls
-
Size
724KB
-
MD5
d65ddb3ade34504d44e72ba9db953916
-
SHA1
8bcccc3bce9568919160024dbc3144de359f2d5f
-
SHA256
83386fb9fa084ea2de1f106d155a819b8090f95c28ed7a0f3c9756910bcedc5b
-
SHA512
60d7a503c24c3b324c185f7010642e874271d759ff58fd0dcc7184683d6c1d3a2e322f19d26f04174ac14fe6a96f97f13fcfde16bd74ab72ed29d30ecb0d198d
Malware Config
Extracted
dridex
111
52.73.70.149:443
8.4.9.152:3786
185.246.87.202:3098
50.116.111.64:5353
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
WMic.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1280 1720 WMic.exe -
Processes:
resource yara_rule behavioral1/memory/1404-11-0x000000006BED0000-0x000000006BEEF000-memory.dmp dridex_ldr -
Blocklisted process makes network request 6 IoCs
Processes:
WMic.exeflow pid process 5 1280 WMic.exe 6 1280 WMic.exe 7 1280 WMic.exe 8 1280 WMic.exe 10 1280 WMic.exe 12 1280 WMic.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe -
JavaScript code in executable 5 IoCs
Processes:
resource yara_rule C:\Windows\Temp\iub8i.dll js \Windows\Temp\iub8i.dll js \Windows\Temp\iub8i.dll js \Windows\Temp\iub8i.dll js \Windows\Temp\iub8i.dll js -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE -
Modifies registry class 280 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{C553900D-EE3E-4071-8E5A-6A90D96A9C7C}\2.0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C553900D-EE3E-4071-8E5A-6A90D96A9C7C}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C553900D-EE3E-4071-8E5A-6A90D96A9C7C}\2.0\FLAGS EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{C553900D-EE3E-4071-8E5A-6A90D96A9C7C}\2.0\0 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 844 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
WMic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1280 WMic.exe Token: SeSecurityPrivilege 1280 WMic.exe Token: SeTakeOwnershipPrivilege 1280 WMic.exe Token: SeLoadDriverPrivilege 1280 WMic.exe Token: SeSystemProfilePrivilege 1280 WMic.exe Token: SeSystemtimePrivilege 1280 WMic.exe Token: SeProfSingleProcessPrivilege 1280 WMic.exe Token: SeIncBasePriorityPrivilege 1280 WMic.exe Token: SeCreatePagefilePrivilege 1280 WMic.exe Token: SeBackupPrivilege 1280 WMic.exe Token: SeRestorePrivilege 1280 WMic.exe Token: SeShutdownPrivilege 1280 WMic.exe Token: SeDebugPrivilege 1280 WMic.exe Token: SeSystemEnvironmentPrivilege 1280 WMic.exe Token: SeRemoteShutdownPrivilege 1280 WMic.exe Token: SeUndockPrivilege 1280 WMic.exe Token: SeManageVolumePrivilege 1280 WMic.exe Token: 33 1280 WMic.exe Token: 34 1280 WMic.exe Token: 35 1280 WMic.exe Token: SeIncreaseQuotaPrivilege 1280 WMic.exe Token: SeSecurityPrivilege 1280 WMic.exe Token: SeTakeOwnershipPrivilege 1280 WMic.exe Token: SeLoadDriverPrivilege 1280 WMic.exe Token: SeSystemProfilePrivilege 1280 WMic.exe Token: SeSystemtimePrivilege 1280 WMic.exe Token: SeProfSingleProcessPrivilege 1280 WMic.exe Token: SeIncBasePriorityPrivilege 1280 WMic.exe Token: SeCreatePagefilePrivilege 1280 WMic.exe Token: SeBackupPrivilege 1280 WMic.exe Token: SeRestorePrivilege 1280 WMic.exe Token: SeShutdownPrivilege 1280 WMic.exe Token: SeDebugPrivilege 1280 WMic.exe Token: SeSystemEnvironmentPrivilege 1280 WMic.exe Token: SeRemoteShutdownPrivilege 1280 WMic.exe Token: SeUndockPrivilege 1280 WMic.exe Token: SeManageVolumePrivilege 1280 WMic.exe Token: 33 1280 WMic.exe Token: 34 1280 WMic.exe Token: 35 1280 WMic.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 844 EXCEL.EXE 844 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 844 EXCEL.EXE 844 EXCEL.EXE 844 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WMic.exerundll32.exedescription pid process target process PID 1280 wrote to memory of 1836 1280 WMic.exe rundll32.exe PID 1280 wrote to memory of 1836 1280 WMic.exe rundll32.exe PID 1280 wrote to memory of 1836 1280 WMic.exe rundll32.exe PID 1836 wrote to memory of 1404 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 1404 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 1404 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 1404 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 1404 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 1404 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 1404 1836 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Notification_71823.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WMic.exeWMic1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//iub8i.dll InitHelperDll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//iub8i.dll InitHelperDll3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\27AB3.XsLMD5
b8c3851e4878f935f84bc801ca898175
SHA1e365adfa7081bd212b0a8824157761b68246d34a
SHA2568dff64e9c4529d7c566fa4a707a6789c4a751d32cbb84cd1aadf9a7be163c701
SHA5123e9b5420a07811320e8bcff80b3782f300f563edba5984dc026557f3355299d1aa321f2d56885d70afab116d9531503019dc03b280cf09d34fe1382771223393
-
C:\Windows\Temp\iub8i.dllMD5
9019cc939edb85725bd0cc760698c4bc
SHA1b67b0831e644a04a24723bcd764b2398629fe664
SHA256a9a4e7849e923cf7fd506230edb93fcbc22c5cceff5c85df133b32e2ef5bedb1
SHA512a6fd3aa1ed6664e32232c55753b09524e0b3d4783eaa907b73631eed90ca3b58dafbe9097c2bbae85f865dedd0aa31e2bcf5143756257563f06a08328d570549
-
\Windows\Temp\iub8i.dllMD5
9019cc939edb85725bd0cc760698c4bc
SHA1b67b0831e644a04a24723bcd764b2398629fe664
SHA256a9a4e7849e923cf7fd506230edb93fcbc22c5cceff5c85df133b32e2ef5bedb1
SHA512a6fd3aa1ed6664e32232c55753b09524e0b3d4783eaa907b73631eed90ca3b58dafbe9097c2bbae85f865dedd0aa31e2bcf5143756257563f06a08328d570549
-
\Windows\Temp\iub8i.dllMD5
9019cc939edb85725bd0cc760698c4bc
SHA1b67b0831e644a04a24723bcd764b2398629fe664
SHA256a9a4e7849e923cf7fd506230edb93fcbc22c5cceff5c85df133b32e2ef5bedb1
SHA512a6fd3aa1ed6664e32232c55753b09524e0b3d4783eaa907b73631eed90ca3b58dafbe9097c2bbae85f865dedd0aa31e2bcf5143756257563f06a08328d570549
-
\Windows\Temp\iub8i.dllMD5
9019cc939edb85725bd0cc760698c4bc
SHA1b67b0831e644a04a24723bcd764b2398629fe664
SHA256a9a4e7849e923cf7fd506230edb93fcbc22c5cceff5c85df133b32e2ef5bedb1
SHA512a6fd3aa1ed6664e32232c55753b09524e0b3d4783eaa907b73631eed90ca3b58dafbe9097c2bbae85f865dedd0aa31e2bcf5143756257563f06a08328d570549
-
\Windows\Temp\iub8i.dllMD5
9019cc939edb85725bd0cc760698c4bc
SHA1b67b0831e644a04a24723bcd764b2398629fe664
SHA256a9a4e7849e923cf7fd506230edb93fcbc22c5cceff5c85df133b32e2ef5bedb1
SHA512a6fd3aa1ed6664e32232c55753b09524e0b3d4783eaa907b73631eed90ca3b58dafbe9097c2bbae85f865dedd0aa31e2bcf5143756257563f06a08328d570549
-
memory/528-3-0x000007FEF6790000-0x000007FEF6A0A000-memory.dmpFilesize
2.5MB
-
memory/1404-6-0x0000000000000000-mapping.dmp
-
memory/1404-11-0x000000006BED0000-0x000000006BEEF000-memory.dmpFilesize
124KB
-
memory/1836-4-0x0000000000000000-mapping.dmp