Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
Contract_#_599848.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Contract_#_599848.xls
Resource
win10v20201028
General
-
Target
Contract_#_599848.xls
-
Size
815KB
-
MD5
82ee594ab9d12d0a00bf399beb7f4e1f
-
SHA1
5b58a1fefd63ca221b0eeca61b9378db25ae0eb1
-
SHA256
05b9806f446c71ca46bbddc10176bf28838430bbecb9545cc730fdb93b205476
-
SHA512
78b80fc1780c51f827ee6f71111b3b037ef0605cbe364b039e7746f6704759f9b1f2c725e7e5869bedf0a11dc9d41d21a9d527f8b2cffcd222818f7ac8651cc5
Malware Config
Extracted
dridex
111
52.73.70.149:443
8.4.9.152:3786
185.246.87.202:3098
50.116.111.64:5353
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
WmIc.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 1312 WmIc.exe -
Processes:
resource yara_rule behavioral1/memory/1680-11-0x000000006B860000-0x000000006B87F000-memory.dmp dridex_ldr -
Blocklisted process makes network request 1 IoCs
Processes:
WmIc.exeflow pid process 6 1548 WmIc.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1680 rundll32.exe 1680 rundll32.exe 1680 rundll32.exe 1680 rundll32.exe -
JavaScript code in executable 5 IoCs
Processes:
resource yara_rule C:\Windows\Temp\o3xs6.dll js \Windows\Temp\o3xs6.dll js \Windows\Temp\o3xs6.dll js \Windows\Temp\o3xs6.dll js \Windows\Temp\o3xs6.dll js -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Modifies registry class 280 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{67A64528-0B1D-46C4-9FAF-265EBCFB60DA}\2.0\FLAGS EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67A64528-0B1D-46C4-9FAF-265EBCFB60DA}\2.0\0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67A64528-0B1D-46C4-9FAF-265EBCFB60DA}\2.0\FLAGS\ = "6" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{67A64528-0B1D-46C4-9FAF-265EBCFB60DA}\2.0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{67A64528-0B1D-46C4-9FAF-265EBCFB60DA}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 776 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
WmIc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1548 WmIc.exe Token: SeSecurityPrivilege 1548 WmIc.exe Token: SeTakeOwnershipPrivilege 1548 WmIc.exe Token: SeLoadDriverPrivilege 1548 WmIc.exe Token: SeSystemProfilePrivilege 1548 WmIc.exe Token: SeSystemtimePrivilege 1548 WmIc.exe Token: SeProfSingleProcessPrivilege 1548 WmIc.exe Token: SeIncBasePriorityPrivilege 1548 WmIc.exe Token: SeCreatePagefilePrivilege 1548 WmIc.exe Token: SeBackupPrivilege 1548 WmIc.exe Token: SeRestorePrivilege 1548 WmIc.exe Token: SeShutdownPrivilege 1548 WmIc.exe Token: SeDebugPrivilege 1548 WmIc.exe Token: SeSystemEnvironmentPrivilege 1548 WmIc.exe Token: SeRemoteShutdownPrivilege 1548 WmIc.exe Token: SeUndockPrivilege 1548 WmIc.exe Token: SeManageVolumePrivilege 1548 WmIc.exe Token: 33 1548 WmIc.exe Token: 34 1548 WmIc.exe Token: 35 1548 WmIc.exe Token: SeIncreaseQuotaPrivilege 1548 WmIc.exe Token: SeSecurityPrivilege 1548 WmIc.exe Token: SeTakeOwnershipPrivilege 1548 WmIc.exe Token: SeLoadDriverPrivilege 1548 WmIc.exe Token: SeSystemProfilePrivilege 1548 WmIc.exe Token: SeSystemtimePrivilege 1548 WmIc.exe Token: SeProfSingleProcessPrivilege 1548 WmIc.exe Token: SeIncBasePriorityPrivilege 1548 WmIc.exe Token: SeCreatePagefilePrivilege 1548 WmIc.exe Token: SeBackupPrivilege 1548 WmIc.exe Token: SeRestorePrivilege 1548 WmIc.exe Token: SeShutdownPrivilege 1548 WmIc.exe Token: SeDebugPrivilege 1548 WmIc.exe Token: SeSystemEnvironmentPrivilege 1548 WmIc.exe Token: SeRemoteShutdownPrivilege 1548 WmIc.exe Token: SeUndockPrivilege 1548 WmIc.exe Token: SeManageVolumePrivilege 1548 WmIc.exe Token: 33 1548 WmIc.exe Token: 34 1548 WmIc.exe Token: 35 1548 WmIc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 776 EXCEL.EXE 776 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WmIc.exerundll32.exedescription pid process target process PID 1548 wrote to memory of 1624 1548 WmIc.exe rundll32.exe PID 1548 wrote to memory of 1624 1548 WmIc.exe rundll32.exe PID 1548 wrote to memory of 1624 1548 WmIc.exe rundll32.exe PID 1624 wrote to memory of 1680 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 1680 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 1680 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 1680 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 1680 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 1680 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 1680 1624 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Contract_#_599848.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmIc.exeWmIc1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//o3xs6.dll InitHelperDll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//o3xs6.dll InitHelperDll3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\2AC17.xSlMD5
6d75f5c52219c05eb60f8d4b0cacfd2f
SHA19b01f494a2f9b0f0e79a1441c3bc52273c900b9e
SHA2560e5c4fe7cde7b846f72886bcc5551c642c098532d18d9d71e6f3913d2df22b14
SHA51295c5bf80f348da62cbd1afc4afc3e3f90ce5c4b76026d47eaed2b90ffa095f149c18d806ab57ef626735bdc7805da91c03c5764579ea707a43b62d9035263636
-
C:\Windows\Temp\o3xs6.dllMD5
56192997620ed4fcddb4c89c8567b9ef
SHA1a2d7021e5e0ad5a1d771e9f4abffbad264154260
SHA25671436caec79992118e125c08518fff2b5f88ad413ce08b1858dcd7ba39e471eb
SHA5121c1ce70b6c5fe6f3b9a2e0fc32950f19136890806da7a7441751eecef3076d1075895fe02cd14bf755036c8da1e5f4fb67b031ae0e9bfc503e96cd76db1a8bc7
-
\Windows\Temp\o3xs6.dllMD5
56192997620ed4fcddb4c89c8567b9ef
SHA1a2d7021e5e0ad5a1d771e9f4abffbad264154260
SHA25671436caec79992118e125c08518fff2b5f88ad413ce08b1858dcd7ba39e471eb
SHA5121c1ce70b6c5fe6f3b9a2e0fc32950f19136890806da7a7441751eecef3076d1075895fe02cd14bf755036c8da1e5f4fb67b031ae0e9bfc503e96cd76db1a8bc7
-
\Windows\Temp\o3xs6.dllMD5
56192997620ed4fcddb4c89c8567b9ef
SHA1a2d7021e5e0ad5a1d771e9f4abffbad264154260
SHA25671436caec79992118e125c08518fff2b5f88ad413ce08b1858dcd7ba39e471eb
SHA5121c1ce70b6c5fe6f3b9a2e0fc32950f19136890806da7a7441751eecef3076d1075895fe02cd14bf755036c8da1e5f4fb67b031ae0e9bfc503e96cd76db1a8bc7
-
\Windows\Temp\o3xs6.dllMD5
56192997620ed4fcddb4c89c8567b9ef
SHA1a2d7021e5e0ad5a1d771e9f4abffbad264154260
SHA25671436caec79992118e125c08518fff2b5f88ad413ce08b1858dcd7ba39e471eb
SHA5121c1ce70b6c5fe6f3b9a2e0fc32950f19136890806da7a7441751eecef3076d1075895fe02cd14bf755036c8da1e5f4fb67b031ae0e9bfc503e96cd76db1a8bc7
-
\Windows\Temp\o3xs6.dllMD5
56192997620ed4fcddb4c89c8567b9ef
SHA1a2d7021e5e0ad5a1d771e9f4abffbad264154260
SHA25671436caec79992118e125c08518fff2b5f88ad413ce08b1858dcd7ba39e471eb
SHA5121c1ce70b6c5fe6f3b9a2e0fc32950f19136890806da7a7441751eecef3076d1075895fe02cd14bf755036c8da1e5f4fb67b031ae0e9bfc503e96cd76db1a8bc7
-
memory/1624-4-0x0000000000000000-mapping.dmp
-
memory/1680-6-0x0000000000000000-mapping.dmp
-
memory/1680-11-0x000000006B860000-0x000000006B87F000-memory.dmpFilesize
124KB
-
memory/1852-3-0x000007FEF72E0000-0x000007FEF755A000-memory.dmpFilesize
2.5MB