Analysis
-
max time kernel
73s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 07:08
Static task
static1
Behavioral task
behavioral1
Sample
Fax 740.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Fax 740.xls
Resource
win10v20201028
General
-
Target
Fax 740.xls
-
Size
886KB
-
MD5
d7213d92bb25a6163ab3b79ba75f95a0
-
SHA1
9e7d2f00b517a32d2f69ac0c41e48d09507abf5b
-
SHA256
2f34e34033c25325694ee6e100e8b2c0deff78d0527acd72ebc598048ba74fe5
-
SHA512
c57e459822b1463ed646824f74371ec518d09a710f41bc1022657794ec65a1eea2d404267543c076cd5e740d1e79238ddf43a3ed63463d7f7bf22e76de34d0a5
Malware Config
Extracted
dridex
111
52.73.70.149:443
8.4.9.152:3786
185.246.87.202:3098
50.116.111.64:5353
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wmic.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1408 1800 wmic.exe -
Processes:
resource yara_rule behavioral1/memory/696-11-0x000000006C1F0000-0x000000006C20F000-memory.dmp dridex_ldr -
Blocklisted process makes network request 5 IoCs
Processes:
wmic.exeflow pid process 6 1408 wmic.exe 7 1408 wmic.exe 8 1408 wmic.exe 9 1408 wmic.exe 11 1408 wmic.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 696 rundll32.exe 696 rundll32.exe 696 rundll32.exe 696 rundll32.exe -
JavaScript code in executable 5 IoCs
Processes:
resource yara_rule C:\Windows\Temp\h41o7.dll js \Windows\Temp\h41o7.dll js \Windows\Temp\h41o7.dll js \Windows\Temp\h41o7.dll js \Windows\Temp\h41o7.dll js -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Modifies registry class 280 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{D759640C-D0D5-4677-9D39-B108F762E743}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D759640C-D0D5-4677-9D39-B108F762E743}\2.0\0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{D759640C-D0D5-4677-9D39-B108F762E743}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D759640C-D0D5-4677-9D39-B108F762E743}\2.0\FLAGS\ = "6" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D759640C-D0D5-4677-9D39-B108F762E743}\2.0\HELPDIR EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 836 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
wmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1408 wmic.exe Token: SeSecurityPrivilege 1408 wmic.exe Token: SeTakeOwnershipPrivilege 1408 wmic.exe Token: SeLoadDriverPrivilege 1408 wmic.exe Token: SeSystemProfilePrivilege 1408 wmic.exe Token: SeSystemtimePrivilege 1408 wmic.exe Token: SeProfSingleProcessPrivilege 1408 wmic.exe Token: SeIncBasePriorityPrivilege 1408 wmic.exe Token: SeCreatePagefilePrivilege 1408 wmic.exe Token: SeBackupPrivilege 1408 wmic.exe Token: SeRestorePrivilege 1408 wmic.exe Token: SeShutdownPrivilege 1408 wmic.exe Token: SeDebugPrivilege 1408 wmic.exe Token: SeSystemEnvironmentPrivilege 1408 wmic.exe Token: SeRemoteShutdownPrivilege 1408 wmic.exe Token: SeUndockPrivilege 1408 wmic.exe Token: SeManageVolumePrivilege 1408 wmic.exe Token: 33 1408 wmic.exe Token: 34 1408 wmic.exe Token: 35 1408 wmic.exe Token: SeIncreaseQuotaPrivilege 1408 wmic.exe Token: SeSecurityPrivilege 1408 wmic.exe Token: SeTakeOwnershipPrivilege 1408 wmic.exe Token: SeLoadDriverPrivilege 1408 wmic.exe Token: SeSystemProfilePrivilege 1408 wmic.exe Token: SeSystemtimePrivilege 1408 wmic.exe Token: SeProfSingleProcessPrivilege 1408 wmic.exe Token: SeIncBasePriorityPrivilege 1408 wmic.exe Token: SeCreatePagefilePrivilege 1408 wmic.exe Token: SeBackupPrivilege 1408 wmic.exe Token: SeRestorePrivilege 1408 wmic.exe Token: SeShutdownPrivilege 1408 wmic.exe Token: SeDebugPrivilege 1408 wmic.exe Token: SeSystemEnvironmentPrivilege 1408 wmic.exe Token: SeRemoteShutdownPrivilege 1408 wmic.exe Token: SeUndockPrivilege 1408 wmic.exe Token: SeManageVolumePrivilege 1408 wmic.exe Token: 33 1408 wmic.exe Token: 34 1408 wmic.exe Token: 35 1408 wmic.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 836 EXCEL.EXE 836 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 836 EXCEL.EXE 836 EXCEL.EXE 836 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
wmic.exerundll32.exedescription pid process target process PID 1408 wrote to memory of 484 1408 wmic.exe rundll32.exe PID 1408 wrote to memory of 484 1408 wmic.exe rundll32.exe PID 1408 wrote to memory of 484 1408 wmic.exe rundll32.exe PID 484 wrote to memory of 696 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 696 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 696 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 696 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 696 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 696 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 696 484 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Fax 740.xls"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\wmic.exewmic1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//h41o7.dll InitHelperDll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//h41o7.dll InitHelperDll3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\40F27.XslMD5
23b1812062536497ba39b4ad1619938f
SHA190a64893e96db8c1e52eaeadf255a7c3bb20b7c3
SHA2562b6f7c8c785878922532dbfa3f23d9b1e195ff51057f56819f5ed6bd377e950d
SHA512b389ad3ad9c4ed2f9c6c3cb20f8cfd5c9c5c50b35402a21d2526517800658abf7bc81beef772338486b532812eeeafe0e99d97acb90a3593201ad625b9628139
-
C:\Windows\Temp\h41o7.dllMD5
9416a042a30b1b5b29ac31a00a280c08
SHA1fcece453d47e8678a6fae77f3947c863e8f6eab6
SHA256e00d88aa22fa89f7468bfddc5faf7f86d9c8c10d1f3b842a5be859afbcf40502
SHA512f424662e71b3e4ab10b7a1f40b47b9f984aaaa24e2e0fdf7f213e15edc64680ee4913e1de7831ff342e78de193d35f0aef927942abb9083b3f58c400d9cc18ea
-
\Windows\Temp\h41o7.dllMD5
9416a042a30b1b5b29ac31a00a280c08
SHA1fcece453d47e8678a6fae77f3947c863e8f6eab6
SHA256e00d88aa22fa89f7468bfddc5faf7f86d9c8c10d1f3b842a5be859afbcf40502
SHA512f424662e71b3e4ab10b7a1f40b47b9f984aaaa24e2e0fdf7f213e15edc64680ee4913e1de7831ff342e78de193d35f0aef927942abb9083b3f58c400d9cc18ea
-
\Windows\Temp\h41o7.dllMD5
9416a042a30b1b5b29ac31a00a280c08
SHA1fcece453d47e8678a6fae77f3947c863e8f6eab6
SHA256e00d88aa22fa89f7468bfddc5faf7f86d9c8c10d1f3b842a5be859afbcf40502
SHA512f424662e71b3e4ab10b7a1f40b47b9f984aaaa24e2e0fdf7f213e15edc64680ee4913e1de7831ff342e78de193d35f0aef927942abb9083b3f58c400d9cc18ea
-
\Windows\Temp\h41o7.dllMD5
9416a042a30b1b5b29ac31a00a280c08
SHA1fcece453d47e8678a6fae77f3947c863e8f6eab6
SHA256e00d88aa22fa89f7468bfddc5faf7f86d9c8c10d1f3b842a5be859afbcf40502
SHA512f424662e71b3e4ab10b7a1f40b47b9f984aaaa24e2e0fdf7f213e15edc64680ee4913e1de7831ff342e78de193d35f0aef927942abb9083b3f58c400d9cc18ea
-
\Windows\Temp\h41o7.dllMD5
9416a042a30b1b5b29ac31a00a280c08
SHA1fcece453d47e8678a6fae77f3947c863e8f6eab6
SHA256e00d88aa22fa89f7468bfddc5faf7f86d9c8c10d1f3b842a5be859afbcf40502
SHA512f424662e71b3e4ab10b7a1f40b47b9f984aaaa24e2e0fdf7f213e15edc64680ee4913e1de7831ff342e78de193d35f0aef927942abb9083b3f58c400d9cc18ea
-
memory/484-4-0x0000000000000000-mapping.dmp
-
memory/696-6-0x0000000000000000-mapping.dmp
-
memory/696-11-0x000000006C1F0000-0x000000006C20F000-memory.dmpFilesize
124KB
-
memory/2036-3-0x000007FEF69C0000-0x000007FEF6C3A000-memory.dmpFilesize
2.5MB