bumblebee | 71a31230604bf678a60842f7625912b27270972f1e9b0e76ea21848ee50be9d4

Analysis

max time kernel
1192s
max time network
1024s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
10-11-2022 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

newfile43.xlsm
Size

56KB
MD5

042d1ae5cc4063907200d18f59e4410e
SHA1

2244f8d0d336801b2280cec5c47c08c5119d8be1
SHA256

71a31230604bf678a60842f7625912b27270972f1e9b0e76ea21848ee50be9d4
SHA512

e7a3fb9c73e02e0f0e59b212b33eb15adf0ef8447be9498f9ccafc4eaccd41a28e68070c2d7317ed3d5c8c5b1933eeb51446dff4818166752f845f95e33370ed
SSDEEP

768:m9x2KUlxWpt1J3S5f3v4Jfa3ODVs3KnooaRHIuZVvZbV1sNl1A6u4:eHUlxWLC5/wJi3eVsdtLVvT1US4

Score

10^/10

bumblebee 0411r trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0411r

172.86.121.123:443

176.223.165.125:443

45.66.248.216:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2196	4964	rundll32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3744	4572	rundll32.exe	81

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2196	rundll32.exe
3744	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2196	rundll32.exe
3744	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	explorer.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3284	2196	WerFault.exe	73
3672	3744	WerFault.exe	83

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000002155a8841100557365727300640009000400efbe724a0b5d2155a8842e000000320500000000010000000000000000003a00000000000a5f390055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000006a55433110004c6f63616c003c0009000400efbe2155a8846a5543312e000000ba520100000001000000000000000000000000000000211155004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000002155a88412004170704461746100400009000400efbe2155a8842155a8842e000000a752010000000100000000000000000000000000000071221f004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000006a555031100054656d7000003a0009000400efbe2155a8846a5550312e000000bb52010000000100000000000000000000000000000034a81201540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000002155818b100041646d696e003c0009000400efbe2155a8842155818b2e0000009c520100000001000000000000000000000000000000d3688000410064006d0069006e00000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4964	EXCEL.EXE
2676	explorer.exe
4572	EXCEL.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4964	EXCEL.EXE
4964	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
2676	explorer.exe
2676	explorer.exe
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE
4572	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2196	4964	EXCEL.EXE	73
PID 4964 wrote to memory of 2196	4964	EXCEL.EXE	73
PID 880 wrote to memory of 2500	880	cmd.exe	76
PID 880 wrote to memory of 2500	880	cmd.exe	76
PID 2676 wrote to memory of 4572	2676	explorer.exe	81
PID 2676 wrote to memory of 4572	2676	explorer.exe	81
PID 2676 wrote to memory of 4572	2676	explorer.exe	81
PID 4572 wrote to memory of 3744	4572	EXCEL.EXE	83
PID 4572 wrote to memory of 3744	4572	EXCEL.EXE	83

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\newfile43.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 name.dll,SendData
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:2196
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2196 -s 412
    3⤵
    - Program crash
    PID:3284

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\explorer.exe
  explorer .
  2⤵
  PID:2500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\newfile43.xlsm"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32 name.dll,SendData
    3⤵
    - Process spawned unexpected child process
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    PID:3744
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3744 -s 444
      4⤵
      Program crash
      PID:3672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
471B

MD5
78ccc60f907d5c4e58237cbfd0a720d6

SHA1
90a9b99056e0409cd8b75481b8030a7f6aa7f3dd

SHA256
24b3ab216852ebaead9e8f533d4a3280627d2488fe11061c3aab5c1c00cab3a6

SHA512
c1c7c1c5fc20b938c5e24aabbd62cc418f3e52c00c8de061298a1d17b363ec75339061d64a4f6a1010c6d23e4990668dc7b379d961001882b965c057fcd7497e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
446B

MD5
85d24117ec252150c1809d6cd2a64aaa

SHA1
acd21fd46c4f5023e028c94f48305324db46df90

SHA256
2f3e1d7d12b37b2ae6a89b57a9c2a25cfabb8917b7de7f6ff8884ad932c08d7f

SHA512
e87d9c0aa0c9c72ed4a2a38bd38e26febe263b2c4760067a948f8f19849695539a0335ad6232ba6c91e8ef50295efff5a985b6166e70effb343b118a1f310ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C91FB4B0-3C20-42AF-BAB5-4D18A794D41B

Filesize
147KB

MD5
e7dac6fdcd482265c266a676a507514f

SHA1
e2397c89a20be5cbda810bc947f64bd3c6ce7e33

SHA256
8ac0e56fb250446071bb2ebb909775fcb1922db630123dbf8a624dc6e7fbda90

SHA512
7245ad43f021fd5358d03b636095efa0e173e8c75b7b4dfe66a36a126b97b64f52f193fc73672c5c8c3ecffb6026d2bf466415c1bd3ba84fe5b2f81879e31f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
325KB

MD5
bfa32c04fd31cd32c76f52178c5376c4

SHA1
32a4a914310512387a447595f14c07756b774e38

SHA256
18769c1a198e6c5041cb27da25380a6e9f3309919d20dc45cccd3d8735b85a4d

SHA512
fc109d8c3ab1df7ba8215a0f418d9e6d83672779b9c7a0ac7e211b170572a3e07738b3cd7a74f964e0caaf34fa9ef9ee9769d67ec8a217dc435c8d63ebd02655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml

Filesize
76B

MD5
0f8eb2423d2bf6cb5b8bdb44cb170ca3

SHA1
242755226012b4449a49b45491c0b1538ebf6410

SHA256
385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944

SHA512
a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Filesize
24KB

MD5
a6064fc9ce640751e063d9af443990da

SHA1
367a3a7d57bfb3e9a6ec356dfc411a5f14dfde2a

SHA256
5f72c11fd2fa88d8b8bfae1214551f8d5ee07b8895df824fa717ebbcec118a6c

SHA512
0e42dd8e341e2334eda1e19e1a344475ed3a0539a21c70ba2247f480c706ab8e2ff6dbeb790614cbde9fb547699b24e69c85c54e99ed77a08fe7e1d1b4b488d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\70W02UF3\0411r_cr4[1].dll

Filesize
994KB

MD5
7f7efa4a8f013bffaefd5bbd24ada276

SHA1
27363f6673a5271644ace7f13decbcfc59546430

SHA256
bad4186ff9b35e5561efa8aae7a32dbde145c3b9e120ce86a522a7610f1c4e59

SHA512
6e2c58e2114cd87af1b6abcac3b04722933f6246fdbf12bf16012b6388e2d964751785e646653ddc82002e7043ce20457d550115079af8095e3508621fffcad0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
C:\Users\Admin\Documents\name.dll

Filesize
994KB

MD5
7f7efa4a8f013bffaefd5bbd24ada276

SHA1
27363f6673a5271644ace7f13decbcfc59546430

SHA256
bad4186ff9b35e5561efa8aae7a32dbde145c3b9e120ce86a522a7610f1c4e59

SHA512
6e2c58e2114cd87af1b6abcac3b04722933f6246fdbf12bf16012b6388e2d964751785e646653ddc82002e7043ce20457d550115079af8095e3508621fffcad0

Download Submit
C:\Users\Admin\Documents\name.dll

Filesize
994KB

MD5
7f7efa4a8f013bffaefd5bbd24ada276

SHA1
27363f6673a5271644ace7f13decbcfc59546430

SHA256
bad4186ff9b35e5561efa8aae7a32dbde145c3b9e120ce86a522a7610f1c4e59

SHA512
6e2c58e2114cd87af1b6abcac3b04722933f6246fdbf12bf16012b6388e2d964751785e646653ddc82002e7043ce20457d550115079af8095e3508621fffcad0

Download Submit
\Users\Admin\Documents\name.dll

Filesize
994KB

MD5
7f7efa4a8f013bffaefd5bbd24ada276

SHA1
27363f6673a5271644ace7f13decbcfc59546430

SHA256
bad4186ff9b35e5561efa8aae7a32dbde145c3b9e120ce86a522a7610f1c4e59

SHA512
6e2c58e2114cd87af1b6abcac3b04722933f6246fdbf12bf16012b6388e2d964751785e646653ddc82002e7043ce20457d550115079af8095e3508621fffcad0

Download Submit
\Users\Admin\Documents\name.dll

Filesize
994KB

MD5
7f7efa4a8f013bffaefd5bbd24ada276

SHA1
27363f6673a5271644ace7f13decbcfc59546430

SHA256
bad4186ff9b35e5561efa8aae7a32dbde145c3b9e120ce86a522a7610f1c4e59

SHA512
6e2c58e2114cd87af1b6abcac3b04722933f6246fdbf12bf16012b6388e2d964751785e646653ddc82002e7043ce20457d550115079af8095e3508621fffcad0

Download Submit
memory/2196-275-0x000001623F4E0000-0x000001623F629000-memory.dmp

Filesize
1.3MB

Download
memory/2196-276-0x000001623F2E0000-0x000001623F356000-memory.dmp

Filesize
472KB

Download
memory/3744-494-0x0000023592210000-0x0000023592286000-memory.dmp

Filesize
472KB

Download
memory/3744-492-0x00000235924D0000-0x0000023592619000-memory.dmp

Filesize
1.3MB

Download
memory/3744-491-0x0000023592210000-0x0000023592286000-memory.dmp

Filesize
472KB

Download
memory/4572-305-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4572-303-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4572-311-0x00007FFBEB590000-0x00007FFBEB5A0000-memory.dmp

Filesize
64KB

Download
memory/4572-309-0x00007FFBEB590000-0x00007FFBEB5A0000-memory.dmp

Filesize
64KB

Download
memory/4572-306-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4572-304-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-299-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-120-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-133-0x00007FFBEB590000-0x00007FFBEB5A0000-memory.dmp

Filesize
64KB

Download
memory/4964-132-0x00007FFBEB590000-0x00007FFBEB5A0000-memory.dmp

Filesize
64KB

Download
memory/4964-123-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-122-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-297-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-298-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-121-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download
memory/4964-300-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads