262e75b938cc8b65820cf4015f33ab3db363eb7a968c23bdd48e7a680d97a9f7 | Triage™

Analysis

max time kernel
2s
max time network
123s
platform
windows10_x64
resource
win10
submitted
06/07/2020, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amortisations.bin.dll
Size 13KB
Sample200706-86l6v255ae
SHA256 262e75b938cc8b65820cf4015f33ab3db363eb7a968c23bdd48e7a680d97a9f7
MD5 205d038bf61251562938f7195263605b
SHA1 7f4b31878642e280d47f5a57aef5d7920e73bae1
SHA512 cfbcdd4d164b9b08023313d0918b7b789e6b3ae07e375edfb0dace2388dc1d5988264d98a04eb5acb7716616423591f9337cd31c7c29d0a4d85b13979616e156
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3880	3908	rundll32.exe	67
PID 3908 wrote to memory of 3880	3908	rundll32.exe	67
PID 3908 wrote to memory of 3880	3908	rundll32.exe	67
PID 3908 wrote to memory of 3880	3908	rundll32.exe	67
PID 3908 wrote to memory of 3880	3908	rundll32.exe	67

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\amortisations.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\system32\runonce.exe
  runonce.exe
  2⤵
  PID:3880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads