Analysis
- max time kernel
146s - max time network
147s - platform
windows10_x64 - resource
win10v200430 - submitted
07/07/2020, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
9TE15.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 9TE15.dll
- Size 433KB
- Sample200707-7wp2rrn6l2
- SHA256 f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb
- MD5 89fbc889caf9e9015b1ee438d1e2f907
- SHA1 71fac1254ea1757a88f76a589a575b5e7ba011e9
- SHA512 3ae5e9896dc732f4fe28bb6dc2fc2410702dd4e80cd72cfda6111bd7b2e6ae9ff3447c9024f15af7a640e538af0eb5aed1733421f1c5cd9aabd640325cfb8af6
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3576 created 2992 3576 rundll32.exe 56 - Blacklisted process makes network request 37 IoCs
flow pid Process 7 2188 msiexec.exe 8 2188 msiexec.exe 9 2188 msiexec.exe 10 2188 msiexec.exe 11 2188 msiexec.exe 12 2188 msiexec.exe 17 2188 msiexec.exe 18 2188 msiexec.exe 19 2188 msiexec.exe 20 2188 msiexec.exe 21 2188 msiexec.exe 22 2188 msiexec.exe 24 2188 msiexec.exe 25 2188 msiexec.exe 26 2188 msiexec.exe 27 2188 msiexec.exe 28 2188 msiexec.exe 29 2188 msiexec.exe 31 2188 msiexec.exe 33 2188 msiexec.exe 35 2188 msiexec.exe 37 2188 msiexec.exe 39 2188 msiexec.exe 40 2188 msiexec.exe 41 2188 msiexec.exe 42 2188 msiexec.exe 43 2188 msiexec.exe 44 2188 msiexec.exe 45 2188 msiexec.exe 46 2188 msiexec.exe 47 2188 msiexec.exe 48 2188 msiexec.exe 49 2188 msiexec.exe 51 2188 msiexec.exe 52 2188 msiexec.exe 53 2188 msiexec.exe 54 2188 msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3576 set thread context of 2188 3576 rundll32.exe 73 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3576 rundll32.exe 3576 rundll32.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3576 rundll32.exe Token: SeSecurityPrivilege 2188 msiexec.exe Token: SeSecurityPrivilege 2188 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1008 wrote to memory of 3576 1008 rundll32.exe 66 PID 1008 wrote to memory of 3576 1008 rundll32.exe 66 PID 1008 wrote to memory of 3576 1008 rundll32.exe 66 PID 3576 wrote to memory of 2188 3576 rundll32.exe 73 PID 3576 wrote to memory of 2188 3576 rundll32.exe 73 PID 3576 wrote to memory of 2188 3576 rundll32.exe 73 PID 3576 wrote to memory of 2188 3576 rundll32.exe 73 PID 3576 wrote to memory of 2188 3576 rundll32.exe 73
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2992
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9TE15.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9TE15.dll,#13⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
-
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:2188
-