f925664a36fcddaf5c9d04ab3dab7f282eff2b6698279af6772bc41af6ca640a | Triage™

Analysis

max time kernel
145s
max time network
148s
platform
windows10_x64
resource
win10
submitted
21/07/2020, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Graftor.770268.28639.20848.dll
Size 224KB
Sample200721-bla9aj4mts
SHA256 f925664a36fcddaf5c9d04ab3dab7f282eff2b6698279af6772bc41af6ca640a
MD5 4ac1ca95f5010cb1ffe33c1f2fc435d3
SHA1 544c5e11e902acbd4fa1c35d6585397ab330aca5
SHA512 ecfd2b2d37e4d25cd6fc2ea7c0e4c9e9d06ded4c05ab475b2736c1bffb1ae247dec2163f9ef3950ef2937cdc13bd2a4faba826dfcd56d942b5d890c332d33ba9
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3828	4012	rundll32.exe	67
PID 4012 wrote to memory of 3828	4012	rundll32.exe	67
PID 4012 wrote to memory of 3828	4012	rundll32.exe	67

Blacklisted process makes network request 14 IoCs

flow	pid	Process
14	3828	rundll32.exe
15	3828	rundll32.exe
17	3828	rundll32.exe
19	3828	rundll32.exe
21	3828	rundll32.exe
25	3828	rundll32.exe
27	3828	rundll32.exe
29	3828	rundll32.exe
31	3828	rundll32.exe
33	3828	rundll32.exe
36	3828	rundll32.exe
38	3828	rundll32.exe
41	3828	rundll32.exe
43	3828	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.770268.28639.20848.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.770268.28639.20848.dll,#1
  2⤵
  - Blacklisted process makes network request
  PID:3828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads