8131a4efe8cd0df08b0dc44a83079aa0dd7cf88c39c85f5caa13b43a950f9a9b | Triage™

Analysis

max time kernel
69s
max time network
69s
platform
windows10_x64
resource
win10v200722
submitted
30/07/2020, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
liut9.cab.dll
Size 224KB
Sample200730-dmhbyby5e2
SHA256 8131a4efe8cd0df08b0dc44a83079aa0dd7cf88c39c85f5caa13b43a950f9a9b
MD5 1cbb6664b6b7ef50cf279f372c60a00e
SHA1 7f546c64bfc62dca6fdb2fecf916c2a0b930297d
SHA512 749e13d54df19c95d93e763dd85e34e611bb59255717840102c59332cb3768ac5d1d8718130a6ed33cbdc1ac3686de64dada88de9a1af1af11d62cb247315f20
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 420	2736	rundll32.exe	67
PID 2736 wrote to memory of 420	2736	rundll32.exe	67
PID 2736 wrote to memory of 420	2736	rundll32.exe	67

Blacklisted process makes network request 12 IoCs

flow	pid	Process
7	420	rundll32.exe
9	420	rundll32.exe
11	420	rundll32.exe
13	420	rundll32.exe
19	420	rundll32.exe
21	420	rundll32.exe
22	420	rundll32.exe
24	420	rundll32.exe
26	420	rundll32.exe
28	420	rundll32.exe
30	420	rundll32.exe
32	420	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
420	rundll32.exe
420	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\liut9.cab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\liut9.cab.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads