e0a4280ea1f844aa28c808c5931e3e245730b70d3c8d6ff8d5c13eaaa7115980 | Triage™

Analysis

max time kernel
66s
max time network
110s
platform
windows10_x64
resource
win10
submitted
30/07/2020, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
liut13.bin.dll
Size 172KB
Sample200730-ecbraqbjfn
SHA256 e0a4280ea1f844aa28c808c5931e3e245730b70d3c8d6ff8d5c13eaaa7115980
MD5 c0f80fcf06f37d482a9bbd2ff3a7de62
SHA1 04ad076a8b088d40de4057ba95e23ed59f9925f3
SHA512 89fcb7156f464443e45cc86491851f1a69e8ca66a0c28d290585ef4b9cce9e8b373b0d7f41b55c44476524bcd30e13c561647275f60e8904d179279f8ae00a66
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 12 IoCs

flow	pid	Process
4	3904	rundll32.exe
6	3904	rundll32.exe
8	3904	rundll32.exe
10	3904	rundll32.exe
12	3904	rundll32.exe
14	3904	rundll32.exe
15	3904	rundll32.exe
17	3904	rundll32.exe
19	3904	rundll32.exe
21	3904	rundll32.exe
23	3904	rundll32.exe
25	3904	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3904	rundll32.exe
3904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3904	3920	rundll32.exe	67
PID 3920 wrote to memory of 3904	3920	rundll32.exe	67
PID 3920 wrote to memory of 3904	3920	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\liut13.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\liut13.bin.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads