b6f0d81099f0bf43567af83bfeb0cd8eb8bbf006f5de72619f6bd25bda0695ff | Triage™

Analysis

max time kernel
138s
max time network
141s
platform
windows10_x64
resource
win10v200722
submitted
18/08/2020, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
likub12.cab.dll
Size 208KB
Sample200818-ctry91vjw2
SHA256 b6f0d81099f0bf43567af83bfeb0cd8eb8bbf006f5de72619f6bd25bda0695ff
MD5 31a408c04ea8d9cd814616830d72c84f
SHA1 61d58d6599151cc7c2ed8d9e63fa1fc86ec81291
SHA512 870675ab2185d1e2bb9168d3460b13130bec518855389fc828942f018c2bb161cc3cc8e119b834a0ef8271bcae58e056d0e85c23bee61eea8e79da7ad3f2cd2c
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 9 IoCs

flow	pid	Process
17	1476	rundll32.exe
19	1476	rundll32.exe
22	1476	rundll32.exe
24	1476	rundll32.exe
26	1476	rundll32.exe
28	1476	rundll32.exe
32	1476	rundll32.exe
34	1476	rundll32.exe
36	1476	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	rundll32.exe
1476	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1476	3288	rundll32.exe	66
PID 3288 wrote to memory of 1476	3288	rundll32.exe	66
PID 3288 wrote to memory of 1476	3288	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\likub12.cab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\likub12.cab.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads