c7b031f4548d4f90f20876b89665e739bc7d2ec3136280abd706db7661f4e3f2 | Triage™

Analysis

max time kernel
125s
max time network
128s
platform
windows10_x64
resource
win10
submitted
18/08/2020, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
likub15.cab.dll
Size 208KB
Sample200818-sfranntphn
SHA256 c7b031f4548d4f90f20876b89665e739bc7d2ec3136280abd706db7661f4e3f2
MD5 5a8338cb010a7c85c30cecd2df24c7f7
SHA1 4cb5147df09d2c439b5ee3269cae34c3ca73ba64
SHA512 8a5b89a604123b4e7e4eb911213f2c72bf328ce032453580612f3e3bd654bf9803dc4852d6e470b9d21e23acd92c2e005d9cd3a378922c1480072ffe98698f3b
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 9 IoCs

flow	pid	Process
5	336	rundll32.exe
7	336	rundll32.exe
9	336	rundll32.exe
11	336	rundll32.exe
13	336	rundll32.exe
15	336	rundll32.exe
17	336	rundll32.exe
19	336	rundll32.exe
21	336	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
336	rundll32.exe
336	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 336	720	rundll32.exe	67
PID 720 wrote to memory of 336	720	rundll32.exe	67
PID 720 wrote to memory of 336	720	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\likub15.cab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\likub15.cab.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads