Analysis
-
max time kernel
96s -
max time network
94s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
28-08-2020 05:00
Static task
static1
Behavioral task
behavioral1
Sample
updateme.dll
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
updateme.dll
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
updateme.dll
-
Size
157KB
-
MD5
c182f4b04f4c0b361c0792f9e75621b2
-
SHA1
4026c3deb1203f6ee5afed71233b888e6f9b393a
-
SHA256
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
-
SHA512
f97ef84dea027e4b9b68c10f1eb599545f8d742698c5a85352460993ec080a14a80b345328c3511e937d7e9797a447b0f47b03b7cb87094ee63788d159a9f2ac
Score
10/10
Malware Config
Signatures
-
Blacklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 6 548 msiexec.exe 7 548 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uhkeew = "regsvr32.exe /s C:\\Users\\Admin\\AppData\\Roaming\\Ciimk\\aryn.dll" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1664 set thread context of 548 1664 rundll32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 548 msiexec.exe Token: SeSecurityPrivilege 548 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 108 wrote to memory of 1664 108 rundll32.exe rundll32.exe PID 108 wrote to memory of 1664 108 rundll32.exe rundll32.exe PID 108 wrote to memory of 1664 108 rundll32.exe rundll32.exe PID 108 wrote to memory of 1664 108 rundll32.exe rundll32.exe PID 108 wrote to memory of 1664 108 rundll32.exe rundll32.exe PID 108 wrote to memory of 1664 108 rundll32.exe rundll32.exe PID 108 wrote to memory of 1664 108 rundll32.exe rundll32.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe PID 1664 wrote to memory of 548 1664 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\updateme.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\updateme.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blacklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/548-1-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/548-2-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/548-3-0x0000000000090000-0x00000000000BC000-memory.dmpFilesize
176KB
-
memory/548-4-0x0000000000000000-mapping.dmp
-
memory/1340-5-0x000007FEF7F70000-0x000007FEF81EA000-memory.dmpFilesize
2.5MB
-
memory/1664-0-0x0000000000000000-mapping.dmp