e35b9feacfba1df802f9ed242775361f4317c22782f4e9e2dddd095577a72487 | Triage™

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libOmio.dll
Size 279KB
Sample201109-glsffdfkya
SHA256 e35b9feacfba1df802f9ed242775361f4317c22782f4e9e2dddd095577a72487
MD5 83b02e12a48b092f91788d7c253dd1c2
SHA1 acf4e3c3fd1772c7d4ebec32b38d018cce4e9707
SHA512 2346555b01a3f5da162dce7a8091e304a207965f1ad6d956e6fc0de1ad457c1bea0ee0b7fcba53fdc0155c021bba53213f585932c59d1a09b0c429e0e190318f
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	1400	rundll32.exe
4	1400	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	rundll32.exe
1400	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1400	240	rundll32.exe	26
PID 240 wrote to memory of 1400	240	rundll32.exe	26
PID 240 wrote to memory of 1400	240	rundll32.exe	26
PID 240 wrote to memory of 1400	240	rundll32.exe	26
PID 240 wrote to memory of 1400	240	rundll32.exe	26
PID 240 wrote to memory of 1400	240	rundll32.exe	26
PID 240 wrote to memory of 1400	240	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libOmio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libOmio.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads