b1b6ca3dd3d6ef951acc6d0fb2b30b9d82d2f7d29deffd3b4346d0fba522a485 | Triage

Analysis

max time kernel
77s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
14-11-2020 00:40

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Mikey.116711.25037.867.dll
Size

131KB
MD5

1519a2dbe2f250a807f8c1b99ee3fc38
SHA1

257cac81f1445896059d2d228b42e3c909bca097
SHA256

b1b6ca3dd3d6ef951acc6d0fb2b30b9d82d2f7d29deffd3b4346d0fba522a485
SHA512

f338ecc831cf46c401fc7f2b9f2ff6faf2c5486c70402e9cd8b3767f6c2c1522f35431651f1c16e0a49f0bb401fb4959b428d2cd1e5ba5b920ee89fc69ab0e6e

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	process
13	804	rundll32.exe
15	804	rundll32.exe
17	804	rundll32.exe
18	804	rundll32.exe
20	804	rundll32.exe
22	804	rundll32.exe
24	804	rundll32.exe
26	804	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

804 rundll32.exe
804 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 500 wrote to memory of 804	500	rundll32.exe	rundll32.exe
PID 500 wrote to memory of 804	500	rundll32.exe	rundll32.exe
PID 500 wrote to memory of 804	500	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Mikey.116711.25037.867.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:500

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Mikey.116711.25037.867.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-0-0x0000000000000000-mapping.dmp

Download