5c5c8af2a703aa1842f4ce9f9e83aeeac0e2cc2d3ed1bf9f9ad72b7f77e89a42 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows10_x64
resource
win10v20201028
submitted
02-12-2020 17:39

Sharing

Report Analysis Logs

General

Target

r.php.dll
Size

440KB
MD5

be211fc134a945398f96e3cfe8ac0acd
SHA1

1546aed93ddf813d13635664470454bf40d89056
SHA256

5c5c8af2a703aa1842f4ce9f9e83aeeac0e2cc2d3ed1bf9f9ad72b7f77e89a42
SHA512

7205a3ac02803fc26b8d895edbad0319d0ce40cfb84250e7fd08bf13bdf6df022784e75e672be2f28621aa94f78de41815d326edfd44599937d15d057dff9902

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 16 IoCs

Processes:

msiexec.exe

flow	pid	process
17	1464	msiexec.exe
18	1464	msiexec.exe
19	1464	msiexec.exe
20	1464	msiexec.exe
21	1464	msiexec.exe
22	1464	msiexec.exe
24	1464	msiexec.exe
26	1464	msiexec.exe
28	1464	msiexec.exe
29	1464	msiexec.exe
30	1464	msiexec.exe
31	1464	msiexec.exe
32	1464	msiexec.exe
33	1464	msiexec.exe
35	1464	msiexec.exe
37	1464	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 904 set thread context of 1464 904 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1464 msiexec.exe
Token: SeSecurityPrivilege 1464 msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 904	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 904	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 904	1924	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1464	904	rundll32.exe	msiexec.exe
PID 904 wrote to memory of 1464	904	rundll32.exe	msiexec.exe
PID 904 wrote to memory of 1464	904	rundll32.exe	msiexec.exe
PID 904 wrote to memory of 1464	904	rundll32.exe	msiexec.exe
PID 904 wrote to memory of 1464	904	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r.php.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r.php.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-2-0x0000000000000000-mapping.dmp

Download
memory/1464-3-0x0000000002D90000-0x0000000002DB6000-memory.dmp

Filesize
152KB

Download
memory/1464-4-0x0000000000000000-mapping.dmp

Download