Analysis

  • max time kernel
    55s
  • max time network
    57s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 00:53

General

  • Target

    E2-20191211_134358.dll

  • Size

    269KB

  • MD5

    2c177c13a67a7a8ce5e2c5a0312e3223

  • SHA1

    1158b27db357ba36fc3922d0f85d7be3ab3f3aa7

  • SHA256

    2bffe5e50c10299a36490f0c0ab76c4b31acbd111e52684bb141d1bc267493ae

  • SHA512

    8a0684acf5ac3d079104a6684c0ab1d32728008295417b36f56572178e83ba08ca47ce31a1a0f9d47b79ec8b4036c7437b3ff8d5e79cf5b2ebbfeb1d1b063925

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\E2-20191211_134358.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\E2-20191211_134358.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Wddlcwtjzt\dxrpiqoto.wnu",ShowDialogA
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/868-3-0x0000000000000000-mapping.dmp
  • memory/1180-2-0x0000000000000000-mapping.dmp