d9e22bc57b8c36650950d471c47869814e215ed7b92f5a6095b38b411dbf6ce4 | Triage

Analysis

max time kernel
113s
max time network
115s
platform
windows10_x64
resource
win10v20201028
submitted
17-02-2021 15:31

Sharing

Report Analysis Logs

General

Target

0SEND4.txt.bin.dll
Size

798KB
MD5

4746a10f3884b8c1855b865adab64038
SHA1

3caa423388eb1314499d27574251365ec5c25e64
SHA256

d9e22bc57b8c36650950d471c47869814e215ed7b92f5a6095b38b411dbf6ce4
SHA512

8b5b56860cf87c969fb9734aa14d8201a2a48a05ceba1416e9b72f49bf4ea988e2c958a8291b95baac2d1d524c96b9c8fa7e6192b2f9211692e62e75d39517b7

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

Processes:

msiexec.exe

flow	pid	process
17	3604	msiexec.exe
18	3604	msiexec.exe
20	3604	msiexec.exe
21	3604	msiexec.exe
23	3604	msiexec.exe
24	3604	msiexec.exe
26	3604	msiexec.exe
27	3604	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 736 set thread context of 3604 736 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 3604 msiexec.exe
Token: SeSecurityPrivilege 3604 msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 736	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 736	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 736	740	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 3604	736	rundll32.exe	msiexec.exe
PID 736 wrote to memory of 3604	736	rundll32.exe	msiexec.exe
PID 736 wrote to memory of 3604	736	rundll32.exe	msiexec.exe
PID 736 wrote to memory of 3604	736	rundll32.exe	msiexec.exe
PID 736 wrote to memory of 3604	736	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0SEND4.txt.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0SEND4.txt.bin.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-2-0x0000000000000000-mapping.dmp

Download
memory/736-3-0x0000000074250000-0x0000000074279000-memory.dmp

Filesize
164KB

Download
memory/736-4-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3604-5-0x0000000000000000-mapping.dmp

Download
memory/3604-6-0x0000000003060000-0x0000000003089000-memory.dmp

Filesize
164KB

Download