72c24df8b7bb94c56c36a21ee311a0b525f432293fa48f54401ea19815630fef | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows10_x64
resource
win10v20201028
submitted
01-03-2021 17:13

Sharing

Report Analysis Logs

General

Target

72c24df8b7bb94c56c36a21ee311a0b525f432293fa48f54401ea19815630fef.bin.dll
Size

407KB
MD5

a25ea03dd5e175e547f1f3048e813f62
SHA1

98727b1b6826e2816f908c08b15db427c875ca53
SHA256

72c24df8b7bb94c56c36a21ee311a0b525f432293fa48f54401ea19815630fef
SHA512

a96aa1fd86fc2e7110d801832fecfad005e1fda53624f39d42a7af6363500be4ec84033a62d7214e3d99c08ef64c8f50e1c333d14b9c53d8c38f036f1cad73a9

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 24 IoCs

Processes:

msiexec.exe

flow	pid	process
16	3912	msiexec.exe
17	3912	msiexec.exe
18	3912	msiexec.exe
19	3912	msiexec.exe
20	3912	msiexec.exe
21	3912	msiexec.exe
23	3912	msiexec.exe
24	3912	msiexec.exe
25	3912	msiexec.exe
26	3912	msiexec.exe
27	3912	msiexec.exe
28	3912	msiexec.exe
30	3912	msiexec.exe
31	3912	msiexec.exe
32	3912	msiexec.exe
33	3912	msiexec.exe
34	3912	msiexec.exe
35	3912	msiexec.exe
37	3912	msiexec.exe
38	3912	msiexec.exe
39	3912	msiexec.exe
41	3912	msiexec.exe
42	3912	msiexec.exe
43	3912	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 852 set thread context of 3912 852 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 3912 msiexec.exe
Token: SeSecurityPrivilege 3912 msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3576 wrote to memory of 852	3576	rundll32.exe	rundll32.exe
PID 3576 wrote to memory of 852	3576	rundll32.exe	rundll32.exe
PID 3576 wrote to memory of 852	3576	rundll32.exe	rundll32.exe
PID 852 wrote to memory of 3912	852	rundll32.exe	msiexec.exe
PID 852 wrote to memory of 3912	852	rundll32.exe	msiexec.exe
PID 852 wrote to memory of 3912	852	rundll32.exe	msiexec.exe
PID 852 wrote to memory of 3912	852	rundll32.exe	msiexec.exe
PID 852 wrote to memory of 3912	852	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c24df8b7bb94c56c36a21ee311a0b525f432293fa48f54401ea19815630fef.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c24df8b7bb94c56c36a21ee311a0b525f432293fa48f54401ea19815630fef.bin.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-2-0x0000000000000000-mapping.dmp

Download
memory/852-3-0x00000000743D0000-0x00000000743F9000-memory.dmp

Filesize
164KB

Download
memory/852-4-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/3912-5-0x0000000000000000-mapping.dmp

Download
memory/3912-6-0x00000000032B0000-0x00000000032D9000-memory.dmp

Filesize
164KB

Download