Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
14-07-2020 04:41
Static task
static1
Behavioral task
behavioral1
Sample
39b89f87fb5a6303bf6721c477e0c109a7cd67433081092fef963b26a00f28c9.dll
Resource
win7
General
-
Target
39b89f87fb5a6303bf6721c477e0c109a7cd67433081092fef963b26a00f28c9.dll
-
Size
611KB
-
MD5
69f15ee8548baac2db17c3432bd97d21
-
SHA1
02b3b0bd1a683fda61488d920cde8c40907a2e68
-
SHA256
39b89f87fb5a6303bf6721c477e0c109a7cd67433081092fef963b26a00f28c9
-
SHA512
be0f32d87f67a71cbd47a32d1335968e87856cf468b1d34f0c13c3a8351a9dfbc7dc6eaaa803fd7439e3e67d90efc1dac088b1fc523ca48b8013fe43cb300f64
Malware Config
Extracted
trickbot
1000512
chil65
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
-
autorunName:pwgrab
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2116 wrote to memory of 2444 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 2444 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 2444 2116 rundll32.exe rundll32.exe PID 2444 wrote to memory of 2648 2444 rundll32.exe wermgr.exe PID 2444 wrote to memory of 2648 2444 rundll32.exe wermgr.exe PID 2444 wrote to memory of 2648 2444 rundll32.exe wermgr.exe PID 2444 wrote to memory of 2648 2444 rundll32.exe wermgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2648 wermgr.exe Token: SeDebugPrivilege 2648 wermgr.exe Token: SeDebugPrivilege 2648 wermgr.exe -
Templ.dll packer 2 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral2/memory/2444-1-0x00000000044A0000-0x00000000044CE000-memory.dmp templ_dll behavioral2/memory/2444-2-0x00000000044D0000-0x00000000044FD000-memory.dmp templ_dll
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39b89f87fb5a6303bf6721c477e0c109a7cd67433081092fef963b26a00f28c9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39b89f87fb5a6303bf6721c477e0c109a7cd67433081092fef963b26a00f28c9.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648