trickbot | 5e84efe4d51ed6e3de4aca32ec599edaf9fd1a2ff1a45dae5d471a53fd121e3e

General

Target

asdodnj1119505.doc
Size

1.1MB
MD5

c4dc25fdbdc0b722de6cb190e08757ce
SHA1

d52e95b887badf0081d66965913555a0b59f00e9
SHA256

5e84efe4d51ed6e3de4aca32ec599edaf9fd1a2ff1a45dae5d471a53fd121e3e
SHA512

7fe15ed619e2957ba3563c05c807e673f9927e1a4324c95114aca04dd30e1fc1dfb18a55a3840278b7ef1fe5346b242e6875c2228344302c51c3398c211c9a48

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

2000010

Botnet

ono78

C2

195.123.239.59:443

85.143.219.36:443

94.250.254.84:443

94.250.255.217:443

212.80.219.98:443

91.210.171.82:443

45.8.230.108:443

194.156.98.172:443

195.2.93.227:443

62.108.35.179:443

91.200.101.192:443

194.5.249.31:443

195.123.241.157:443

104.161.32.10:443

88.150.197.186:443

62.108.35.204:443

45.155.173.196:443

51.89.177.18:443

194.5.249.107:443

195.123.241.182:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1060	896	explorer.exe	WINWORD.EXE

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

300 rundll32.exe
300 rundll32.exe
300 rundll32.exe
300 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

WScript.exe

description ioc process

File created C:\Windows\System32\sadasjdn.css WScript.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
300	rundll32.exe
300	rundll32.exe
300	rundll32.exe
300	rundll32.exe

description	ioc	process
File created	C:\Windows\System32\sadasjdn.css	WScript.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{568ACBBF-1239-4C36-B1BD-D54D1ED3FA8A}\2.0\FLAGS\ = "6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{568ACBBF-1239-4C36-B1BD-D54D1ED3FA8A}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{568ACBBF-1239-4C36-B1BD-D54D1ED3FA8A}\2.0\0\win32	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{568ACBBF-1239-4C36-B1BD-D54D1ED3FA8A}\2.0\FLAGS\ = "6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{568ACBBF-1239-4C36-B1BD-D54D1ED3FA8A}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

896 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 852 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

896 WINWORD.EXE
896 WINWORD.EXE

pid	process
896	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	852	wermgr.exe

pid	process
896	WINWORD.EXE
896	WINWORD.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

WINWORD.EXEexplorer.exeWScript.exerundll32.exerundll32.exe

description	pid	process	target process
PID 896 wrote to memory of 1060	896	WINWORD.EXE	explorer.exe
PID 896 wrote to memory of 1060	896	WINWORD.EXE	explorer.exe
PID 896 wrote to memory of 1060	896	WINWORD.EXE	explorer.exe
PID 1548 wrote to memory of 756	1548	explorer.exe	WScript.exe
PID 1548 wrote to memory of 756	1548	explorer.exe	WScript.exe
PID 1548 wrote to memory of 756	1548	explorer.exe	WScript.exe
PID 756 wrote to memory of 544	756	WScript.exe	rundll32.exe
PID 756 wrote to memory of 544	756	WScript.exe	rundll32.exe
PID 756 wrote to memory of 544	756	WScript.exe	rundll32.exe
PID 544 wrote to memory of 300	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 300	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 300	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 300	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 300	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 300	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 300	544	rundll32.exe	rundll32.exe
PID 300 wrote to memory of 852	300	rundll32.exe	wermgr.exe
PID 300 wrote to memory of 852	300	rundll32.exe	wermgr.exe
PID 300 wrote to memory of 852	300	rundll32.exe	wermgr.exe
PID 300 wrote to memory of 852	300	rundll32.exe	wermgr.exe
PID 300 wrote to memory of 852	300	rundll32.exe	wermgr.exe
PID 300 wrote to memory of 852	300	rundll32.exe	wermgr.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\asdodnj1119505.doc"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\explorer.exe
explorer c:\tabkey\pkmgsdgra.vbe
2⤵
- Process spawned unexpected child process
PID:1060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\tabkey\pkmgsdgra.vbe"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\System32\rundll32.exe
rundll32 c:\tabkey\pasodsjg\DVOBSNDSOG.dll,DllRegisterServer
3⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\rundll32.exe
rundll32 c:\tabkey\pasodsjg\DVOBSNDSOG.dll,DllRegisterServer
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:300

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\tabkey\pkmgsdgra.vbe
MD5
1a79677bdaf8aaf431b0894eee99a63c

SHA1
b3bd5a0eb4edab681f14d09d9bef6776403deec9

SHA256
e93dbbbb9e9adeba9b59a2bd3d6412f691860aa1b73ad53049f3895d5d9054aa

SHA512
724b4045db61a6ca30ac184f55b8c6350a3d27c272a7b933d4590ad8dd1d24b72f38d30f616115ef4f00dba2d45a87472609427003b5e848132add4acb1c67da

Download Submit
\??\c:\tabkey\pasodsjg\DVOBSNDSOG.dll
MD5
7c537f7a08f180c10cfe5a64741909b3

SHA1
09a41c9d0aa71a05daf10ef11fd615b6208b5db6

SHA256
c965159b432c96ca529d359e82bf92bf6b5199ff686d6a31c20ab7741c719df2

SHA512
fecb709fa35ff2bd059c0a244900c92b7560b8d12539baee161207824024cfbba15714ef8ce99fe4ad6333038f619d01b399a0d1be533379be8653b14a5460bc

Download Submit
\tabkey\pasodsjg\DVOBSNDSOG.dll
MD5
7c537f7a08f180c10cfe5a64741909b3

SHA1
09a41c9d0aa71a05daf10ef11fd615b6208b5db6

SHA256
c965159b432c96ca529d359e82bf92bf6b5199ff686d6a31c20ab7741c719df2

SHA512
fecb709fa35ff2bd059c0a244900c92b7560b8d12539baee161207824024cfbba15714ef8ce99fe4ad6333038f619d01b399a0d1be533379be8653b14a5460bc

Download Submit
\tabkey\pasodsjg\DVOBSNDSOG.dll
MD5
7c537f7a08f180c10cfe5a64741909b3

SHA1
09a41c9d0aa71a05daf10ef11fd615b6208b5db6

SHA256
c965159b432c96ca529d359e82bf92bf6b5199ff686d6a31c20ab7741c719df2

SHA512
fecb709fa35ff2bd059c0a244900c92b7560b8d12539baee161207824024cfbba15714ef8ce99fe4ad6333038f619d01b399a0d1be533379be8653b14a5460bc

Download Submit
\tabkey\pasodsjg\DVOBSNDSOG.dll
MD5
7c537f7a08f180c10cfe5a64741909b3

SHA1
09a41c9d0aa71a05daf10ef11fd615b6208b5db6

SHA256
c965159b432c96ca529d359e82bf92bf6b5199ff686d6a31c20ab7741c719df2

SHA512
fecb709fa35ff2bd059c0a244900c92b7560b8d12539baee161207824024cfbba15714ef8ce99fe4ad6333038f619d01b399a0d1be533379be8653b14a5460bc

Download Submit
\tabkey\pasodsjg\DVOBSNDSOG.dll
MD5
7c537f7a08f180c10cfe5a64741909b3

SHA1
09a41c9d0aa71a05daf10ef11fd615b6208b5db6

SHA256
c965159b432c96ca529d359e82bf92bf6b5199ff686d6a31c20ab7741c719df2

SHA512
fecb709fa35ff2bd059c0a244900c92b7560b8d12539baee161207824024cfbba15714ef8ce99fe4ad6333038f619d01b399a0d1be533379be8653b14a5460bc

Download Submit
memory/300-12-0x0000000000000000-mapping.dmp

Download
memory/300-17-0x00000000001C0000-0x00000000001F7000-memory.dmp

Filesize
220KB

Download
memory/300-18-0x00000000002A0000-0x00000000002D6000-memory.dmp

Filesize
216KB

Download
memory/544-9-0x0000000000000000-mapping.dmp

Download
memory/756-10-0x00000000026B0000-0x00000000026B4000-memory.dmp

Filesize
16KB

Download
memory/756-7-0x0000000000000000-mapping.dmp

Download
memory/852-19-0x0000000000000000-mapping.dmp

Download
memory/896-8-0x0000000004B80000-0x0000000004B84000-memory.dmp

Filesize
16KB

Download
memory/896-1-0x0000000007190000-0x0000000007390000-memory.dmp

Filesize
2.0MB

Download
memory/896-0-0x0000000002550000-0x0000000002554000-memory.dmp

Filesize
16KB

Download
memory/896-6-0x0000000007DB0000-0x0000000007DB4000-memory.dmp

Filesize
16KB

Download
memory/896-2-0x0000000007190000-0x0000000007390000-memory.dmp

Filesize
2.0MB

Download
memory/1060-3-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads