Analysis
-
max time kernel
116s -
max time network
14s -
platform
windows7_x64 -
resource
win7 -
submitted
21-10-2020 10:56
Static task
static1
Behavioral task
behavioral1
Sample
0517dfcbbc548c75f81cc8f64095ea39924d002a39e5cb4f7316b1984da5012d.dll
Resource
win7
General
-
Target
0517dfcbbc548c75f81cc8f64095ea39924d002a39e5cb4f7316b1984da5012d.dll
-
Size
678KB
-
MD5
f08bc130bab38a3bd77d961a87ef5532
-
SHA1
24fea15a4286138653b9d333b00033fcad487db2
-
SHA256
0517dfcbbc548c75f81cc8f64095ea39924d002a39e5cb4f7316b1984da5012d
-
SHA512
a2472f55b57a0d0d6432b54f4eee4602d1336c20343ac991fd6228fad36f9dc7714f7c3ad940581fe9f80ca7068d4d83563755382b19ae1c6cde60aa3a506999
Malware Config
Extracted
trickbot
1000512
chil65
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
-
autorunName:pwgrab
Signatures
-
Templ.dll packer 2 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral1/memory/744-1-0x0000000000260000-0x000000000028E000-memory.dmp templ_dll behavioral1/memory/744-2-0x0000000000290000-0x00000000002BD000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1760 wermgr.exe Token: SeDebugPrivilege 1760 wermgr.exe Token: SeDebugPrivilege 1760 wermgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 896 wrote to memory of 744 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 744 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 744 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 744 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 744 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 744 896 rundll32.exe rundll32.exe PID 896 wrote to memory of 744 896 rundll32.exe rundll32.exe PID 744 wrote to memory of 1760 744 rundll32.exe wermgr.exe PID 744 wrote to memory of 1760 744 rundll32.exe wermgr.exe PID 744 wrote to memory of 1760 744 rundll32.exe wermgr.exe PID 744 wrote to memory of 1760 744 rundll32.exe wermgr.exe PID 744 wrote to memory of 1760 744 rundll32.exe wermgr.exe PID 744 wrote to memory of 1760 744 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0517dfcbbc548c75f81cc8f64095ea39924d002a39e5cb4f7316b1984da5012d.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0517dfcbbc548c75f81cc8f64095ea39924d002a39e5cb4f7316b1984da5012d.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken