Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-02-2021 21:15
Static task
static1
Behavioral task
behavioral1
Sample
8d6f00e5fd9873adbb197131fe6e6eec178ee9ade06f8aa5d3a9fc7cb42771ee.dll
Resource
win7v20201028
General
-
Target
8d6f00e5fd9873adbb197131fe6e6eec178ee9ade06f8aa5d3a9fc7cb42771ee.dll
-
Size
358KB
-
MD5
e079b373bb72a2639c2fe1c2b61e9e71
-
SHA1
00e2d85bfc59b24855f53388a4d0fe6324bfdf31
-
SHA256
8d6f00e5fd9873adbb197131fe6e6eec178ee9ade06f8aa5d3a9fc7cb42771ee
-
SHA512
ca469c4e6fc025ec84b30a9177240c92472da98198197480e5a5c631c7ba9228ba0970192d6a51e4dcca86cb3841dd813f3020c01bab8e9aa68a8c4517792110
Malware Config
Extracted
trickbot
100010
rob44
5.34.180.180:443
64.74.160.228:443
198.46.198.116:443
5.34.180.185:443
107.152.46.188:443
195.123.241.214:443
23.254.224.2:443
107.172.188.113:443
200.52.147.93:443
185.198.59.45:443
45.14.226.101:443
185.82.126.38:443
85.204.116.139:443
45.155.173.248:443
103.91.244.50:443
45.230.244.20:443
45.226.124.226:443
187.84.95.6:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
180.92.158.244:443
-
autorunName:pwgrab
Signatures
-
Templ.dll packer 1 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral2/memory/1776-4-0x0000000010000000-0x0000000013054000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 204 wermgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1456 wrote to memory of 1776 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1776 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1776 1456 rundll32.exe rundll32.exe PID 1776 wrote to memory of 204 1776 rundll32.exe wermgr.exe PID 1776 wrote to memory of 204 1776 rundll32.exe wermgr.exe PID 1776 wrote to memory of 204 1776 rundll32.exe wermgr.exe PID 1776 wrote to memory of 204 1776 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d6f00e5fd9873adbb197131fe6e6eec178ee9ade06f8aa5d3a9fc7cb42771ee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d6f00e5fd9873adbb197131fe6e6eec178ee9ade06f8aa5d3a9fc7cb42771ee.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:204
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-5-0x0000000000000000-mapping.dmp
-
memory/204-10-0x0000014BF02D0000-0x0000014BF02F7000-memory.dmpFilesize
156KB
-
memory/204-11-0x0000014BF0310000-0x0000014BF0311000-memory.dmpFilesize
4KB
-
memory/1776-2-0x0000000000000000-mapping.dmp
-
memory/1776-3-0x0000000004C00000-0x0000000007C54000-memory.dmpFilesize
48.3MB
-
memory/1776-4-0x0000000010000000-0x0000000013054000-memory.dmpFilesize
48.3MB
-
memory/1776-6-0x0000000004840000-0x0000000004881000-memory.dmpFilesize
260KB
-
memory/1776-7-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/1776-9-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB
-
memory/1776-8-0x0000000004811000-0x0000000004813000-memory.dmpFilesize
8KB