Overview
overview
10Static
static
2021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
12021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
10Analysis
-
max time kernel
52s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-02-2021 19:50
Static task
static1
Behavioral task
behavioral1
Sample
202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
Resource
win10v20201028
Behavioral task
behavioral3
Sample
202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll
Resource
win7v20201028
Behavioral task
behavioral4
Sample
202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll
Resource
win10v20201028
Behavioral task
behavioral5
Sample
202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll
Resource
win7v20201028
Behavioral task
behavioral6
Sample
202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll
Resource
win10v20201028
Behavioral task
behavioral7
Sample
202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll
Resource
win7v20201028
Behavioral task
behavioral8
Sample
202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll
Resource
win10v20201028
Behavioral task
behavioral9
Sample
202102121641_ae55975bd40147ab3b9a02f1e2e0279f714bce9845d26ace252cd590a42d733d.bin.dll
Resource
win7v20201028
Behavioral task
behavioral10
Sample
202102121641_ae55975bd40147ab3b9a02f1e2e0279f714bce9845d26ace252cd590a42d733d.bin.dll
Resource
win10v20201028
Behavioral task
behavioral11
Sample
202102121641_c642dca14e48cae8391d5f100304b399b70a9c3967d7b7d3949ead3b96ba1a63.bin.dll
Resource
win7v20201028
Behavioral task
behavioral12
Sample
202102121641_c642dca14e48cae8391d5f100304b399b70a9c3967d7b7d3949ead3b96ba1a63.bin.dll
Resource
win10v20201028
Behavioral task
behavioral13
Sample
202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll
Resource
win7v20201028
Behavioral task
behavioral14
Sample
202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll
Resource
win10v20201028
Behavioral task
behavioral15
Sample
202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll
Resource
win7v20201028
General
-
Target
202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll
-
Size
329KB
-
MD5
48cab21fcbe254e7c83f4c1d455a39dc
-
SHA1
b96c1f765abb14eb401cacab6f6e203c3a255df9
-
SHA256
f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73
-
SHA512
0375a26a2d6d8990d202b75b4cb6797d03300ddc077c4dcb05778365212644ee49ce6e437fde0b77e1b8179d01ffad028635869d2f3897333b85471724d15ebc
Malware Config
Extracted
trickbot
100011
mon48
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
-
autorunName:pwgrab
Signatures
-
Templ.dll packer 1 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral16/memory/4844-4-0x00000000045A0000-0x00000000045D7000-memory.dmp templ_dll -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ipinfo.io -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 4328 wermgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4776 wrote to memory of 4844 4776 rundll32.exe rundll32.exe PID 4776 wrote to memory of 4844 4776 rundll32.exe rundll32.exe PID 4776 wrote to memory of 4844 4776 rundll32.exe rundll32.exe PID 4844 wrote to memory of 3084 4844 rundll32.exe wermgr.exe PID 4844 wrote to memory of 3084 4844 rundll32.exe wermgr.exe PID 4844 wrote to memory of 4328 4844 rundll32.exe wermgr.exe PID 4844 wrote to memory of 4328 4844 rundll32.exe wermgr.exe PID 4844 wrote to memory of 4328 4844 rundll32.exe wermgr.exe PID 4844 wrote to memory of 4328 4844 rundll32.exe wermgr.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4328-3-0x0000000000000000-mapping.dmp
-
memory/4328-8-0x00000271A5C80000-0x00000271A5CA7000-memory.dmpFilesize
156KB
-
memory/4328-9-0x00000271A5CC0000-0x00000271A5CC1000-memory.dmpFilesize
4KB
-
memory/4844-2-0x0000000000000000-mapping.dmp
-
memory/4844-5-0x00000000045E0000-0x0000000004621000-memory.dmpFilesize
260KB
-
memory/4844-6-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/4844-4-0x00000000045A0000-0x00000000045D7000-memory.dmpFilesize
220KB
-
memory/4844-7-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB