Overview
overview
10Static
static
2021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
12021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
10Analysis
-
max time kernel
18s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-02-2021 19:50
Static task
static1
Behavioral task
behavioral1
Sample
202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
Resource
win10v20201028
Behavioral task
behavioral3
Sample
202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll
Resource
win7v20201028
Behavioral task
behavioral4
Sample
202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll
Resource
win10v20201028
Behavioral task
behavioral5
Sample
202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll
Resource
win7v20201028
Behavioral task
behavioral6
Sample
202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll
Resource
win10v20201028
Behavioral task
behavioral7
Sample
202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll
Resource
win7v20201028
Behavioral task
behavioral8
Sample
202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll
Resource
win10v20201028
Behavioral task
behavioral9
Sample
202102121641_ae55975bd40147ab3b9a02f1e2e0279f714bce9845d26ace252cd590a42d733d.bin.dll
Resource
win7v20201028
Behavioral task
behavioral10
Sample
202102121641_ae55975bd40147ab3b9a02f1e2e0279f714bce9845d26ace252cd590a42d733d.bin.dll
Resource
win10v20201028
Behavioral task
behavioral11
Sample
202102121641_c642dca14e48cae8391d5f100304b399b70a9c3967d7b7d3949ead3b96ba1a63.bin.dll
Resource
win7v20201028
Behavioral task
behavioral12
Sample
202102121641_c642dca14e48cae8391d5f100304b399b70a9c3967d7b7d3949ead3b96ba1a63.bin.dll
Resource
win10v20201028
Behavioral task
behavioral13
Sample
202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll
Resource
win7v20201028
Behavioral task
behavioral14
Sample
202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll
Resource
win10v20201028
Behavioral task
behavioral15
Sample
202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll
Resource
win7v20201028
General
-
Target
202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll
-
Size
300KB
-
MD5
d564753c69c611fb485af9b66b967630
-
SHA1
056f88c4f7f0ed8f746f36f3cc37961c606bbf40
-
SHA256
7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5
-
SHA512
ade094db28924395908b6afff429ae716e0f58b7a4eef04f835bef5bff5e476c0fd3754ac94cb6810b67d6c666995e0fc45c05da33bf48a3a9b7f1dac17ddeea
Malware Config
Extracted
trickbot
100011
mon42
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
-
autorunName:pwgrab
Signatures
-
Templ.dll packer 1 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral6/memory/4792-4-0x0000000000CE0000-0x0000000000D17000-memory.dmp templ_dll -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4316 4792 WerFault.exe regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe 4316 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4316 WerFault.exe Token: SeBackupPrivilege 4316 WerFault.exe Token: SeDebugPrivilege 4316 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4692 wrote to memory of 4792 4692 regsvr32.exe regsvr32.exe PID 4692 wrote to memory of 4792 4692 regsvr32.exe regsvr32.exe PID 4692 wrote to memory of 4792 4692 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 6323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4316-3-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/4792-2-0x0000000000000000-mapping.dmp
-
memory/4792-4-0x0000000000CE0000-0x0000000000D17000-memory.dmpFilesize
220KB
-
memory/4792-5-0x0000000000D20000-0x0000000000D61000-memory.dmpFilesize
260KB