Resubmissions
04-05-2021 21:49
210504-vy6bjrf15e 1012-04-2021 15:59
210412-pzkl1vf56j 1012-04-2021 15:21
210412-wmdnkzp5la 10Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-04-2021 15:21
Static task
static1
General
-
Target
click.php.dll
-
Size
439KB
-
MD5
cbea511bd35f247e4b4bf7cc5a3a7cbd
-
SHA1
8c0d352934271350cfe6c00b7587e8dc8d062817
-
SHA256
0ae86e5abbc09e96f8c1155556ca6598c22aebd73acbba8d59f2ce702d3115f8
-
SHA512
aec894d9d3aaccccc029c615d283af4946c5150372db0ecdd616a9d491478759068214bf03db11631a5efb59951150d92c1517c2c11d8c6f0ddf5c8f76734fcf
Malware Config
Extracted
| Family |
trickbot |
| Version |
2000028 |
| Botnet |
rob52 |
| C2 |
89.250.208.42:449 182.253.184.130:449 31.211.85.110:443 85.112.74.178:449 102.68.17.97:443 103.76.150.14:443 96.9.77.142:443 91.185.236.170:449 87.76.1.81:449 91.225.231.120:443 62.213.14.166:443 81.95.45.234:449 148.216.32.55:443 109.185.139.90:449 202.166.211.197:443 196.41.57.46:449 84.21.206.164:449 190.122.168.219:443 77.95.93.132:449 41.77.134.250:443 87.116.151.237:449 185.205.250.162:443 103.9.188.23:449 78.138.187.231:443 138.185.72.142:443 173.81.4.147:443 31.134.124.90:443 200.90.11.177:449 5.59.205.32:443 |
| Attributes |
autorun Name:pwgrab |
| ecc_pubkey.base64 |
|
Signatures
-
Templ.dll packer ⋅ 1 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral2/memory/812-116-0x0000000004300000-0x0000000004337000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2444 wermgr.exe -
Suspicious use of WriteProcessMemory ⋅ 7 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3944 wrote to memory of 812 3944 rundll32.exe rundll32.exe PID 3944 wrote to memory of 812 3944 rundll32.exe rundll32.exe PID 3944 wrote to memory of 812 3944 rundll32.exe rundll32.exe PID 812 wrote to memory of 2444 812 rundll32.exe wermgr.exe PID 812 wrote to memory of 2444 812 rundll32.exe wermgr.exe PID 812 wrote to memory of 2444 812 rundll32.exe wermgr.exe PID 812 wrote to memory of 2444 812 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exePID:3944rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:812rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exePID:2444C:\Windows\system32\wermgr.exeSuspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
memory/812-114-0x0000000000000000-mapping.dmp
-
memory/812-117-0x0000000004340000-0x0000000004383000-memory.dmp
-
memory/812-118-0x00000000009E0000-0x00000000009E1000-memory.dmp
-
memory/812-116-0x0000000004300000-0x0000000004337000-memory.dmp
-
memory/812-119-0x0000000010001000-0x0000000010003000-memory.dmp
-
memory/2444-115-0x0000000000000000-mapping.dmp
-
memory/2444-120-0x000001DED4D40000-0x000001DED4D68000-memory.dmp
-
memory/2444-121-0x000001DED4D80000-0x000001DED4D81000-memory.dmp