Analysis
-
max time kernel
3s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
07-05-2021 06:01
Static task
static1
Behavioral task
behavioral1
Sample
mon123(1).dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
mon123(1).dll
-
Size
768KB
-
MD5
958f2d2965ef9b6b23134513688d36aa
-
SHA1
5929406e2f36f8ad79c45ace27e437d6023fb638
-
SHA256
a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560
-
SHA512
56cbf9d0875e603ce3af6948e387043644c54481c3ddd99441686dc530164046e243f644b7aad00b215186b6b9f9d2e6772213da901176858bd6c4fe1b2a7a05
Malware Config
Signatures
-
Templ.dll packer 3 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral1/memory/840-61-0x00000000002C0000-0x00000000002F9000-memory.dmp templ_dll behavioral1/memory/840-64-0x00000000007D0000-0x0000000000807000-memory.dmp templ_dll behavioral1/memory/840-66-0x00000000001A0000-0x00000000001D6000-memory.dmp templ_dll -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1084 wrote to memory of 840 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 840 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 840 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 840 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 840 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 840 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 840 1084 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mon123(1).dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mon123(1).dll,#12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/840-59-0x0000000000000000-mapping.dmp
-
memory/840-60-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/840-61-0x00000000002C0000-0x00000000002F9000-memory.dmpFilesize
228KB
-
memory/840-64-0x00000000007D0000-0x0000000000807000-memory.dmpFilesize
220KB
-
memory/840-66-0x00000000001A0000-0x00000000001D6000-memory.dmpFilesize
216KB
-
memory/840-67-0x0000000000830000-0x0000000000873000-memory.dmpFilesize
268KB