Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 05:16
Static task
static1
Behavioral task
behavioral1
Sample
mon123(1).dll
Resource
win7v20210408
General
-
Target
mon123(1).dll
-
Size
768KB
-
MD5
958f2d2965ef9b6b23134513688d36aa
-
SHA1
5929406e2f36f8ad79c45ace27e437d6023fb638
-
SHA256
a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560
-
SHA512
56cbf9d0875e603ce3af6948e387043644c54481c3ddd99441686dc530164046e243f644b7aad00b215186b6b9f9d2e6772213da901176858bd6c4fe1b2a7a05
Malware Config
Extracted
trickbot
100013
mon123
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
-
autorunName:pwgrab
Signatures
-
Templ.dll packer 2 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral2/memory/3884-115-0x0000000002C80000-0x0000000002CB9000-memory.dmp templ_dll behavioral2/memory/3884-118-0x0000000004AE0000-0x0000000004B17000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2732 wermgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2208 wrote to memory of 3884 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 3884 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 3884 2208 rundll32.exe rundll32.exe PID 3884 wrote to memory of 2680 3884 rundll32.exe cmd.exe PID 3884 wrote to memory of 2680 3884 rundll32.exe cmd.exe PID 3884 wrote to memory of 2680 3884 rundll32.exe cmd.exe PID 3884 wrote to memory of 2732 3884 rundll32.exe wermgr.exe PID 3884 wrote to memory of 2732 3884 rundll32.exe wermgr.exe PID 3884 wrote to memory of 2732 3884 rundll32.exe wermgr.exe PID 3884 wrote to memory of 2732 3884 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mon123(1).dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mon123(1).dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2732-122-0x0000000000000000-mapping.dmp
-
memory/2732-125-0x00000219E08B0000-0x00000219E08D8000-memory.dmpFilesize
160KB
-
memory/2732-126-0x00000219E08F0000-0x00000219E08F1000-memory.dmpFilesize
4KB
-
memory/3884-114-0x0000000000000000-mapping.dmp
-
memory/3884-115-0x0000000002C80000-0x0000000002CB9000-memory.dmpFilesize
228KB
-
memory/3884-118-0x0000000004AE0000-0x0000000004B17000-memory.dmpFilesize
220KB
-
memory/3884-120-0x00000000028B0000-0x00000000029FA000-memory.dmpFilesize
1.3MB
-
memory/3884-121-0x0000000004B20000-0x0000000004B63000-memory.dmpFilesize
268KB
-
memory/3884-124-0x0000000002D11000-0x0000000002D13000-memory.dmpFilesize
8KB
-
memory/3884-123-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB