Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 10:36
Static task
static1
Behavioral task
behavioral1
Sample
a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560.dll
Resource
win7v20210410
General
-
Target
a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560.dll
-
Size
768KB
-
MD5
958f2d2965ef9b6b23134513688d36aa
-
SHA1
5929406e2f36f8ad79c45ace27e437d6023fb638
-
SHA256
a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560
-
SHA512
56cbf9d0875e603ce3af6948e387043644c54481c3ddd99441686dc530164046e243f644b7aad00b215186b6b9f9d2e6772213da901176858bd6c4fe1b2a7a05
Malware Config
Extracted
trickbot
100013
mon123
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
-
autorunName:pwgrab
Signatures
-
Templ.dll packer 3 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral1/memory/1952-62-0x00000000002E0000-0x0000000000319000-memory.dmp templ_dll behavioral1/memory/1952-65-0x0000000000A20000-0x0000000000A57000-memory.dmp templ_dll behavioral1/memory/1952-67-0x0000000000250000-0x0000000000286000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1160 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1100 wrote to memory of 1952 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1952 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1952 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1952 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1952 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1952 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1952 1100 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1772 1952 rundll32.exe cmd.exe PID 1952 wrote to memory of 1772 1952 rundll32.exe cmd.exe PID 1952 wrote to memory of 1772 1952 rundll32.exe cmd.exe PID 1952 wrote to memory of 1772 1952 rundll32.exe cmd.exe PID 1952 wrote to memory of 1160 1952 rundll32.exe wermgr.exe PID 1952 wrote to memory of 1160 1952 rundll32.exe wermgr.exe PID 1952 wrote to memory of 1160 1952 rundll32.exe wermgr.exe PID 1952 wrote to memory of 1160 1952 rundll32.exe wermgr.exe PID 1952 wrote to memory of 1160 1952 rundll32.exe wermgr.exe PID 1952 wrote to memory of 1160 1952 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:1772
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-