Overview
overview
10Static
static
1006ffb7bbd7...da3906
linux_amd64
06ffb7bbd7...da3906
linux_mipsel
06ffb7bbd7...da3906
linux_mips
154080c584...95.msi
windows7_x64
8154080c584...95.msi
windows10_x64
81650ced30c...c5.exe
windows7_x64
1650ced30c...c5.exe
windows10_x64
1a70a7de8a...4a.exe
windows7_x64
81a70a7de8a...4a.exe
windows10_x64
8ISSUES INV....1.exe
windows7_x64
10ISSUES INV....1.exe
windows10_x64
10350fbd43ce...ed.exe
windows7_x64
350fbd43ce...ed.exe
windows10_x64
44faf11719...12.exe
windows7_x64
144faf11719...12.exe
windows10_x64
14853dc09bb...5f6.js
windows7_x64
14853dc09bb...5f6.js
windows10_x64
14ba637df90...3f4a9e
linux_amd64
4ba637df90...3f4a9e
linux_mipsel
4ba637df90...3f4a9e
linux_mips
4f8c1840d6...92df06
linux_amd64
4f8c1840d6...92df06
linux_mipsel
4f8c1840d6...92df06
linux_mips
623534bf15...72.vbs
windows7_x64
10623534bf15...72.vbs
windows10_x64
1065df637db2...00083b
linux_amd64
65df637db2...00083b
linux_mipsel
65df637db2...00083b
linux_mips
717ad3ee2b...47.dll
windows7_x64
10717ad3ee2b...47.dll
windows10_x64
1071ba20bdd8...99.pps
windows7_x64
1071ba20bdd8...99.pps
windows10_x64
10Analysis
-
max time kernel
130s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-07-2021 13:07
Behavioral task
behavioral1
Sample
06ffb7bbd7dd6a47bd3fdb77f86e2bc3b3a9d0112496eed24f75581164da3906
Resource
ubuntu-amd64
Behavioral task
behavioral2
Sample
06ffb7bbd7dd6a47bd3fdb77f86e2bc3b3a9d0112496eed24f75581164da3906
Resource
debian9-mipsel
Behavioral task
behavioral3
Sample
06ffb7bbd7dd6a47bd3fdb77f86e2bc3b3a9d0112496eed24f75581164da3906
Resource
debian9-mipsbe
Behavioral task
behavioral4
Sample
154080c5844ed76332320fcf3f1773391d80200f18f9025fd05b55b86f8ff795.msi
Resource
win7v20210408
Behavioral task
behavioral5
Sample
154080c5844ed76332320fcf3f1773391d80200f18f9025fd05b55b86f8ff795.msi
Resource
win10v20210410
Behavioral task
behavioral6
Sample
1650ced30cfb68451bb432b44f72fa93687d95d83f70fa039658d8cb665508c5.exe
Resource
win7v20210410
Behavioral task
behavioral7
Sample
1650ced30cfb68451bb432b44f72fa93687d95d83f70fa039658d8cb665508c5.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
1a70a7de8a393638b80336e9d2b225c2fd199d9d3eed3ad2c007656cc20c2b4a.exe
Resource
win7v20210410
Behavioral task
behavioral9
Sample
1a70a7de8a393638b80336e9d2b225c2fd199d9d3eed3ad2c007656cc20c2b4a.exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
ISSUES INVOICE E-4136 REV.1.exe
Resource
win7v20210410
Behavioral task
behavioral11
Sample
ISSUES INVOICE E-4136 REV.1.exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
350fbd43ce6f7d1d3d636aa5b94187d4dcc8e866527cfdc9c9ce226aea3500ed.exe
Resource
win7v20210408
Behavioral task
behavioral13
Sample
350fbd43ce6f7d1d3d636aa5b94187d4dcc8e866527cfdc9c9ce226aea3500ed.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112.exe
Resource
win7v20210408
Behavioral task
behavioral15
Sample
44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112.exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
4853dc09bbd4a61610a354d5fcd0f9e376e284124c5ff949ba49457eed1f55f6.js
Resource
win7v20210410
Behavioral task
behavioral17
Sample
4853dc09bbd4a61610a354d5fcd0f9e376e284124c5ff949ba49457eed1f55f6.js
Resource
win10v20210408
Behavioral task
behavioral18
Sample
4ba637df90076330cdace697a87aafc6dd1d1b3a35b4ad924aad80aa7c3f4a9e
Resource
ubuntu-amd64
Behavioral task
behavioral19
Sample
4ba637df90076330cdace697a87aafc6dd1d1b3a35b4ad924aad80aa7c3f4a9e
Resource
debian9-mipsel
Behavioral task
behavioral20
Sample
4ba637df90076330cdace697a87aafc6dd1d1b3a35b4ad924aad80aa7c3f4a9e
Resource
debian9-mipsbe
Behavioral task
behavioral21
Sample
4f8c1840d692d8248f3b7cb478acfbb7e65bdeecd64790a163eaa0db5592df06
Resource
ubuntu-amd64
Behavioral task
behavioral22
Sample
4f8c1840d692d8248f3b7cb478acfbb7e65bdeecd64790a163eaa0db5592df06
Resource
debian9-mipsel
Behavioral task
behavioral23
Sample
4f8c1840d692d8248f3b7cb478acfbb7e65bdeecd64790a163eaa0db5592df06
Resource
debian9-mipsbe
Behavioral task
behavioral24
Sample
623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772.vbs
Resource
win7v20210410
Behavioral task
behavioral25
Sample
623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772.vbs
Resource
win10v20210410
Behavioral task
behavioral26
Sample
65df637db227ff1685bdf82ab676de4ed70bffd4c96e6cde70d575217700083b
Resource
ubuntu-amd64
Behavioral task
behavioral27
Sample
65df637db227ff1685bdf82ab676de4ed70bffd4c96e6cde70d575217700083b
Resource
debian9-mipsel
Behavioral task
behavioral28
Sample
65df637db227ff1685bdf82ab676de4ed70bffd4c96e6cde70d575217700083b
Resource
debian9-mipsbe
Behavioral task
behavioral29
Sample
717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47.dll
Resource
win7v20210410
Behavioral task
behavioral30
Sample
717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47.dll
Resource
win10v20210410
Behavioral task
behavioral31
Sample
71ba20bdd899fde2a4e2967bc6c719f2c96146cc80c3dd8953431cb82d4df199.pps
Resource
win7v20210408
Behavioral task
behavioral32
Sample
71ba20bdd899fde2a4e2967bc6c719f2c96146cc80c3dd8953431cb82d4df199.pps
Resource
win10v20210410
General
-
Target
717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47.dll
-
Size
594KB
-
MD5
18104d225266e7754f27a413323425c4
-
SHA1
8e49c7b8ac4d81e757d919f545408e07eaba10c9
-
SHA256
717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47
-
SHA512
c96470045de5f84defb435d6b8fb127fc48b5a5b930507e9bdf6650015e36fd31bd1be57f22723cd202caaf27d987c4ede2aa7c9be7f22d1b9ae776f3d3a5c33
Malware Config
Extracted
trickbot
2000031
zev1
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2396 wermgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3972 wrote to memory of 1540 3972 regsvr32.exe regsvr32.exe PID 3972 wrote to memory of 1540 3972 regsvr32.exe regsvr32.exe PID 3972 wrote to memory of 1540 3972 regsvr32.exe regsvr32.exe PID 1540 wrote to memory of 2396 1540 regsvr32.exe wermgr.exe PID 1540 wrote to memory of 2396 1540 regsvr32.exe wermgr.exe PID 1540 wrote to memory of 2396 1540 regsvr32.exe wermgr.exe PID 1540 wrote to memory of 2396 1540 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1540-114-0x0000000000000000-mapping.dmp
-
memory/1540-115-0x0000000000E70000-0x0000000000EA7000-memory.dmpFilesize
220KB
-
memory/1540-118-0x0000000000B60000-0x0000000000D6E000-memory.dmpFilesize
2.1MB
-
memory/1540-119-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/1540-120-0x0000000000EB0000-0x0000000000EF3000-memory.dmpFilesize
268KB
-
memory/1540-121-0x0000000000B60000-0x0000000000D6E000-memory.dmpFilesize
2.1MB
-
memory/2396-122-0x0000000000000000-mapping.dmp
-
memory/2396-124-0x000001ECE46B0000-0x000001ECE46B1000-memory.dmpFilesize
4KB
-
memory/2396-123-0x000001ECE4670000-0x000001ECE4698000-memory.dmpFilesize
160KB