Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en -
submitted
13-09-2021 22:17
Static task
static1
Behavioral task
behavioral1
Sample
caDeEx.jpg.dll
Resource
win7-en
General
-
Target
caDeEx.jpg.dll
-
Size
564KB
-
MD5
d342499ba2e3adab152c4c7ed9ead426
-
SHA1
0b4d212ac06d26e3fbb7365322d4cb7c5487444b
-
SHA256
074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
-
SHA512
0ef2cde0d828559d8134a136a1e85797d99c95343dd9f3ec329defeba86a5adb99445448fc9c5346f5c2ec6a251d676618ac96e0cdf76317e2e6f1746dbda6b5
Malware Config
Extracted
trickbot
2000033
zev4
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1592 wermgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1188 wrote to memory of 1152 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1152 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1152 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1152 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1152 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1152 1188 regsvr32.exe regsvr32.exe PID 1188 wrote to memory of 1152 1188 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 1592 1152 regsvr32.exe wermgr.exe PID 1152 wrote to memory of 1592 1152 regsvr32.exe wermgr.exe PID 1152 wrote to memory of 1592 1152 regsvr32.exe wermgr.exe PID 1152 wrote to memory of 1592 1152 regsvr32.exe wermgr.exe PID 1152 wrote to memory of 1592 1152 regsvr32.exe wermgr.exe PID 1152 wrote to memory of 1592 1152 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\caDeEx.jpg.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\caDeEx.jpg.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1152-63-0x00000000001E0000-0x0000000000219000-memory.dmpFilesize
228KB
-
memory/1152-54-0x0000000000000000-mapping.dmp
-
memory/1152-55-0x00000000762A1000-0x00000000762A3000-memory.dmpFilesize
8KB
-
memory/1152-56-0x00000000009B0000-0x00000000009EB000-memory.dmpFilesize
236KB
-
memory/1152-59-0x0000000001E30000-0x0000000001E69000-memory.dmpFilesize
228KB
-
memory/1152-61-0x0000000001E70000-0x0000000001EA8000-memory.dmpFilesize
224KB
-
memory/1152-65-0x0000000000340000-0x0000000000351000-memory.dmpFilesize
68KB
-
memory/1152-64-0x0000000001EE0000-0x0000000001F25000-memory.dmpFilesize
276KB
-
memory/1152-66-0x0000000000231000-0x0000000000233000-memory.dmpFilesize
8KB
-
memory/1188-53-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmpFilesize
8KB
-
memory/1592-67-0x0000000000000000-mapping.dmp
-
memory/1592-68-0x0000000000060000-0x0000000000089000-memory.dmpFilesize
164KB
-
memory/1592-69-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB