Analysis
-
max time kernel
39s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll
Resource
win7-20220414-en
General
-
Target
cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll
-
Size
413KB
-
MD5
a09bfbcac469ccb01588d5dad416e23a
-
SHA1
c3dbbc8bfa5e82622a1a8df01a48c876736b48d5
-
SHA256
cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f
-
SHA512
047d0a776cb4dc5e2936337786c4fb63b130bd3203c9a5e02e123d1b162a67097e94d52c138fc6d3775036ad7b4fcb726ed57c767526fb7baffef3e354a58f0e
Malware Config
Extracted
trickbot
1000513
po2
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
-
autorunName:pwgrab
Signatures
-
Processes:
resource yara_rule behavioral1/memory/952-57-0x0000000000210000-0x000000000023C000-memory.dmp templ_dll behavioral1/memory/952-61-0x00000000001A0000-0x00000000001C9000-memory.dmp templ_dll -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8EE49D1-02E4-472F-B55D-D3FC30F70DE6}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8EE49D1-02E4-472F-B55D-D3FC30F70DE6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8EE49D1-02E4-472F-B55D-D3FC30F70DE6}\ = "Device Property Sheet" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8EE49D1-02E4-472F-B55D-D3FC30F70DE6}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F8EE49D1-02E4-472F-B55D-D3FC30F70DE6}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1732 wrote to memory of 952 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 952 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 952 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 952 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 952 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 952 1732 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 952 1732 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll2⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-55-0x0000000000000000-mapping.dmp
-
memory/952-56-0x00000000755C1000-0x00000000755C3000-memory.dmpFilesize
8KB
-
memory/952-57-0x0000000000210000-0x000000000023C000-memory.dmpFilesize
176KB
-
memory/952-61-0x00000000001A0000-0x00000000001C9000-memory.dmpFilesize
164KB
-
memory/1732-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmpFilesize
8KB