Analysis
-
max time kernel
105s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll
Resource
win7-20220414-en
General
-
Target
cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll
-
Size
413KB
-
MD5
a09bfbcac469ccb01588d5dad416e23a
-
SHA1
c3dbbc8bfa5e82622a1a8df01a48c876736b48d5
-
SHA256
cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f
-
SHA512
047d0a776cb4dc5e2936337786c4fb63b130bd3203c9a5e02e123d1b162a67097e94d52c138fc6d3775036ad7b4fcb726ed57c767526fb7baffef3e354a58f0e
Malware Config
Extracted
trickbot
1000513
po2
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
-
autorunName:pwgrab
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1452-131-0x0000000000D10000-0x0000000000D3C000-memory.dmp templ_dll behavioral2/memory/1452-136-0x0000000000CE0000-0x0000000000D09000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 3048 wermgr.exe Token: SeDebugPrivilege 3048 wermgr.exe Token: SeDebugPrivilege 3048 wermgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 4776 wrote to memory of 1452 4776 regsvr32.exe regsvr32.exe PID 4776 wrote to memory of 1452 4776 regsvr32.exe regsvr32.exe PID 4776 wrote to memory of 1452 4776 regsvr32.exe regsvr32.exe PID 1452 wrote to memory of 3048 1452 regsvr32.exe wermgr.exe PID 1452 wrote to memory of 3048 1452 regsvr32.exe wermgr.exe PID 1452 wrote to memory of 3048 1452 regsvr32.exe wermgr.exe PID 1452 wrote to memory of 3048 1452 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cd777155fcae88b74e97731dc1ee45fc5cf7d81b1b300a4db5483a44316f347f.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1452-130-0x0000000000000000-mapping.dmp
-
memory/1452-131-0x0000000000D10000-0x0000000000D3C000-memory.dmpFilesize
176KB
-
memory/1452-136-0x0000000000CE0000-0x0000000000D09000-memory.dmpFilesize
164KB
-
memory/1452-137-0x0000000000D90000-0x0000000000DC9000-memory.dmpFilesize
228KB
-
memory/3048-135-0x0000000000000000-mapping.dmp
-
memory/3048-138-0x000001D2DD1F0000-0x000001D2DD210000-memory.dmpFilesize
128KB