d3653992cbeaecd58a6fd47e178c6f8b7e60b54b3ec686d01841dedd4b744409

Submit
Reports

Overview

overview

Static

static

0d2cda8805...68.dll

windows7_x64

0d2cda8805...68.dll

windows10-2004_x64

0ee7590362...44.exe

windows7_x64

0ee7590362...44.exe

windows10-2004_x64

1ddb782ee3...18.exe

windows7_x64

1ddb782ee3...18.exe

windows10-2004_x64

41b4e93a1d...11.dll

windows7_x64

41b4e93a1d...11.dll

windows10-2004_x64

606c060979...b5.dll

windows7_x64

606c060979...b5.dll

windows10-2004_x64

72534ec2c4...77.dll

windows7_x64

72534ec2c4...77.dll

windows10-2004_x64

9da8a5a0b5...e1.dll

windows7_x64

9da8a5a0b5...e1.dll

windows10-2004_x64

b99e41eff1...70.dll

windows7_x64

b99e41eff1...70.dll

windows10-2004_x64

b9e0e806c7...5b.exe

windows7_x64

b9e0e806c7...5b.exe

windows10-2004_x64

d215aa40c0...59.dll

windows7_x64

d215aa40c0...59.dll

windows10-2004_x64

e2f6ac2c14...dc.dll

windows7_x64

e2f6ac2c14...dc.dll

windows10-2004_x64

e45cc54b2d...9d.dll

windows7_x64

e45cc54b2d...9d.dll

windows10-2004_x64

f1b9d5520b...73.dll

windows7_x64

f1b9d5520b...73.dll

windows10-2004_x64

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-06-2022 06:12

Sharing

Copy URL

Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

0d2cda88052d6a9feb73fd7383fb412f15a854f2af1d997dc1048a48edeeca68.dll

Resource

win7-20220414-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

0d2cda88052d6a9feb73fd7383fb412f15a854f2af1d997dc1048a48edeeca68.dll

Resource

win10v2004-20220414-en

trickbot mon159 banker packer trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral3

Sample

0ee7590362df39d54f390e2f5ae309d36f75961c992667ec34b1113fe405f344.exe

Resource

win7-20220414-en

trickbot lib108 banker trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral4

Sample

0ee7590362df39d54f390e2f5ae309d36f75961c992667ec34b1113fe405f344.exe

Resource

win10v2004-20220414-en

trickbot lib108 banker trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral5

Sample

1ddb782ee3b9f61cbdb87a1eb04f020de9e8febcea4d823b105c38d072f58818.exe

Resource

win7-20220414-en

trickbot tot108 banker trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral6

Sample

1ddb782ee3b9f61cbdb87a1eb04f020de9e8febcea4d823b105c38d072f58818.exe

Resource

win10v2004-20220414-en

trickbot tot108 banker trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral7

Sample

41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011.dll

Resource

win7-20220414-en

trickbot mon94 banker packer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral8

Sample

41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011.dll

Resource

win10v2004-20220414-en

trickbot mon94 banker packer trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral9

Sample

606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5.dll

Resource

win7-20220414-en

trickbot banker packer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral10

Sample

606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5.dll

Resource

win10v2004-20220414-en

trickbot mon148 banker packer trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral11

Sample

72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677.dll

Resource

win7-20220414-en

trickbot soc1 banker trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral12

Sample

72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677.dll

Resource

win10v2004-20220414-en

trickbot soc1 banker trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral13

Sample

9da8a5a0b5957db6112e927b607a8fd062b870f2132c4ae3442eb63235f789e1.dll

Resource

win7-20220414-en

trickbot rob109 banker trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral14

Sample

9da8a5a0b5957db6112e927b607a8fd062b870f2132c4ae3442eb63235f789e1.dll

Resource

win10v2004-20220414-en

trickbot rob109 banker suricata trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral15

Sample

b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70.dll

Resource

win7-20220414-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral16

Sample

b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70.dll

Resource

win10v2004-20220414-en

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral17

Sample

b9e0e806c71d915e3cc2401d4a0d0d1f5d4cf1f3eb15c93f862b07c416b1195b.exe

Resource

win7-20220414-en

trickbot tot108 banker trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral18

Sample

b9e0e806c71d915e3cc2401d4a0d0d1f5d4cf1f3eb15c93f862b07c416b1195b.exe

Resource

win10v2004-20220414-en

trickbot tot108 banker trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral19

Sample

d215aa40c0e512b7562cad4de5b0790d88facafcdef3f80484b08a50d0c47859.dll

Resource

win7-20220414-en

trickbot rob106 banker suricata trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral20

Sample

d215aa40c0e512b7562cad4de5b0790d88facafcdef3f80484b08a50d0c47859.dll

Resource

win10v2004-20220414-en

trickbot rob106 banker suricata trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral21

Sample

e2f6ac2c144bf28ac853c5dc3f3c4ce5ff08f42076c1d996c1ebb6362f9e66dc.dll

Resource

win7-20220414-en

trickbot mon92 banker packer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral22

Sample

e2f6ac2c144bf28ac853c5dc3f3c4ce5ff08f42076c1d996c1ebb6362f9e66dc.dll

Resource

win10v2004-20220414-en

trickbot mon92 banker packer trojan

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral23

Sample

e45cc54b2d0faaf9870ed2d7b4f7febd2cb4bc119e6989c23f29411085bd889d.dll

Resource

win7-20220414-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral24

Sample

e45cc54b2d0faaf9870ed2d7b4f7febd2cb4bc119e6989c23f29411085bd889d.dll

Resource

win10v2004-20220414-en

windows10-2004_x64

0 signatures

0 seconds

Behavioral task

behavioral25

Sample

f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.dll

Resource

win7-20220414-en

trickbot mon48 banker packer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral26

Sample

f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.dll

Resource

win10v2004-20220414-en

trickbot mon48 banker packer suricata trojan

windows10-2004_x64

0 signatures

0 seconds

Report Analysis Logs

General

Target

b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70.dll
Size

1.0MB
MD5

7e09c3d9ee6e83e7b6de694c4f72e129
SHA1

13019bf341f28165f6e4729a7d76ec4f3eab1ad6
SHA256

b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70
SHA512

6b40cc14805eeefb1a68afff2d72e78cc9924fe8a3dd212459b846ad2bd184fb4854f5d95efb7c9267205c485e189f0d1651e1930f4c62b3b875e904a7ae59a2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1580 wrote to memory of 1212	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1212	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1212	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1212	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1212	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1212	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1212	1580	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70.dll,#1
2⤵
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-54-0x0000000000000000-mapping.dmp

Download
memory/1212-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download