Analysis
-
max time kernel
126s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 17:54
Static task
static1
Behavioral task
behavioral1
Sample
e23eb97093080ea94f494631b59d0e9baa860bbacb5f7b970b20339186ebdea3.dll
Resource
win7-20220812-en
General
-
Target
e23eb97093080ea94f494631b59d0e9baa860bbacb5f7b970b20339186ebdea3.dll
-
Size
347KB
-
MD5
f29c32025fee487c7bbbf3e23ad04ead
-
SHA1
90ae88e6edd4159d4be6edfcb25ec42af6b98523
-
SHA256
e23eb97093080ea94f494631b59d0e9baa860bbacb5f7b970b20339186ebdea3
-
SHA512
7f63fbbe608f2db73e98d0389b296f125f11c23375f0fdc023dc399e36fec396680769f4f7344fd05a52282934e493b9ae61b69b2c6b6fb9e86558ece76c5153
-
SSDEEP
6144:nehCU2WtxIp8CblMs7pwg1ham082O8p9p+fDxV3GPAyt4ZbwK7GeI:naCU2QE8CblMs7px4m039p+LOAA4uKCv
Malware Config
Extracted
trickbot
100011
mon68
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
-
autorunName:pwgrab
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1652-56-0x00000000001F0000-0x0000000000227000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1864 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1588 wrote to memory of 1652 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1652 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1652 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1652 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1652 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1652 1588 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1652 1588 rundll32.exe rundll32.exe PID 1652 wrote to memory of 1396 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1396 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1396 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1396 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1864 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1864 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1864 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1864 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1864 1652 rundll32.exe wermgr.exe PID 1652 wrote to memory of 1864 1652 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e23eb97093080ea94f494631b59d0e9baa860bbacb5f7b970b20339186ebdea3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e23eb97093080ea94f494631b59d0e9baa860bbacb5f7b970b20339186ebdea3.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1652-54-0x0000000000000000-mapping.dmp
-
memory/1652-55-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/1652-56-0x00000000001F0000-0x0000000000227000-memory.dmpFilesize
220KB
-
memory/1652-57-0x0000000000270000-0x00000000002B1000-memory.dmpFilesize
260KB
-
memory/1652-60-0x0000000000270000-0x00000000002B1000-memory.dmpFilesize
260KB
-
memory/1864-58-0x0000000000000000-mapping.dmp
-
memory/1864-59-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/1864-61-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB