truebot | bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9

Resubmissions

21/02/2023, 14:12

10/10/2022, 04:28

max time kernel
51s
max time network
52s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/02/2023, 14:12

Target
ovcfrnzu.dll
Size 687KB
Sample230221-rhvpmagh7v
SHA256 bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9
MD5 37e6904d84153d1435407f4669135134
SHA1 e4dd1f8fc4e44c8fd0e25242d994c4b59eed6939
SHA512 4208f016541c9868354733342f0e2813d3d0fe47de7a4f40766946172039ab1addcc6601c3dedf363cbe4f785c07cbf67b67830a3f88b3a6f17309010a8cf379
SSDEEP 12288:WJpOXg6QYZEEDBK51pF/0RP+xeQKg30xFAE4sLF8tW5XWQyYa7VROtv7:WSXgWYpFj+g39sLOtUyd7W1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

TrueBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/1700-55-0x0000000000210000-0x000000000026D000-memory.dmp	family_truebot

TrueBot, Silence.Downloader
A downloader attributed to Silence group first seen in 2017.
downloader truebot

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\NvTmRep_CrashReport2_{A2FE1952-0186-36D3-AAHC-B80CA35AH5B6}.job	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1404	1700	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1700	744	rundll32.exe	28
PID 744 wrote to memory of 1700	744	rundll32.exe	28
PID 744 wrote to memory of 1700	744	rundll32.exe	28
PID 744 wrote to memory of 1700	744	rundll32.exe	28
PID 744 wrote to memory of 1700	744	rundll32.exe	28
PID 744 wrote to memory of 1700	744	rundll32.exe	28
PID 744 wrote to memory of 1700	744	rundll32.exe	28
PID 1700 wrote to memory of 1404	1700	rundll32.exe	29
PID 1700 wrote to memory of 1404	1700	rundll32.exe	29
PID 1700 wrote to memory of 1404	1700	rundll32.exe	29
PID 1700 wrote to memory of 1404	1700	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 576
    3⤵
    - Program crash
    PID:1404

memory/1700-55-0x0000000000210000-0x000000000026D000-memory.dmp

Download