truebot | bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9

Resubmissions

21/02/2023, 14:12

10/10/2022, 04:28

max time kernel
96s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2023, 14:12

Target
ovcfrnzu.dll
Size 687KB
Sample230221-rhvpmagh7v
SHA256 bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9
MD5 37e6904d84153d1435407f4669135134
SHA1 e4dd1f8fc4e44c8fd0e25242d994c4b59eed6939
SHA512 4208f016541c9868354733342f0e2813d3d0fe47de7a4f40766946172039ab1addcc6601c3dedf363cbe4f785c07cbf67b67830a3f88b3a6f17309010a8cf379
SSDEEP 12288:WJpOXg6QYZEEDBK51pF/0RP+xeQKg30xFAE4sLF8tW5XWQyYa7VROtv7:WSXgWYpFj+g39sLOtUyd7W1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

TrueBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4292-135-0x0000000000D00000-0x0000000000D5D000-memory.dmp	family_truebot

TrueBot, Silence.Downloader
A downloader attributed to Silence group first seen in 2017.
downloader truebot

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\NvTmRep_CrashReport2_{A2FE1952-0186-36D3-AAHC-B80CA35AH5B6}.job	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4592	4292	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4292	1660	rundll32.exe	81
PID 1660 wrote to memory of 4292	1660	rundll32.exe	81
PID 1660 wrote to memory of 4292	1660	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1080
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4292 -ip 4292
1⤵
PID:4540

memory/4292-135-0x0000000000D00000-0x0000000000D5D000-memory.dmp

Download