Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
7d61dca8e20011d03534bd669f2cee7a.dll
Resource
win7-20231215-en
General
-
Target
7d61dca8e20011d03534bd669f2cee7a.dll
-
Size
544KB
-
MD5
7d61dca8e20011d03534bd669f2cee7a
-
SHA1
c449919c17f8247ecabcd361124c916c27d617ce
-
SHA256
16e8a4dadb46582efc7c1c526b4100455c14ab2f7a27a04d44fcca1c84c8bd87
-
SHA512
dbcf0346053bc0a4ea14687635006f75c6cff53e9713416e19432b8c323218ab7e28b7517e5e2a4ad95bafe42c2b88ae53e7bd26a01e779821a77e3e96067024
-
SSDEEP
6144:6nhWubOStZ6AbgmgwLp3gUhWeGtaOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXr/DGaXhu45pI3rep
Malware Config
Extracted
trickbot
100018
rob109
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2696 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1816 1840 rundll32.exe 28 PID 1840 wrote to memory of 1816 1840 rundll32.exe 28 PID 1840 wrote to memory of 1816 1840 rundll32.exe 28 PID 1840 wrote to memory of 1816 1840 rundll32.exe 28 PID 1840 wrote to memory of 1816 1840 rundll32.exe 28 PID 1840 wrote to memory of 1816 1840 rundll32.exe 28 PID 1840 wrote to memory of 1816 1840 rundll32.exe 28 PID 1816 wrote to memory of 2732 1816 rundll32.exe 29 PID 1816 wrote to memory of 2732 1816 rundll32.exe 29 PID 1816 wrote to memory of 2732 1816 rundll32.exe 29 PID 1816 wrote to memory of 2732 1816 rundll32.exe 29 PID 1816 wrote to memory of 2696 1816 rundll32.exe 30 PID 1816 wrote to memory of 2696 1816 rundll32.exe 30 PID 1816 wrote to memory of 2696 1816 rundll32.exe 30 PID 1816 wrote to memory of 2696 1816 rundll32.exe 30 PID 1816 wrote to memory of 2696 1816 rundll32.exe 30 PID 1816 wrote to memory of 2696 1816 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d61dca8e20011d03534bd669f2cee7a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d61dca8e20011d03534bd669f2cee7a.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2732
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-