Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
7d61dca8e20011d03534bd669f2cee7a.dll
Resource
win7-20231215-en
General
-
Target
7d61dca8e20011d03534bd669f2cee7a.dll
-
Size
544KB
-
MD5
7d61dca8e20011d03534bd669f2cee7a
-
SHA1
c449919c17f8247ecabcd361124c916c27d617ce
-
SHA256
16e8a4dadb46582efc7c1c526b4100455c14ab2f7a27a04d44fcca1c84c8bd87
-
SHA512
dbcf0346053bc0a4ea14687635006f75c6cff53e9713416e19432b8c323218ab7e28b7517e5e2a4ad95bafe42c2b88ae53e7bd26a01e779821a77e3e96067024
-
SSDEEP
6144:6nhWubOStZ6AbgmgwLp3gUhWeGtaOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXr/DGaXhu45pI3rep
Malware Config
Extracted
trickbot
100018
rob109
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4724 wermgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3148 wrote to memory of 1800 3148 rundll32.exe 84 PID 3148 wrote to memory of 1800 3148 rundll32.exe 84 PID 3148 wrote to memory of 1800 3148 rundll32.exe 84 PID 1800 wrote to memory of 3304 1800 rundll32.exe 85 PID 1800 wrote to memory of 3304 1800 rundll32.exe 85 PID 1800 wrote to memory of 3304 1800 rundll32.exe 85 PID 1800 wrote to memory of 4724 1800 rundll32.exe 86 PID 1800 wrote to memory of 4724 1800 rundll32.exe 86 PID 1800 wrote to memory of 4724 1800 rundll32.exe 86 PID 1800 wrote to memory of 4724 1800 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d61dca8e20011d03534bd669f2cee7a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d61dca8e20011d03534bd669f2cee7a.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:3304
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-