Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 00:50
Static task
static1
Behavioral task
behavioral1
Sample
7e71cbafddda3ed366349aee8e49c4dd.dll
Resource
win7-20231129-en
General
-
Target
7e71cbafddda3ed366349aee8e49c4dd.dll
-
Size
388KB
-
MD5
7e71cbafddda3ed366349aee8e49c4dd
-
SHA1
2de41b9dc0bf8a84de90ed599c4e2e9cf58f3b3e
-
SHA256
c52cfe80176df32d24ea1417e79f1fc62797acbb97ccddadf2135f0101907e5b
-
SHA512
d2e5fdd6249aadec259c3603219fb2c7061da1166d82e0608401229e18a0b38992e9f23f10f90d385bcfa6e5a4560990eb95cc861c3e141a05cb5c05daceffa7
-
SSDEEP
6144:vW3hPbF9A3hAfKKC64zROB6NBbTN+qGfhI6zSRZKhoRli2fFzs:vWRjAhAfKbRO6NBbTMp/STKhoHi2fFzs
Malware Config
Extracted
trickbot
100019
rob122
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3060 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2860 2420 rundll32.exe 28 PID 2420 wrote to memory of 2860 2420 rundll32.exe 28 PID 2420 wrote to memory of 2860 2420 rundll32.exe 28 PID 2420 wrote to memory of 2860 2420 rundll32.exe 28 PID 2420 wrote to memory of 2860 2420 rundll32.exe 28 PID 2420 wrote to memory of 2860 2420 rundll32.exe 28 PID 2420 wrote to memory of 2860 2420 rundll32.exe 28 PID 2860 wrote to memory of 964 2860 rundll32.exe 29 PID 2860 wrote to memory of 964 2860 rundll32.exe 29 PID 2860 wrote to memory of 964 2860 rundll32.exe 29 PID 2860 wrote to memory of 964 2860 rundll32.exe 29 PID 2860 wrote to memory of 3060 2860 rundll32.exe 30 PID 2860 wrote to memory of 3060 2860 rundll32.exe 30 PID 2860 wrote to memory of 3060 2860 rundll32.exe 30 PID 2860 wrote to memory of 3060 2860 rundll32.exe 30 PID 2860 wrote to memory of 3060 2860 rundll32.exe 30 PID 2860 wrote to memory of 3060 2860 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7e71cbafddda3ed366349aee8e49c4dd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7e71cbafddda3ed366349aee8e49c4dd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:964
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-