Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 23:53
Static task
static1
Behavioral task
behavioral1
Sample
fad27b4549f33c4f8c244b87fc8b043d439f4a5a41b4a04fb2317ffed85aca51.dll
Resource
win7-20241010-en
General
-
Target
fad27b4549f33c4f8c244b87fc8b043d439f4a5a41b4a04fb2317ffed85aca51.dll
-
Size
652KB
-
MD5
3f246bfe93a42d7054ff6f1138833ef4
-
SHA1
c15aa8a9caf13c2e6927aee3f471be0e2bcc3f56
-
SHA256
fad27b4549f33c4f8c244b87fc8b043d439f4a5a41b4a04fb2317ffed85aca51
-
SHA512
0a3bd87790d390829205ea2e27a84f08b3d0468b10576a007d8f85491fff64452532835e38ef7310899eec6732223404d69760591eca2bade17163fb94c3ab2e
-
SSDEEP
12288:P5g4A5St8G5/TMDhdLURcZdE+AoMmFspMoZZN3DT:+4A5SX5TMNdDI+BFOzT
Malware Config
Extracted
trickbot
100019
soh1
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
Program crash 1 IoCs
pid pid_target Process procid_target 1924 4320 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3908 wermgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1668 wrote to memory of 4320 1668 rundll32.exe 83 PID 1668 wrote to memory of 4320 1668 rundll32.exe 83 PID 1668 wrote to memory of 4320 1668 rundll32.exe 83 PID 4320 wrote to memory of 2096 4320 rundll32.exe 84 PID 4320 wrote to memory of 2096 4320 rundll32.exe 84 PID 4320 wrote to memory of 2096 4320 rundll32.exe 84 PID 4320 wrote to memory of 3908 4320 rundll32.exe 85 PID 4320 wrote to memory of 3908 4320 rundll32.exe 85 PID 4320 wrote to memory of 3908 4320 rundll32.exe 85 PID 4320 wrote to memory of 3908 4320 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fad27b4549f33c4f8c244b87fc8b043d439f4a5a41b4a04fb2317ffed85aca51.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fad27b4549f33c4f8c244b87fc8b043d439f4a5a41b4a04fb2317ffed85aca51.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2096
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 6763⤵
- Program crash
PID:1924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4320 -ip 43201⤵PID:3124