Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 04:21
Static task
static1
Behavioral task
behavioral1
Sample
d9a52dcd6de626eb950e606826c89e5f8bdb5dad717c3fd8f610e09f55fec0a7.dll
Resource
win7-20241010-en
General
-
Target
d9a52dcd6de626eb950e606826c89e5f8bdb5dad717c3fd8f610e09f55fec0a7.dll
-
Size
508KB
-
MD5
8986d2586f15b71b9a77f6846ffcbc8c
-
SHA1
5c78597eccd04f70c02ad9345a686ebd80d972d9
-
SHA256
d9a52dcd6de626eb950e606826c89e5f8bdb5dad717c3fd8f610e09f55fec0a7
-
SHA512
2bf46fcc3404e2a773bbd1b40ee093a52ada7fb67757439e1f05c0218320c481d646e63a40f4a4112338664697dce5ed348e58d98ddc25dec8358a33b4258a24
-
SSDEEP
12288:rMGeVRE83xVOESLawOVP6hO9724GpBb33:rMGeVe83xVOKchO97SpR33
Malware Config
Extracted
trickbot
100019
soc1
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1096 2672 WerFault.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 4808 wermgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 216 wrote to memory of 2672 216 rundll32.exe rundll32.exe PID 216 wrote to memory of 2672 216 rundll32.exe rundll32.exe PID 216 wrote to memory of 2672 216 rundll32.exe rundll32.exe PID 2672 wrote to memory of 4776 2672 rundll32.exe cmd.exe PID 2672 wrote to memory of 4776 2672 rundll32.exe cmd.exe PID 2672 wrote to memory of 4776 2672 rundll32.exe cmd.exe PID 2672 wrote to memory of 4808 2672 rundll32.exe wermgr.exe PID 2672 wrote to memory of 4808 2672 rundll32.exe wermgr.exe PID 2672 wrote to memory of 4808 2672 rundll32.exe wermgr.exe PID 2672 wrote to memory of 4808 2672 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d9a52dcd6de626eb950e606826c89e5f8bdb5dad717c3fd8f610e09f55fec0a7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d9a52dcd6de626eb950e606826c89e5f8bdb5dad717c3fd8f610e09f55fec0a7.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:4776
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 6283⤵
- Program crash
PID:1096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2672 -ip 26721⤵PID:3064