Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 19:53
Static task
static1
Behavioral task
behavioral1
Sample
faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe
Resource
win7-20240903-en
General
-
Target
faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe
-
Size
678KB
-
MD5
26aca67e755b79679663436a4996ddbf
-
SHA1
92aaef7ce303ad5aeeb09c0acd38be75affc6f2d
-
SHA256
faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350
-
SHA512
bd98a1712a883632374b028eaf0a615709319571effdf569249f483c1fe0ff86f14370026f18ea9e42fbf2aa772a27da8ba318d7919dff2dd282be300d401ebc
-
SSDEEP
12288:uqluOGXcc5O95gTHGJGxc/Mi1qF6gnc4DYTP3EEyB7u/adsNDQmTHzRXy2EGkGux:uOu1CwamU+svEEs5sNDpTRXPhA
Malware Config
Extracted
trickbot
1000514
mor125
51.89.163.40:443
89.223.126.186:443
45.67.231.68:443
148.251.185.165:443
194.87.110.144:443
213.32.84.27:443
185.234.72.35:443
45.89.125.148:443
195.123.240.104:443
185.99.2.243:443
5.182.211.223:443
195.123.240.113:443
85.204.116.173:443
5.152.210.188:443
103.36.48.103:449
36.94.33.102:449
36.91.87.227:449
177.190.69.162:449
103.76.169.213:449
179.97.246.23:449
200.24.67.161:449
181.143.186.42:449
190.99.97.42:449
179.127.88.41:449
117.252.214.138:449
117.222.63.145:449
45.224.213.234:449
45.237.241.97:449
125.165.20.104:449
-
autorunName:pwgrab
Signatures
-
Trickbot family
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
resource yara_rule behavioral2/memory/2812-4-0x0000000000680000-0x00000000006B6000-memory.dmp dave -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2812 faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe 2812 faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3504 wermgr.exe Token: SeDebugPrivilege 3504 wermgr.exe Token: SeDebugPrivilege 3504 wermgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2812 wrote to memory of 3504 2812 faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe 85 PID 2812 wrote to memory of 3504 2812 faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe 85 PID 2812 wrote to memory of 3504 2812 faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe 85 PID 2812 wrote to memory of 3504 2812 faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe"C:\Users\Admin\AppData\Local\Temp\faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3504
-