Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 07:50
Static task
static1
Behavioral task
behavioral1
Sample
c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.dll
Resource
win7-20240903-en
General
-
Target
c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.dll
-
Size
433KB
-
MD5
eb70b6c24c0466954169882dbe5729a4
-
SHA1
b81bcd8273854efb7d7b3fb5b982d75051a5d9a6
-
SHA256
c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240
-
SHA512
e90c5c958024734f089205e43f2c9a842e4fc68b8a7fcc7fc10754511a8b6bb724eab563bdd5141f9a1be634a3194f5b3abd14f97cdd0735c42f501d8f63e59f
-
SSDEEP
12288:mLseU1D6L/hAsEYhbdf6YMvkm2kJYcxpGJ1:mLlS6L/G2f6jv7dJYYpGJ1
Malware Config
Extracted
trickbot
2000029
net9
103.66.72.217:443
117.252.68.211:443
103.124.173.35:443
115.73.211.230:443
117.54.250.246:443
131.0.112.122:443
102.176.221.78:443
181.176.161.143:443
154.79.251.172:443
103.111.199.76:443
103.54.41.193:443
154.79.244.182:443
154.79.245.158:443
139.255.116.42:443
178.254.161.250:443
178.134.47.166:443
158.181.179.229:443
103.90.197.33:443
109.207.165.40:443
178.72.192.20:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
resource yara_rule behavioral2/memory/3576-0-0x0000000002370000-0x0000000002596000-memory.dmp templ_dll -
Program crash 1 IoCs
pid pid_target Process procid_target 3416 3576 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1940 wermgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1420 wrote to memory of 3576 1420 rundll32.exe 86 PID 1420 wrote to memory of 3576 1420 rundll32.exe 86 PID 1420 wrote to memory of 3576 1420 rundll32.exe 86 PID 3576 wrote to memory of 1940 3576 rundll32.exe 87 PID 3576 wrote to memory of 1940 3576 rundll32.exe 87 PID 3576 wrote to memory of 1940 3576 rundll32.exe 87 PID 3576 wrote to memory of 1940 3576 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 6603⤵
- Program crash
PID:3416
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3576 -ip 35761⤵PID:3232