Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 13:06
Static task
static1
Behavioral task
behavioral1
Sample
be8c7560d3d223aa6c3dfce8da989c5dcc845466694f266da5a9b9d7ccb8644a.dll
Resource
win7-20240903-en
General
-
Target
be8c7560d3d223aa6c3dfce8da989c5dcc845466694f266da5a9b9d7ccb8644a.dll
-
Size
649KB
-
MD5
f417ee44492f1715e1019a73b73ffd2b
-
SHA1
6e473b1064b73084265cc3ec5d228a248d6322e3
-
SHA256
be8c7560d3d223aa6c3dfce8da989c5dcc845466694f266da5a9b9d7ccb8644a
-
SHA512
08c5c86d6d6d281851d251728e653a2bf51b1191d1dc7898ec3631a54b6a2aae9ded5095272a6e29347bb5f076d17ea7f08b8fda82c7be112abadff524b9772a
-
SSDEEP
12288:LR0JJhudrUtLpDwrEJKu+90vN8tLpDwrEJKu+90vo:LRVdYtLOrr2vN8tLOrr2vo
Malware Config
Extracted
trickbot
100017
sat1
178.72.192.20:443
103.124.145.98:443
45.5.152.39:443
114.7.240.222:443
85.248.1.126:443
94.183.237.101:443
146.196.121.219:443
89.37.1.2:443
94.142.179.77:443
177.221.39.161:443
85.175.171.246:443
103.12.160.164:443
180.178.106.50:443
94.142.179.179:443
46.209.140.220:443
123.231.149.122:443
123.231.149.123:443
182.160.116.190:443
131.0.112.122:443
116.0.6.110:443
103.101.104.229:443
88.150.240.129:443
103.242.104.68:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2332 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2068 1920 regsvr32.exe 31 PID 1920 wrote to memory of 2068 1920 regsvr32.exe 31 PID 1920 wrote to memory of 2068 1920 regsvr32.exe 31 PID 1920 wrote to memory of 2068 1920 regsvr32.exe 31 PID 1920 wrote to memory of 2068 1920 regsvr32.exe 31 PID 1920 wrote to memory of 2068 1920 regsvr32.exe 31 PID 1920 wrote to memory of 2068 1920 regsvr32.exe 31 PID 2068 wrote to memory of 2512 2068 regsvr32.exe 32 PID 2068 wrote to memory of 2512 2068 regsvr32.exe 32 PID 2068 wrote to memory of 2512 2068 regsvr32.exe 32 PID 2068 wrote to memory of 2512 2068 regsvr32.exe 32 PID 2068 wrote to memory of 2332 2068 regsvr32.exe 33 PID 2068 wrote to memory of 2332 2068 regsvr32.exe 33 PID 2068 wrote to memory of 2332 2068 regsvr32.exe 33 PID 2068 wrote to memory of 2332 2068 regsvr32.exe 33 PID 2068 wrote to memory of 2332 2068 regsvr32.exe 33 PID 2068 wrote to memory of 2332 2068 regsvr32.exe 33
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\be8c7560d3d223aa6c3dfce8da989c5dcc845466694f266da5a9b9d7ccb8644a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\be8c7560d3d223aa6c3dfce8da989c5dcc845466694f266da5a9b9d7ccb8644a.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2512
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-