Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 16:48
Static task
static1
Behavioral task
behavioral1
Sample
bb67713cb5733d091111f34dfde3a1723507b9f6ffe38257996bb0c906a677f3.dll
Resource
win7-20240708-en
General
-
Target
bb67713cb5733d091111f34dfde3a1723507b9f6ffe38257996bb0c906a677f3.dll
-
Size
640KB
-
MD5
c3a9b7357e462c207a4b64ea8ba2ecf0
-
SHA1
9fc3b2e8c963730f7c28427c3eb94aabe0001481
-
SHA256
bb67713cb5733d091111f34dfde3a1723507b9f6ffe38257996bb0c906a677f3
-
SHA512
4f9e54a6fe769bbe9cb292afa7cf1f70478a0e3f0b73dd5867edd7cd97d9653d2f8127461f2372c083c70c4b4e5293b561a65c38cc0cdb66422e31644e0c8f35
-
SSDEEP
12288:mp7J/EbHidy3vZ86lhXo0vCR2f9IwKsOuoWyae8sOTT/Fe:mp7NEudy3BhoIupac8sOTT/Fe
Malware Config
Extracted
trickbot
100018
sat2
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
Program crash 1 IoCs
pid pid_target Process procid_target 4064 2380 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1120 wermgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2380 1072 regsvr32.exe 83 PID 1072 wrote to memory of 2380 1072 regsvr32.exe 83 PID 1072 wrote to memory of 2380 1072 regsvr32.exe 83 PID 2380 wrote to memory of 4180 2380 regsvr32.exe 84 PID 2380 wrote to memory of 4180 2380 regsvr32.exe 84 PID 2380 wrote to memory of 4180 2380 regsvr32.exe 84 PID 2380 wrote to memory of 1120 2380 regsvr32.exe 85 PID 2380 wrote to memory of 1120 2380 regsvr32.exe 85 PID 2380 wrote to memory of 1120 2380 regsvr32.exe 85 PID 2380 wrote to memory of 1120 2380 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb67713cb5733d091111f34dfde3a1723507b9f6ffe38257996bb0c906a677f3.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\bb67713cb5733d091111f34dfde3a1723507b9f6ffe38257996bb0c906a677f3.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:4180
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 7043⤵
- Program crash
PID:4064
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2380 -ip 23801⤵PID:1268