Analysis
-
max time kernel
132s -
max time network
136s -
resource
win7v191014
Task
task1
Sample
30ebf4174d1703dd66d867ba65cd015d3604c938.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
30ebf4174d1703dd66d867ba65cd015d3604c938.exe
Resource
win10v191014
0 signatures
General
-
Target
30ebf4174d1703dd66d867ba65cd015d3604c938
-
Sample
191018-9z5rvjxg6s
-
SHA256
cbf1bb0acfa0adf0cc63952e220e52c5215c74f84ec49c3fa00b476ba04dc59e
Score
N/A
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeTcbPrivilege 1952 svchost.exe -
Processes:
svchost.exedescription ioc pid process File created C:\Users\Admin\AppData\Roaming\netRest\settings.ini 1952 svchost.exe -
trickbot family
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
30ebf4174d1703dd66d867ba65cd015d3604c938.exe그길리그우그서리리즐우.exe그길리그우그서리리즐우.exepid process 1616 30ebf4174d1703dd66d867ba65cd015d3604c938.exe 1472 그길리그우그서리리즐우.exe 1608 그길리그우그서리리즐우.exe -
Loads dropped DLL 1 IoCs
Processes:
30ebf4174d1703dd66d867ba65cd015d3604c938.exepid process 1616 30ebf4174d1703dd66d867ba65cd015d3604c938.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
30ebf4174d1703dd66d867ba65cd015d3604c938.exe그길리그우그서리리즐우.exetaskeng.exe그길리그우그서리리즐우.exedescription pid process target process PID 1616 wrote to memory of 1472 1616 30ebf4174d1703dd66d867ba65cd015d3604c938.exe 그길리그우그서리리즐우.exe PID 1472 wrote to memory of 1108 1472 그길리그우그서리리즐우.exe svchost.exe PID 1988 wrote to memory of 1608 1988 taskeng.exe 그길리그우그서리리즐우.exe PID 1608 wrote to memory of 1952 1608 그길리그우그서리리즐우.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
그길리그우그서리리즐우.exe그길리그우그서리리즐우.exepid process 1472 그길리그우그서리리즐우.exe 1608 그길리그우그서리리즐우.exe -
Uses Task Scheduler COM API 1 TTPs 26 IoCs
Processes:
svchost.exesvchost.exedescription ioc pid process Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1108 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1108 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1108 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1108 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID 1108 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1108 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1108 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1108 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1108 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1108 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1108 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1108 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1108 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1108 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1952 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1952 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1952 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1952 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1952 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1952 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1952 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1952 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1952 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1952 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1952 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1952 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30ebf4174d1703dd66d867ba65cd015d3604c938.exe"C:\Users\Admin\AppData\Local\Temp\30ebf4174d1703dd66d867ba65cd015d3604c938.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616
-
C:\ProgramData\그길리그우그서리리즐우.exe"C:\ProgramData\그길리그우그서리리즐우.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Uses Task Scheduler COM API
PID:1108
-
C:\Windows\system32\taskeng.exetaskeng.exe {BBA9BBDD-33DC-455B-8070-75198B334CAE} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1988
-
C:\Users\Admin\AppData\Roaming\netRest\그길리그우그서리리즐우.exeC:\Users\Admin\AppData\Roaming\netRest\그길리그우그서리리즐우.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Trickbot persistence files
- Uses Task Scheduler COM API
PID:1952