Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10_x64 -
resource
win10 -
submitted
24-08-2020 21:43
Static task
static1
Behavioral task
behavioral1
Sample
dilaryi8.exe
Resource
win7v200722
General
-
Target
dilaryi8.exe
-
Size
343KB
-
MD5
d02406a2b62215dc5d5a42e0c8e15f6e
-
SHA1
7ffa70f90eb6bf01b2b7f3b2fde2fbe93ba6acc4
-
SHA256
274170f2acf032561911675964fe1852e63e5af6bf97c3a76d6273cf7b5bf1c0
-
SHA512
c6879fa99d961dc1bfc07e136d89054ca94087ca8e3fa50b12b389c983b4e46eae6243cb756947e11eb62c458f8e8b9f652a3069c5ab738575a0c2bd844658b7
Malware Config
Extracted
trickbot
1000102
mac1
79.106.41.9:449
185.21.149.41:449
200.111.97.235:449
67.209.219.92:449
209.205.188.238:449
73.252.252.62:449
76.16.105.16:449
82.202.236.84:443
78.155.199.124:443
179.43.160.45:443
94.250.253.142:443
5.200.55.47:443
37.60.177.19:443
94.250.255.50:443
82.146.48.44:443
194.87.93.30:443
194.87.94.225:443
195.62.53.88:443
82.146.48.241:443
195.88.209.128:443
80.87.198.204:443
194.87.146.14:443
195.133.147.140:443
92.53.66.60:443
194.87.93.84:443
82.202.226.189:443
95.154.199.136:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
ejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exepid process 3932 ejmaryj8.exe 4020 ejmaryj8.exe 1916 ejmaryj8.exe 2112 ejmaryj8.exe 3900 ejmaryj8.exe 2180 ejmaryj8.exe -
Loads dropped DLL 4 IoCs
Processes:
dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exepid process 3020 dilaryi8.exe 3932 ejmaryj8.exe 1916 ejmaryj8.exe 3900 ejmaryj8.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 checkip.amazonaws.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exedescription pid process target process PID 3020 set thread context of 3852 3020 dilaryi8.exe dilaryi8.exe PID 3932 set thread context of 4020 3932 ejmaryj8.exe ejmaryj8.exe PID 1916 set thread context of 2112 1916 ejmaryj8.exe ejmaryj8.exe PID 3900 set thread context of 2180 3900 ejmaryj8.exe ejmaryj8.exe -
NSIS installer 14 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe nsis_installer_2 -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exepid process 3020 dilaryi8.exe 3932 ejmaryj8.exe 1916 ejmaryj8.exe 3900 ejmaryj8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
svchost.exeejmaryj8.exeejmaryj8.exedescription pid process Token: SeTakeOwnershipPrivilege 2776 svchost.exe Token: SeTcbPrivilege 2112 ejmaryj8.exe Token: SeTcbPrivilege 2180 ejmaryj8.exe -
Suspicious use of WriteProcessMemory 1417 IoCs
Processes:
dilaryi8.exedilaryi8.exeejmaryj8.exeejmaryj8.exedescription pid process target process PID 3020 wrote to memory of 3852 3020 dilaryi8.exe dilaryi8.exe PID 3020 wrote to memory of 3852 3020 dilaryi8.exe dilaryi8.exe PID 3020 wrote to memory of 3852 3020 dilaryi8.exe dilaryi8.exe PID 3020 wrote to memory of 3852 3020 dilaryi8.exe dilaryi8.exe PID 3852 wrote to memory of 3932 3852 dilaryi8.exe ejmaryj8.exe PID 3852 wrote to memory of 3932 3852 dilaryi8.exe ejmaryj8.exe PID 3852 wrote to memory of 3932 3852 dilaryi8.exe ejmaryj8.exe PID 3932 wrote to memory of 4020 3932 ejmaryj8.exe ejmaryj8.exe PID 3932 wrote to memory of 4020 3932 ejmaryj8.exe ejmaryj8.exe PID 3932 wrote to memory of 4020 3932 ejmaryj8.exe ejmaryj8.exe PID 3932 wrote to memory of 4020 3932 ejmaryj8.exe ejmaryj8.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe PID 4020 wrote to memory of 2776 4020 ejmaryj8.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exeC:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exeC:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SYSTEM32\svchost.exesvchost.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exeC:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1916 -
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exeC:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\SYSTEM32\svchost.exesvchost.exe3⤵
- Modifies data under HKEY_USERS
PID:2136
-
-
-
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exeC:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3900 -
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exeC:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\SYSTEM32\svchost.exesvchost.exe3⤵PID:2544
-
-