Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    24-08-2020 21:43

General

  • Target

    dilaryi8.exe

  • Size

    343KB

  • MD5

    d02406a2b62215dc5d5a42e0c8e15f6e

  • SHA1

    7ffa70f90eb6bf01b2b7f3b2fde2fbe93ba6acc4

  • SHA256

    274170f2acf032561911675964fe1852e63e5af6bf97c3a76d6273cf7b5bf1c0

  • SHA512

    c6879fa99d961dc1bfc07e136d89054ca94087ca8e3fa50b12b389c983b4e46eae6243cb756947e11eb62c458f8e8b9f652a3069c5ab738575a0c2bd844658b7

Malware Config

Extracted

Family

trickbot

Version

1000102

Botnet

mac1

C2

79.106.41.9:449

185.21.149.41:449

200.111.97.235:449

67.209.219.92:449

209.205.188.238:449

73.252.252.62:449

76.16.105.16:449

82.202.236.84:443

78.155.199.124:443

179.43.160.45:443

94.250.253.142:443

5.200.55.47:443

37.60.177.19:443

94.250.255.50:443

82.146.48.44:443

194.87.93.30:443

194.87.94.225:443

195.62.53.88:443

82.146.48.241:443

195.88.209.128:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Windows security bypass 2 TTPs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • NSIS installer 14 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 1417 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe
    "C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe
      "C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
        C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
          C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4020
          • C:\Windows\SYSTEM32\svchost.exe
            svchost.exe
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2776
  • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    PID:1916
    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
      C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
      • C:\Windows\SYSTEM32\svchost.exe
        svchost.exe
        3⤵
        • Modifies data under HKEY_USERS
        PID:2136
  • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    PID:3900
    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
      C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
      • C:\Windows\SYSTEM32\svchost.exe
        svchost.exe
        3⤵
          PID:2544

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ZjUOw

    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

    • C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

    • C:\Windows\TEMP\ZjUOw

    • \Users\Admin\AppData\Local\Temp\nsl274A.tmp\System.dll

    • \Users\Admin\AppData\Local\Temp\nsr154.tmp\System.dll

    • \Windows\Temp\nsa236D.tmp\System.dll

    • \Windows\Temp\nsj1D4E.tmp\System.dll

    • memory/1916-23-0x0000000000F50000-0x0000000000F8D000-memory.dmp

      Filesize

      244KB

    • memory/2112-20-0x0000000000401B70-mapping.dmp

    • memory/2136-24-0x0000000000000000-mapping.dmp

    • memory/2180-30-0x0000000000401B70-mapping.dmp

    • memory/2544-34-0x0000000000000000-mapping.dmp

    • memory/2776-16-0x0000000140000000-0x0000000140022000-memory.dmp

      Filesize

      136KB

    • memory/2776-15-0x0000000000000000-mapping.dmp

    • memory/3020-4-0x0000000008FD0000-0x000000000900D000-memory.dmp

      Filesize

      244KB

    • memory/3852-3-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3852-2-0x0000000000401B70-mapping.dmp

    • memory/3852-1-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3932-5-0x0000000000000000-mapping.dmp

    • memory/4020-11-0x0000000000401B70-mapping.dmp