Overview

overview

10

Static

static

cdfee4284b...58.msi

windows7_x64

10

cdfee4284b...58.msi

windows10_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-11-2020 14:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cdfee4284b9ef2c76b7198c1e21118c19be395ac76d3485d50d0ff63faa21d58.msi

  • Size

    624KB

  • MD5

    e1d32800e12d4df430e9f016bfba70b3

  • SHA1

    2aadf50c972d6dcbd439896a2cb5446f4fa8eebc

  • SHA256

    cdfee4284b9ef2c76b7198c1e21118c19be395ac76d3485d50d0ff63faa21d58

  • SHA512

    870fdbdadefbfab69887c50b253270cce3ce9da90092b11a6d26bd4989a98182833f07be7836109ee2e157d698139c8ed1094cf2f53d4483458b50a04410da13

Score
10/10
trickbottar2bankerpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

100001

Botnet

tar2

C2

66.85.183.5:443

185.163.47.157:443

94.140.115.99:443

195.123.240.40:443

195.123.241.226:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Blacklisted process makes network request 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 72 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 165 IoCs
    persistence
  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 96 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cdfee4284b9ef2c76b7198c1e21118c19be395ac76d3485d50d0ff63faa21d58.msi
    1⤵
    • Blacklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:796
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Modifies service
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:3800
    • C:\Users\Admin\AppData\Local\Temp\MMMedia\MMMedia.exe
      C:\Users\Admin\AppData\Local\Temp\MMMedia\MMMedia.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3908
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4220
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Modifies service
    • Suspicious use of AdjustPrivilegeToken
    PID:200
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B
    MD5

    5750119e73733fa46e0e619bcc38c9e4

    SHA1

    f4676a5ed5b119ff1bc3159e7dfcb56ab9983a67

    SHA256

    9294e1ab3b124831317fc30d02523147abb8006a22b9f429106cc05ae358ab5d

    SHA512

    d67c1e47ecec9d849052d5dcceb4e60a7f99859bff5c86f41f1b07e6906e406105279c3934ddd59f98a4f0aca8d76fa25dddfd2ee4f3d4217bdc74168d5a3603

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_2EC831F712385997548A0475F2DAA8EC
    MD5

    483073b54bd6b8352dcdf5cd87c8c24f

    SHA1

    de2b9f3b81eb714517c869f5e16bf9754e558f25

    SHA256

    49a40c57ac173e259d2d8fc70d85c256ecbf20c7c8a21bb598b4060fd4d4f592

    SHA512

    16c278df57a33c389297d2d021ed033e2e0a74fd3ce22d04cb1e50e1e75d3452c4ab38fc415a6790e8ab24a7caa2259333a6ee64ca309162798014c061eb90f8

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
    MD5

    030fe87cfe5f6cd49739fdf70cbd3a5e

    SHA1

    5a2414fa9f2eae51e2bef9871e7cef0ebbdee0d2

    SHA256

    4df6f0a37708e36c68fe9eec2deedfe4f3f4fc7a311902209d2b399bd946ea5e

    SHA512

    0eb4798c3b34e1d5eb33675207bb85396fb54bef6d37f3617292f73299bc0d310e60db98eb8e5eaa28c01fe37b811f0b04731e68d1587095d9fb4fafcbc09a27

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B
    MD5

    79121847d966abd988dcdd3a9614558b

    SHA1

    50379bf8b187eda61a9afa5f4d2aae325902b902

    SHA256

    0379ed9a16c0a5cb780e03150915b792931c21578762b362d68fa6de24bfe86a

    SHA512

    7e57c202c7c0a878fbeae51f37bd4af04a58244fb1ac4167962ddb496af25d60c3939a53b00abbdfd7876df6c3c4818281cf8e3f3c248537c956b911b28acb8a

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_2EC831F712385997548A0475F2DAA8EC
    MD5

    34bd0fd017a7f514b7c60c206f3dc1e3

    SHA1

    9cf0bb90752caabf42ba6b9a3f49183ab97fa131

    SHA256

    ed837302d6e607861ccccd3f73325d4c5c6ea12f959ca457978c21fa69907740

    SHA512

    4e5d0ce9ff4eec083daee9aa4125d2b200389e659a8cd0f6418f4e1f541d953da516544c6969eafffc593aa945759edfa5cf573f1c113bcb6fe608528261e184

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
    MD5

    a9c84f6c494394ef43e261584be8c24b

    SHA1

    28615058c429c19909a93abf3bfe9a86ab90c7e4

    SHA256

    8241ae0c7a931dcff96081feae9d397133f0b12e7ea4f53494ae71144ec5ff06

    SHA512

    939f6a9588ab5f199393aa10138d3ca54aeec4807ee6f73b723f47fba682ad5d080b38c05a97acc6ddca50090a475cc9c895da16a62d1ee2108d29c24d7a42eb

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\MMMedia\MMMedia.exe
    MD5

    46a07ec480cd011dae44a527b478cce4

    SHA1

    21d83628819edcded2ca949c8c886526594847cd

    SHA256

    b4ad3c9c795d3d07eed4af3d337662a974e64315bb7edde82b6df25f4c09b32b

    SHA512

    ca1bce0427b4531f2d3960a49f734bbc61014627fac912a780b43d40b9db45c76801337d0086a1da464622aa05a6cc25e07c15bbef418826d40b78e6679e1e64

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\MMMedia\MMMedia.exe
    MD5

    46a07ec480cd011dae44a527b478cce4

    SHA1

    21d83628819edcded2ca949c8c886526594847cd

    SHA256

    b4ad3c9c795d3d07eed4af3d337662a974e64315bb7edde82b6df25f4c09b32b

    SHA512

    ca1bce0427b4531f2d3960a49f734bbc61014627fac912a780b43d40b9db45c76801337d0086a1da464622aa05a6cc25e07c15bbef418826d40b78e6679e1e64

    Download Submit
  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    MD5

    4fe1d0e62d7a70d9a8bef39650a5924a

    SHA1

    20bddd960d6f28390182b0609d868cf988a0ce8c

    SHA256

    80b620e2760b0ed28ecf4e30f3e7e3e351eaa7ccf207e2ddff19777f0f84e556

    SHA512

    26dcff758db14470891b079e2c6c459f269bfe355ccc14f5d5301238b6890240ec36193bbc128ed9109adbb26cde73fd1aa5f837470d076cacabf573aa524a08

    Download Submit
  • \??\Volume{f994966a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{7ad0faf7-c7b5-4fa3-a21e-d609eb2bebc4}_OnDiskSnapshotProp
    MD5

    e5a3bd95e8e87eaa65e6eaf5ed9acfb3

    SHA1

    6b9a748e798b289e8cdec53d2a062ca9641037a4

    SHA256

    dfa87f43cd4e4e300d384541342b0ddef374a19a1f98775731fdf3d616c048bb

    SHA512

    e87ed838c42838c03c88c4e301ecd6907a1cea805f10441d0ff49011edc9b45ae90a945ff3e21d2407fcd9e4955cc58a324d17e027a0f8732de78e7275214811

    Download Submit
  • memory/796-0-0x0000021D04560000-0x0000021D04564000-memory.dmp
    Filesize

    16KB

    Download
  • memory/796-19-0x0000021D01500000-0x0000021D01504000-memory.dmp
    Filesize

    16KB

    Download
  • memory/3800-2-0x0000000000000000-mapping.dmp
    Download
  • memory/3908-11-0x0000000000000000-mapping.dmp
    Download
  • memory/3908-14-0x00000000042F0000-0x000000000432E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3908-15-0x0000000004330000-0x000000000436A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/4220-18-0x0000000000000000-mapping.dmp
    Download