Resubmissions
23-11-2020 11:51
201123-ypblgj22k2 1020-11-2020 11:47
201120-y2cng92bq6 1020-11-2020 11:44
201120-5yd27gn712 10Analysis
-
max time kernel
1747s -
max time network
1747s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-11-2020 11:47
Static task
static1
General
-
Target
trick.dll
-
Size
272KB
-
MD5
5f7b5a98f75f4aa550e4368eb6dc9733
-
SHA1
d835a309e249f5d526529b9a28ed138b1bcfd40b
-
SHA256
c2c3bb003eb76cc5f1a9e2bc938c4254f4c4c3b2cc017e9a39d00a88f7ab181a
-
SHA512
167e5e1af1c82b9379d4a275f77b373969c0655d0b4f6ea32942d70f18b1147e65ef525e8f8f2d3d27c0ebf914785ce7b15e7808c3ca1700983bbc9eb318ebac
Malware Config
Extracted
trickbot
100003
rob7
102.164.206.129:449
103.131.156.21:449
103.131.157.102:449
103.131.157.161:449
103.146.232.5:449
103.150.68.124:449
103.156.126.232:449
103.30.85.157:449
103.52.47.20:449
-
autorunName:pwgrab
Signatures
-
Blacklisted process makes network request 1 IoCs
Processes:
cmd.exeflow pid process 36 1328 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 ident.me 21 ident.me -
Modifies service 2 TTPs 2 IoCs
Processes:
ipconfig.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe -
Drops file in Windows directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\notepad.exe regsvr32.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1584 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
cmd.execmd.exepid process 820 cmd.exe 1328 cmd.exe 820 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wermgr.execmd.exedescription pid process Token: SeDebugPrivilege 1768 wermgr.exe Token: SeDebugPrivilege 820 cmd.exe -
Suspicious use of WriteProcessMemory 721 IoCs
Processes:
regsvr32.exeregsvr32.exewermgr.exedescription pid process target process PID 2028 wrote to memory of 1628 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1628 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1628 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1628 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1628 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1628 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 1628 2028 regsvr32.exe regsvr32.exe PID 1628 wrote to memory of 1768 1628 regsvr32.exe wermgr.exe PID 1628 wrote to memory of 1768 1628 regsvr32.exe wermgr.exe PID 1628 wrote to memory of 1768 1628 regsvr32.exe wermgr.exe PID 1628 wrote to memory of 1768 1628 regsvr32.exe wermgr.exe PID 1628 wrote to memory of 1768 1628 regsvr32.exe wermgr.exe PID 1628 wrote to memory of 1768 1628 regsvr32.exe wermgr.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe PID 1768 wrote to memory of 820 1768 wermgr.exe cmd.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\trick.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\trick.dll2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:820 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1328 -
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Modifies service
- Gathers network information
PID:1584 -
C:\Windows\system32\net.exenet config workstation5⤵PID:2000
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation6⤵PID:1228
-
C:\Windows\system32\net.exenet view /all5⤵
- Discovers systems in the same network
PID:1848 -
C:\Windows\system32\net.exenet view /all /domain5⤵
- Discovers systems in the same network
PID:852 -
C:\Windows\system32\nltest.exenltest /domain_trusts5⤵PID:1964
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts5⤵PID:1580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/820-5-0x0000000000000000-mapping.dmp
-
memory/820-96-0x0000000000330000-0x0000000000330017-memory.dmpFilesize
23B
-
memory/820-17-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/820-18-0x0000000000330000-0x0000000000330017-memory.dmpFilesize
23B
-
memory/852-89-0x0000000000000000-mapping.dmp
-
memory/1228-87-0x0000000000000000-mapping.dmp
-
memory/1328-83-0x0000000000250000-0x0000000000250188-memory.dmpFilesize
392B
-
memory/1328-40-0x0000000000000000-mapping.dmp
-
memory/1328-95-0x0000000000230000-0x000000000023000D-memory.dmpFilesize
13B
-
memory/1328-93-0x0000000000250000-0x0000000000250188-memory.dmpFilesize
392B
-
memory/1328-50-0x0000000180000000-0x0000000180016000-memory.dmpFilesize
88KB
-
memory/1328-51-0x0000000000240000-0x0000000000240400-memory.dmpFilesize
1024B
-
memory/1328-52-0x0000000000230000-0x000000000023000D-memory.dmpFilesize
13B
-
memory/1328-48-0x0000000180000000-0x0000000180016000-memory.dmpFilesize
88KB
-
memory/1580-92-0x0000000000000000-mapping.dmp
-
memory/1584-84-0x0000000000000000-mapping.dmp
-
memory/1628-1-0x0000000000310000-0x000000000034A000-memory.dmpFilesize
232KB
-
memory/1628-2-0x0000000000550000-0x0000000000588000-memory.dmpFilesize
224KB
-
memory/1628-0-0x0000000000000000-mapping.dmp
-
memory/1628-3-0x0000000001DE0000-0x0000000001E16000-memory.dmpFilesize
216KB
-
memory/1768-4-0x0000000000000000-mapping.dmp
-
memory/1848-88-0x0000000000000000-mapping.dmp
-
memory/1964-91-0x0000000000000000-mapping.dmp
-
memory/2000-86-0x0000000000000000-mapping.dmp