Resubmissions
23-11-2020 11:51
201123-ypblgj22k2 1020-11-2020 11:47
201120-y2cng92bq6 1020-11-2020 11:44
201120-5yd27gn712 10Analysis
-
max time kernel
1721s -
max time network
1787s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-11-2020 11:51
Static task
static1
Behavioral task
behavioral1
Sample
trick.dll
Resource
win7v20201028
General
-
Target
trick.dll
-
Size
272KB
-
MD5
5f7b5a98f75f4aa550e4368eb6dc9733
-
SHA1
d835a309e249f5d526529b9a28ed138b1bcfd40b
-
SHA256
c2c3bb003eb76cc5f1a9e2bc938c4254f4c4c3b2cc017e9a39d00a88f7ab181a
-
SHA512
167e5e1af1c82b9379d4a275f77b373969c0655d0b4f6ea32942d70f18b1147e65ef525e8f8f2d3d27c0ebf914785ce7b15e7808c3ca1700983bbc9eb318ebac
Malware Config
Extracted
trickbot
100003
rob7
102.164.206.129:449
103.131.156.21:449
103.131.157.102:449
103.131.157.161:449
103.146.232.5:449
103.150.68.124:449
103.156.126.232:449
103.30.85.157:449
103.52.47.20:449
-
autorunName:pwgrab
Signatures
-
Blacklisted process makes network request 1 IoCs
Processes:
cmd.exeflow pid process 33 1280 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ipecho.net -
Modifies service 2 TTPs 2 IoCs
Processes:
ipconfig.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe -
Drops file in Windows directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\notepad.exe regsvr32.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1908 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
cmd.execmd.exepid process 524 cmd.exe 1280 cmd.exe 524 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wermgr.execmd.exedescription pid process Token: SeDebugPrivilege 1784 wermgr.exe Token: SeDebugPrivilege 524 cmd.exe -
Suspicious use of WriteProcessMemory 721 IoCs
Processes:
regsvr32.exeregsvr32.exewermgr.exedescription pid process target process PID 1680 wrote to memory of 884 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 884 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 884 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 884 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 884 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 884 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 884 1680 regsvr32.exe regsvr32.exe PID 884 wrote to memory of 1784 884 regsvr32.exe wermgr.exe PID 884 wrote to memory of 1784 884 regsvr32.exe wermgr.exe PID 884 wrote to memory of 1784 884 regsvr32.exe wermgr.exe PID 884 wrote to memory of 1784 884 regsvr32.exe wermgr.exe PID 884 wrote to memory of 1784 884 regsvr32.exe wermgr.exe PID 884 wrote to memory of 1784 884 regsvr32.exe wermgr.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe PID 1784 wrote to memory of 524 1784 wermgr.exe cmd.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\trick.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\trick.dll2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Modifies service
- Gathers network information
-
C:\Windows\system32\net.exenet config workstation5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation6⤵
-
C:\Windows\system32\net.exenet view /all5⤵
- Discovers systems in the same network
-
C:\Windows\system32\net.exenet view /all /domain5⤵
- Discovers systems in the same network
-
C:\Windows\system32\nltest.exenltest /domain_trusts5⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-103-0x0000000000230000-0x0000000000230013-memory.dmpFilesize
19B
-
memory/524-5-0x0000000000000000-mapping.dmp
-
memory/524-18-0x0000000000230000-0x0000000000230013-memory.dmpFilesize
19B
-
memory/524-17-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/884-0-0x0000000000000000-mapping.dmp
-
memory/884-1-0x0000000000220000-0x000000000025A000-memory.dmpFilesize
232KB
-
memory/884-2-0x0000000000260000-0x0000000000298000-memory.dmpFilesize
224KB
-
memory/884-3-0x0000000000540000-0x0000000000576000-memory.dmpFilesize
216KB
-
memory/1096-93-0x0000000000000000-mapping.dmp
-
memory/1104-95-0x0000000000000000-mapping.dmp
-
memory/1280-53-0x0000000000140000-0x0000000000140400-memory.dmpFilesize
1024B
-
memory/1280-48-0x0000000180000000-0x0000000180016000-memory.dmpFilesize
88KB
-
memory/1280-50-0x0000000180000000-0x0000000180016000-memory.dmpFilesize
88KB
-
memory/1280-54-0x0000000000130000-0x000000000013000D-memory.dmpFilesize
13B
-
memory/1280-85-0x00000000003B0000-0x00000000003B0058-memory.dmpFilesize
88B
-
memory/1280-90-0x0000000000190000-0x0000000000190080-memory.dmpFilesize
128B
-
memory/1280-102-0x0000000000130000-0x000000000013000D-memory.dmpFilesize
13B
-
memory/1280-51-0x00000000003B0000-0x00000000003B0058-memory.dmpFilesize
88B
-
memory/1280-100-0x0000000000190000-0x0000000000190080-memory.dmpFilesize
128B
-
memory/1280-40-0x0000000000000000-mapping.dmp
-
memory/1352-99-0x0000000000000000-mapping.dmp
-
memory/1444-94-0x0000000000000000-mapping.dmp
-
memory/1524-98-0x0000000000000000-mapping.dmp
-
memory/1784-4-0x0000000000000000-mapping.dmp
-
memory/1908-91-0x0000000000000000-mapping.dmp
-
memory/1932-96-0x0000000000000000-mapping.dmp