Analysis
-
max time kernel
1772s -
max time network
1788s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
23-09-2021 12:59
Static task
static1
Behavioral task
behavioral1
Sample
a784f1a3c6d9391c65ffba7818168e25.dll
Resource
win7v20210408
General
-
Target
a784f1a3c6d9391c65ffba7818168e25.dll
-
Size
520KB
-
MD5
a784f1a3c6d9391c65ffba7818168e25
-
SHA1
f050b4bc1e583400fd687eb174770692753d1700
-
SHA256
0cea65ac6779cc107ee1f79ca5c7d70c8bd5027e02e567b7c597485ad175d277
-
SHA512
9927aa957101a024794d0c61ba7924ad0e2b34f8f4d5c28eac5ef9547605f816af21bb01cfc100dfd6bed3440b013ad27c16801aaf7e4fbe01da5333186220f1
Malware Config
Extracted
trickbot
100019
rob133
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
suricata: ET MALWARE Trickbot Checkin Response
suricata: ET MALWARE Trickbot Checkin Response
-
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 32 checkip.amazonaws.com -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3324 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 3972 svchost.exe 3972 svchost.exe 3668 svchost.exe 3668 svchost.exe 2124 svchost.exe 2124 svchost.exe 3668 svchost.exe 3668 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 316 wermgr.exe Token: SeDebugPrivilege 3972 svchost.exe Token: SeDebugPrivilege 3668 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exewermgr.exedescription pid process target process PID 2752 wrote to memory of 2740 2752 rundll32.exe rundll32.exe PID 2752 wrote to memory of 2740 2752 rundll32.exe rundll32.exe PID 2752 wrote to memory of 2740 2752 rundll32.exe rundll32.exe PID 2740 wrote to memory of 3848 2740 rundll32.exe cmd.exe PID 2740 wrote to memory of 3848 2740 rundll32.exe cmd.exe PID 2740 wrote to memory of 3848 2740 rundll32.exe cmd.exe PID 2740 wrote to memory of 316 2740 rundll32.exe wermgr.exe PID 2740 wrote to memory of 316 2740 rundll32.exe wermgr.exe PID 2740 wrote to memory of 316 2740 rundll32.exe wermgr.exe PID 2740 wrote to memory of 316 2740 rundll32.exe wermgr.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe PID 316 wrote to memory of 3972 316 wermgr.exe svchost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a784f1a3c6d9391c65ffba7818168e25.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a784f1a3c6d9391c65ffba7818168e25.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe/c ipconfig /all5⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
-
C:\Windows\system32\cmd.exe/c net config workstation5⤵
-
C:\Windows\system32\net.exenet config workstation6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation7⤵
-
C:\Windows\system32\cmd.exe/c net view /all5⤵
-
C:\Windows\system32\net.exenet view /all6⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c net view /all /domain5⤵
-
C:\Windows\system32\net.exenet view /all /domain6⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts5⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts6⤵
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts /all_trusts5⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-127-0x0000000000000000-mapping.dmp
-
memory/316-128-0x000001BF19450000-0x000001BF19478000-memory.dmpFilesize
160KB
-
memory/316-129-0x000001BF19660000-0x000001BF19661000-memory.dmpFilesize
4KB
-
memory/568-155-0x0000000000000000-mapping.dmp
-
memory/872-161-0x0000000000000000-mapping.dmp
-
memory/1464-157-0x0000000000000000-mapping.dmp
-
memory/1716-152-0x0000000000000000-mapping.dmp
-
memory/2124-145-0x0000000000000000-mapping.dmp
-
memory/2124-146-0x0000000180000000-0x000000018000A000-memory.dmpFilesize
40KB
-
memory/2248-160-0x0000000000000000-mapping.dmp
-
memory/2284-159-0x0000000000000000-mapping.dmp
-
memory/2740-126-0x00000000029F1000-0x00000000029F3000-memory.dmpFilesize
8KB
-
memory/2740-116-0x0000000002C80000-0x0000000002CBB000-memory.dmpFilesize
236KB
-
memory/2740-119-0x0000000002F80000-0x0000000002FB9000-memory.dmpFilesize
228KB
-
memory/2740-115-0x0000000000000000-mapping.dmp
-
memory/2740-121-0x00000000046C0000-0x00000000046F8000-memory.dmpFilesize
224KB
-
memory/2740-124-0x0000000004720000-0x0000000004764000-memory.dmpFilesize
272KB
-
memory/2740-125-0x0000000002CD0000-0x0000000002CD1000-memory.dmpFilesize
4KB
-
memory/2740-123-0x0000000002870000-0x00000000029BA000-memory.dmpFilesize
1.3MB
-
memory/2752-154-0x0000000000000000-mapping.dmp
-
memory/2768-158-0x0000000000000000-mapping.dmp
-
memory/3064-153-0x0000000000000000-mapping.dmp
-
memory/3204-151-0x0000000000000000-mapping.dmp
-
memory/3324-150-0x0000000000000000-mapping.dmp
-
memory/3668-139-0x0000000000000000-mapping.dmp
-
memory/3784-149-0x0000000000000000-mapping.dmp
-
memory/3788-156-0x0000000000000000-mapping.dmp
-
memory/3972-138-0x000001BF54410000-0x000001BF54411000-memory.dmpFilesize
4KB
-
memory/3972-132-0x0000000000000000-mapping.dmp