Analysis
-
max time kernel
101s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 17:58
Static task
static1
Behavioral task
behavioral1
Sample
f7d50ffb24b9a7802c4657e3dd871574.exe
Resource
win7-en-20210920
General
-
Target
f7d50ffb24b9a7802c4657e3dd871574.exe
-
Size
440KB
-
MD5
f7d50ffb24b9a7802c4657e3dd871574
-
SHA1
1d2b0641ac09a198f71e2b0e8e48351a6fca6674
-
SHA256
0983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
-
SHA512
ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
Malware Config
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/320-60-0x0000000001E10000-0x0000000001EA3000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
f8d60ffb24b9a8902c4768e3dd981684.exef8d60ffb24b9a8902c4768e3dd981684.exepid process 636 f8d60ffb24b9a8902c4768e3dd981684.exe 1076 f8d60ffb24b9a8902c4768e3dd981684.exe -
Loads dropped DLL 1 IoCs
Processes:
f7d50ffb24b9a7802c4657e3dd871574.exepid process 320 f7d50ffb24b9a7802c4657e3dd871574.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.amazonaws.com -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exef8d60ffb24b9a8902c4768e3dd981684.exedescription pid process Token: SeTakeOwnershipPrivilege 1892 svchost.exe Token: SeTcbPrivilege 1076 f8d60ffb24b9a8902c4768e3dd981684.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
f7d50ffb24b9a7802c4657e3dd871574.exef8d60ffb24b9a8902c4768e3dd981684.exepid process 320 f7d50ffb24b9a7802c4657e3dd871574.exe 636 f8d60ffb24b9a8902c4768e3dd981684.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f7d50ffb24b9a7802c4657e3dd871574.exef8d60ffb24b9a8902c4768e3dd981684.exedescription pid process target process PID 320 wrote to memory of 636 320 f7d50ffb24b9a7802c4657e3dd871574.exe f8d60ffb24b9a8902c4768e3dd981684.exe PID 320 wrote to memory of 636 320 f7d50ffb24b9a7802c4657e3dd871574.exe f8d60ffb24b9a8902c4768e3dd981684.exe PID 320 wrote to memory of 636 320 f7d50ffb24b9a7802c4657e3dd871574.exe f8d60ffb24b9a8902c4768e3dd981684.exe PID 320 wrote to memory of 636 320 f7d50ffb24b9a7802c4657e3dd871574.exe f8d60ffb24b9a8902c4768e3dd981684.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 636 wrote to memory of 1892 636 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7d50ffb24b9a7802c4657e3dd871574.exe"C:\Users\Admin\AppData\Local\Temp\f7d50ffb24b9a7802c4657e3dd871574.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeC:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {51AE7241-C038-44E9-B08E-80E0378100E5} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeC:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeMD5
f7d50ffb24b9a7802c4657e3dd871574
SHA11d2b0641ac09a198f71e2b0e8e48351a6fca6674
SHA2560983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
SHA512ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeMD5
f7d50ffb24b9a7802c4657e3dd871574
SHA11d2b0641ac09a198f71e2b0e8e48351a6fca6674
SHA2560983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
SHA512ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
-
\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeMD5
f7d50ffb24b9a7802c4657e3dd871574
SHA11d2b0641ac09a198f71e2b0e8e48351a6fca6674
SHA2560983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
SHA512ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
-
memory/320-54-0x00000000767F1000-0x00000000767F3000-memory.dmpFilesize
8KB
-
memory/320-59-0x00000000003F0000-0x00000000003F3000-memory.dmpFilesize
12KB
-
memory/320-60-0x0000000001E10000-0x0000000001EA3000-memory.dmpFilesize
588KB
-
memory/636-61-0x0000000010000000-0x0000000010001000-memory.dmpFilesize
4KB
-
memory/636-62-0x0000000010001000-0x0000000010004000-memory.dmpFilesize
12KB
-
memory/636-63-0x0000000010004000-0x0000000010005000-memory.dmpFilesize
4KB
-
memory/636-64-0x0000000010006000-0x0000000010007000-memory.dmpFilesize
4KB
-
memory/636-72-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/636-56-0x0000000000000000-mapping.dmp
-
memory/1076-88-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1076-74-0x0000000000000000-mapping.dmp
-
memory/1892-65-0x0000000000000000-mapping.dmp
-
memory/1892-69-0x000000014001E000-0x0000000140020000-memory.dmpFilesize
8KB
-
memory/1892-71-0x0000000140021000-0x0000000140022000-memory.dmpFilesize
4KB
-
memory/1892-73-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1892-70-0x0000000140020000-0x0000000140021000-memory.dmpFilesize
4KB
-
memory/1892-67-0x0000000140001000-0x0000000140016000-memory.dmpFilesize
84KB
-
memory/1892-68-0x0000000140016000-0x000000014001D000-memory.dmpFilesize
28KB
-
memory/1892-66-0x0000000140000000-0x0000000140001000-memory.dmpFilesize
4KB
-
memory/1928-81-0x0000000000000000-mapping.dmp