Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 17:58
Static task
static1
Behavioral task
behavioral1
Sample
f7d50ffb24b9a7802c4657e3dd871574.exe
Resource
win7-en-20210920
General
-
Target
f7d50ffb24b9a7802c4657e3dd871574.exe
-
Size
440KB
-
MD5
f7d50ffb24b9a7802c4657e3dd871574
-
SHA1
1d2b0641ac09a198f71e2b0e8e48351a6fca6674
-
SHA256
0983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
-
SHA512
ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
Malware Config
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/3584-119-0x0000000003050000-0x00000000030E3000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
f8d60ffb24b9a8902c4768e3dd981684.exef8d60ffb24b9a8902c4768e3dd981684.exef8d60ffb24b9a8902c4768e3dd981684.exepid process 4048 f8d60ffb24b9a8902c4768e3dd981684.exe 2260 f8d60ffb24b9a8902c4768e3dd981684.exe 1268 f8d60ffb24b9a8902c4768e3dd981684.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 wtfismyip.com -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe -
Modifies data under HKEY_USERS 42 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
svchost.exef8d60ffb24b9a8902c4768e3dd981684.exef8d60ffb24b9a8902c4768e3dd981684.exedescription pid process Token: SeTakeOwnershipPrivilege 368 svchost.exe Token: SeTcbPrivilege 2260 f8d60ffb24b9a8902c4768e3dd981684.exe Token: SeTcbPrivilege 1268 f8d60ffb24b9a8902c4768e3dd981684.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
f7d50ffb24b9a7802c4657e3dd871574.exef8d60ffb24b9a8902c4768e3dd981684.exepid process 3584 f7d50ffb24b9a7802c4657e3dd871574.exe 4048 f8d60ffb24b9a8902c4768e3dd981684.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f7d50ffb24b9a7802c4657e3dd871574.exef8d60ffb24b9a8902c4768e3dd981684.exedescription pid process target process PID 3584 wrote to memory of 4048 3584 f7d50ffb24b9a7802c4657e3dd871574.exe f8d60ffb24b9a8902c4768e3dd981684.exe PID 3584 wrote to memory of 4048 3584 f7d50ffb24b9a7802c4657e3dd871574.exe f8d60ffb24b9a8902c4768e3dd981684.exe PID 3584 wrote to memory of 4048 3584 f7d50ffb24b9a7802c4657e3dd871574.exe f8d60ffb24b9a8902c4768e3dd981684.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe PID 4048 wrote to memory of 368 4048 f8d60ffb24b9a8902c4768e3dd981684.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7d50ffb24b9a7802c4657e3dd871574.exe"C:\Users\Admin\AppData\Local\Temp\f7d50ffb24b9a7802c4657e3dd871574.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeC:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeC:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeC:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeMD5
f7d50ffb24b9a7802c4657e3dd871574
SHA11d2b0641ac09a198f71e2b0e8e48351a6fca6674
SHA2560983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
SHA512ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeMD5
f7d50ffb24b9a7802c4657e3dd871574
SHA11d2b0641ac09a198f71e2b0e8e48351a6fca6674
SHA2560983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
SHA512ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeMD5
f7d50ffb24b9a7802c4657e3dd871574
SHA11d2b0641ac09a198f71e2b0e8e48351a6fca6674
SHA2560983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
SHA512ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
-
C:\Users\Admin\AppData\Roaming\TeamViewer\f8d60ffb24b9a8902c4768e3dd981684.exeMD5
f7d50ffb24b9a7802c4657e3dd871574
SHA11d2b0641ac09a198f71e2b0e8e48351a6fca6674
SHA2560983eb624effc643a11db3a17755ec83c5db588330a89aaea612e199d77d0c43
SHA512ef5de20e5dcd89e010835758a9fc300b25ea1245d7472cb3a492b58db6cf42dbabb999df39f0e9394e0f7517b23056166ca073203e9ca5b7feba7a74057c8b9b
-
memory/368-127-0x0000000140016000-0x000000014001D000-memory.dmpFilesize
28KB
-
memory/368-129-0x0000000140020000-0x0000000140021000-memory.dmpFilesize
4KB
-
memory/368-132-0x000002193A230000-0x000002193A231000-memory.dmpFilesize
4KB
-
memory/368-128-0x000000014001E000-0x0000000140020000-memory.dmpFilesize
8KB
-
memory/368-130-0x0000000140021000-0x0000000140022000-memory.dmpFilesize
4KB
-
memory/368-124-0x0000000000000000-mapping.dmp
-
memory/368-125-0x0000000140000000-0x0000000140001000-memory.dmpFilesize
4KB
-
memory/368-126-0x0000000140001000-0x0000000140016000-memory.dmpFilesize
84KB
-
memory/1120-138-0x0000000000000000-mapping.dmp
-
memory/1268-158-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/2260-145-0x00000000004D0000-0x000000000061A000-memory.dmpFilesize
1.3MB
-
memory/2304-151-0x0000000000000000-mapping.dmp
-
memory/3584-119-0x0000000003050000-0x00000000030E3000-memory.dmpFilesize
588KB
-
memory/3584-118-0x0000000002330000-0x0000000002333000-memory.dmpFilesize
12KB
-
memory/4048-121-0x0000000010001000-0x0000000010004000-memory.dmpFilesize
12KB
-
memory/4048-122-0x0000000010004000-0x0000000010005000-memory.dmpFilesize
4KB
-
memory/4048-123-0x0000000010006000-0x0000000010007000-memory.dmpFilesize
4KB
-
memory/4048-120-0x0000000010000000-0x0000000010001000-memory.dmpFilesize
4KB
-
memory/4048-131-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/4048-115-0x0000000000000000-mapping.dmp