Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 18:58
Static task
static1
Behavioral task
behavioral1
Sample
c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe
Resource
win7-en-20211208
General
-
Target
c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe
-
Size
881KB
-
MD5
59ccde8ff080314a8568b0f909037ca2
-
SHA1
acf6ab5b9a983c70864f0c95790d85d257ceb528
-
SHA256
c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9
-
SHA512
6f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2
Malware Config
Extracted
trickbot
1000479
trgt98888
192.3.104.46:443
23.94.233.210:443
172.82.152.126:443
192.3.247.11:443
202.29.215.114:449
-
autorunControl:GetSystemInfoName:systeminfoName:pwgrab
Signatures
-
Trickbot x86 loader 2 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/652-62-0x0000000000240000-0x000000000026C000-memory.dmp trickbot_loader32 behavioral1/memory/1840-67-0x0000000000550000-0x000000000057D000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
있서래처길모고른든.exe있서래처길모고른든.exepid process 652 있서래처길모고른든.exe 1840 있서래처길모고른든.exe -
Loads dropped DLL 2 IoCs
Processes:
c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exepid process 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeTcbPrivilege 1536 svchost.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe있서래처길모고른든.exe있서래처길모고른든.exepid process 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe 652 있서래처길모고른든.exe 652 있서래처길모고른든.exe 1840 있서래처길모고른든.exe 1840 있서래처길모고른든.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe있서래처길모고른든.exetaskeng.exe있서래처길모고른든.exedescription pid process target process PID 1072 wrote to memory of 652 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe 있서래처길모고른든.exe PID 1072 wrote to memory of 652 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe 있서래처길모고른든.exe PID 1072 wrote to memory of 652 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe 있서래처길모고른든.exe PID 1072 wrote to memory of 652 1072 c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe 있서래처길모고른든.exe PID 652 wrote to memory of 1676 652 있서래처길모고른든.exe svchost.exe PID 652 wrote to memory of 1676 652 있서래처길모고른든.exe svchost.exe PID 652 wrote to memory of 1676 652 있서래처길모고른든.exe svchost.exe PID 652 wrote to memory of 1676 652 있서래처길모고른든.exe svchost.exe PID 652 wrote to memory of 1676 652 있서래처길모고른든.exe svchost.exe PID 652 wrote to memory of 1676 652 있서래처길모고른든.exe svchost.exe PID 1984 wrote to memory of 1840 1984 taskeng.exe 있서래처길모고른든.exe PID 1984 wrote to memory of 1840 1984 taskeng.exe 있서래처길모고른든.exe PID 1984 wrote to memory of 1840 1984 taskeng.exe 있서래처길모고른든.exe PID 1984 wrote to memory of 1840 1984 taskeng.exe 있서래처길모고른든.exe PID 1840 wrote to memory of 1536 1840 있서래처길모고른든.exe svchost.exe PID 1840 wrote to memory of 1536 1840 있서래처길모고른든.exe svchost.exe PID 1840 wrote to memory of 1536 1840 있서래처길모고른든.exe svchost.exe PID 1840 wrote to memory of 1536 1840 있서래처길모고른든.exe svchost.exe PID 1840 wrote to memory of 1536 1840 있서래처길모고른든.exe svchost.exe PID 1840 wrote to memory of 1536 1840 있서래처길모고른든.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe"C:\Users\Admin\AppData\Local\Temp\c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\있서래처길모고른든.exe"C:\ProgramData\있서래처길모고른든.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {09353C12-6FFA-43E6-949D-219F8DF7C3DE} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exeC:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\있서래처길모고른든.exeMD5
59ccde8ff080314a8568b0f909037ca2
SHA1acf6ab5b9a983c70864f0c95790d85d257ceb528
SHA256c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9
SHA5126f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2
-
C:\ProgramData\있서래처길모고른든.exeMD5
59ccde8ff080314a8568b0f909037ca2
SHA1acf6ab5b9a983c70864f0c95790d85d257ceb528
SHA256c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9
SHA5126f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2
-
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exeMD5
59ccde8ff080314a8568b0f909037ca2
SHA1acf6ab5b9a983c70864f0c95790d85d257ceb528
SHA256c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9
SHA5126f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2
-
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exeMD5
59ccde8ff080314a8568b0f909037ca2
SHA1acf6ab5b9a983c70864f0c95790d85d257ceb528
SHA256c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9
SHA5126f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2
-
\ProgramData\있서래처길모고른든.exeMD5
59ccde8ff080314a8568b0f909037ca2
SHA1acf6ab5b9a983c70864f0c95790d85d257ceb528
SHA256c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9
SHA5126f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2
-
\ProgramData\있서래처길모고른든.exeMD5
59ccde8ff080314a8568b0f909037ca2
SHA1acf6ab5b9a983c70864f0c95790d85d257ceb528
SHA256c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9
SHA5126f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2
-
memory/652-62-0x0000000000240000-0x000000000026C000-memory.dmpFilesize
176KB
-
memory/1072-54-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1536-69-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1676-63-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1840-67-0x0000000000550000-0x000000000057D000-memory.dmpFilesize
180KB