Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 20:15
Static task
static1
Behavioral task
behavioral1
Sample
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe
Resource
win7-en-20211208
General
-
Target
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe
-
Size
849KB
-
MD5
08be646d95d65e8ee44bd4dc7281ad78
-
SHA1
7472dcb193c700180857a33144c5d635770d4978
-
SHA256
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
-
SHA512
c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59
Malware Config
Extracted
trickbot
1000479
trgt98888
192.3.104.46:443
23.94.233.210:443
172.82.152.126:443
192.3.247.11:443
202.29.215.114:449
-
autorunControl:GetSystemInfoName:systeminfoName:pwgrab
Signatures
-
Trickbot x86 loader 2 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/592-60-0x00000000003D0000-0x00000000003FD000-memory.dmp trickbot_loader32 behavioral1/memory/592-62-0x00000000003A0000-0x00000000003CC000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
있서래처길모고른든.exe있서래처길모고른든.exepid process 592 있서래처길모고른든.exe 1544 있서래처길모고른든.exe -
Loads dropped DLL 2 IoCs
Processes:
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exepid process 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeTcbPrivilege 844 svchost.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe있서래처길모고른든.exe있서래처길모고른든.exepid process 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe 592 있서래처길모고른든.exe 592 있서래처길모고른든.exe 1544 있서래처길모고른든.exe 1544 있서래처길모고른든.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe있서래처길모고른든.exetaskeng.exe있서래처길모고른든.exedescription pid process target process PID 980 wrote to memory of 592 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe 있서래처길모고른든.exe PID 980 wrote to memory of 592 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe 있서래처길모고른든.exe PID 980 wrote to memory of 592 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe 있서래처길모고른든.exe PID 980 wrote to memory of 592 980 f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe 있서래처길모고른든.exe PID 592 wrote to memory of 1032 592 있서래처길모고른든.exe svchost.exe PID 592 wrote to memory of 1032 592 있서래처길모고른든.exe svchost.exe PID 592 wrote to memory of 1032 592 있서래처길모고른든.exe svchost.exe PID 592 wrote to memory of 1032 592 있서래처길모고른든.exe svchost.exe PID 592 wrote to memory of 1032 592 있서래처길모고른든.exe svchost.exe PID 592 wrote to memory of 1032 592 있서래처길모고른든.exe svchost.exe PID 1832 wrote to memory of 1544 1832 taskeng.exe 있서래처길모고른든.exe PID 1832 wrote to memory of 1544 1832 taskeng.exe 있서래처길모고른든.exe PID 1832 wrote to memory of 1544 1832 taskeng.exe 있서래처길모고른든.exe PID 1832 wrote to memory of 1544 1832 taskeng.exe 있서래처길모고른든.exe PID 1544 wrote to memory of 844 1544 있서래처길모고른든.exe svchost.exe PID 1544 wrote to memory of 844 1544 있서래처길모고른든.exe svchost.exe PID 1544 wrote to memory of 844 1544 있서래처길모고른든.exe svchost.exe PID 1544 wrote to memory of 844 1544 있서래처길모고른든.exe svchost.exe PID 1544 wrote to memory of 844 1544 있서래처길모고른든.exe svchost.exe PID 1544 wrote to memory of 844 1544 있서래처길모고른든.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe"C:\Users\Admin\AppData\Local\Temp\f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\있서래처길모고른든.exe"C:\ProgramData\있서래처길모고른든.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {54C26B81-1EDB-4D3C-A995-42FCAF595035} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exeC:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\있서래처길모고른든.exeMD5
08be646d95d65e8ee44bd4dc7281ad78
SHA17472dcb193c700180857a33144c5d635770d4978
SHA256f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
SHA512c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59
-
C:\ProgramData\있서래처길모고른든.exeMD5
08be646d95d65e8ee44bd4dc7281ad78
SHA17472dcb193c700180857a33144c5d635770d4978
SHA256f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
SHA512c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59
-
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exeMD5
08be646d95d65e8ee44bd4dc7281ad78
SHA17472dcb193c700180857a33144c5d635770d4978
SHA256f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
SHA512c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59
-
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exeMD5
08be646d95d65e8ee44bd4dc7281ad78
SHA17472dcb193c700180857a33144c5d635770d4978
SHA256f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
SHA512c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59
-
\ProgramData\있서래처길모고른든.exeMD5
08be646d95d65e8ee44bd4dc7281ad78
SHA17472dcb193c700180857a33144c5d635770d4978
SHA256f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
SHA512c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59
-
\ProgramData\있서래처길모고른든.exeMD5
08be646d95d65e8ee44bd4dc7281ad78
SHA17472dcb193c700180857a33144c5d635770d4978
SHA256f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
SHA512c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59
-
memory/592-60-0x00000000003D0000-0x00000000003FD000-memory.dmpFilesize
180KB
-
memory/592-62-0x00000000003A0000-0x00000000003CC000-memory.dmpFilesize
176KB
-
memory/844-69-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/980-54-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB
-
memory/1032-63-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB