Analysis

  • max time kernel
    121s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28-01-2022 19:39

General

  • Target

    bbe02e749c9d0d47527a268418fd354f4bf7351657e25cdc5e7dd79ee5a32b41.exe

  • Size

    874KB

  • MD5

    5e0303742e801bb71ba15f5895acbe8c

  • SHA1

    91270cb84c2a40ed488b4ca363f1db06b7edc589

  • SHA256

    bbe02e749c9d0d47527a268418fd354f4bf7351657e25cdc5e7dd79ee5a32b41

  • SHA512

    63ea8a5dfdc1022e4038985a27462c41b52375e0177167a8f5ca8a785ad5bc0b33a4cf026328343743c7db56900bdef9a981bd0cd01e64f2e14181a9b211a61d

Malware Config

Extracted

Family

trickbot

Version

1000477

Botnet

trg88889

C2

37.44.212.148:443

185.65.202.127:443

193.37.212.246:443

193.124.191.243:443

31.148.99.63:443

94.103.91.61:443

203.23.128.179:443

179.43.147.72:443

93.123.73.192:443

51.89.115.120:443

144.91.76.214:443

46.21.153.81:443

194.5.250.98:443

190.154.203.218:449

178.183.150.169:449

200.116.199.10:449

181.113.20.186:449

187.58.56.26:449

85.11.116.194:449

177.103.240.149:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bbe02e749c9d0d47527a268418fd354f4bf7351657e25cdc5e7dd79ee5a32b41.exe
    "C:\Users\Admin\AppData\Local\Temp\bbe02e749c9d0d47527a268418fd354f4bf7351657e25cdc5e7dd79ee5a32b41.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\ProgramData\すすのは抱べも私.exe
      "C:\ProgramData\すすのは抱べも私.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3136
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2980

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\すすのは抱べも私.exe
      MD5

      5e0303742e801bb71ba15f5895acbe8c

      SHA1

      91270cb84c2a40ed488b4ca363f1db06b7edc589

      SHA256

      bbe02e749c9d0d47527a268418fd354f4bf7351657e25cdc5e7dd79ee5a32b41

      SHA512

      63ea8a5dfdc1022e4038985a27462c41b52375e0177167a8f5ca8a785ad5bc0b33a4cf026328343743c7db56900bdef9a981bd0cd01e64f2e14181a9b211a61d

    • C:\ProgramData\すすのは抱べも私.exe
      MD5

      5e0303742e801bb71ba15f5895acbe8c

      SHA1

      91270cb84c2a40ed488b4ca363f1db06b7edc589

      SHA256

      bbe02e749c9d0d47527a268418fd354f4bf7351657e25cdc5e7dd79ee5a32b41

      SHA512

      63ea8a5dfdc1022e4038985a27462c41b52375e0177167a8f5ca8a785ad5bc0b33a4cf026328343743c7db56900bdef9a981bd0cd01e64f2e14181a9b211a61d

    • memory/2980-125-0x00000249BB5A0000-0x00000249BB5BE000-memory.dmp
      Filesize

      120KB

    • memory/3136-122-0x0000000000640000-0x000000000066C000-memory.dmp
      Filesize

      176KB