Analysis

  • max time kernel
    132s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28-01-2022 19:44

General

  • Target

    38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828.exe

  • Size

    985KB

  • MD5

    320931357db07a43b4f43f57c4c1c87b

  • SHA1

    8cfe7e8e3c747fcfb2e2657e557d07baa3d4c4f4

  • SHA256

    38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828

  • SHA512

    1ba1021bbe262469b50016e045495a255a30741772791699ce2b19c35a4ee57175024418df33d3d19a78c3feb2b4d164a9545d833a818aea18c0fcbbe0528bd8

Malware Config

Extracted

Family

trickbot

Version

1000475

Botnet

trg911

C2

45.80.148.30:443

194.5.250.83:443

185.222.202.223:443

66.55.71.11:443

94.156.144.3:443

185.244.150.142:443

194.5.250.82:443

31.184.253.37:443

109.234.34.135:443

45.66.11.116:443

185.222.202.222:443

46.30.41.229:443

45.142.213.58:443

190.154.203.218:449

189.80.134.122:449

200.116.199.10:449

181.113.20.186:449

187.58.56.26:449

85.11.116.194:449

177.103.240.149:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 2 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828.exe
    "C:\Users\Admin\AppData\Local\Temp\38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\ProgramData\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe
      "C:\ProgramData\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3632
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:3980
      • C:\ProgramData\аоасу.exe
        "C:\ProgramData\аоасу.exe"
        2⤵
        • Executes dropped EXE
        PID:3652
    • C:\Users\Admin\AppData\Roaming\HomeLan\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe
      C:\Users\Admin\AppData\Roaming\HomeLan\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:940

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\аоасу.exe
      MD5

      2c24eaad1af80b2320c8eca59208b9e3

      SHA1

      354a2eb38a26dc7b035b439385a572b5f7ec72ed

      SHA256

      295238ae29bd534c46e1b8c65d0a7ef172d033e370024aea064cbd98b9e33c9c

      SHA512

      b6bb8be3607927aea914d33ad3cec14b945a98b5d13cfb2bffe99b80ed8103c3e4df9bade45c5704e0be64ed2158292e98eea067cd21132539b9ca7ececf2519

    • C:\ProgramData\аоасу.exe
      MD5

      2c24eaad1af80b2320c8eca59208b9e3

      SHA1

      354a2eb38a26dc7b035b439385a572b5f7ec72ed

      SHA256

      295238ae29bd534c46e1b8c65d0a7ef172d033e370024aea064cbd98b9e33c9c

      SHA512

      b6bb8be3607927aea914d33ad3cec14b945a98b5d13cfb2bffe99b80ed8103c3e4df9bade45c5704e0be64ed2158292e98eea067cd21132539b9ca7ececf2519

    • C:\ProgramData\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe
      MD5

      320931357db07a43b4f43f57c4c1c87b

      SHA1

      8cfe7e8e3c747fcfb2e2657e557d07baa3d4c4f4

      SHA256

      38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828

      SHA512

      1ba1021bbe262469b50016e045495a255a30741772791699ce2b19c35a4ee57175024418df33d3d19a78c3feb2b4d164a9545d833a818aea18c0fcbbe0528bd8

    • C:\ProgramData\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe
      MD5

      320931357db07a43b4f43f57c4c1c87b

      SHA1

      8cfe7e8e3c747fcfb2e2657e557d07baa3d4c4f4

      SHA256

      38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828

      SHA512

      1ba1021bbe262469b50016e045495a255a30741772791699ce2b19c35a4ee57175024418df33d3d19a78c3feb2b4d164a9545d833a818aea18c0fcbbe0528bd8

    • C:\Users\Admin\AppData\Roaming\HomeLan\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe
      MD5

      320931357db07a43b4f43f57c4c1c87b

      SHA1

      8cfe7e8e3c747fcfb2e2657e557d07baa3d4c4f4

      SHA256

      38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828

      SHA512

      1ba1021bbe262469b50016e045495a255a30741772791699ce2b19c35a4ee57175024418df33d3d19a78c3feb2b4d164a9545d833a818aea18c0fcbbe0528bd8

    • C:\Users\Admin\AppData\Roaming\HomeLan\私チ私ェたでてでス合も任できのでスすべ私たたジでたチ私すので任いきべきっでがべ合で抱ェすがジいェべ愛もスち合は愛でャャつジもすスきすチチす合ち愛ちた愛スはすで抱スっでェたっつはでべはっもっスがいつでジた合てで愛べいつ抱てャ私ジてすきすジ愛ちすャジがつでェのちいたすて合べのたス私っべ任愛ェスのチェたてェすきたべてェの意もャべでべジっはきつたてべスっ私すス私もっい愛っ私すャもェきち私てェのたたもてでチ.exe
      MD5

      320931357db07a43b4f43f57c4c1c87b

      SHA1

      8cfe7e8e3c747fcfb2e2657e557d07baa3d4c4f4

      SHA256

      38789619c9e5b7b1b19dc1a0bb98daa3314ed0862b753763b68b3e6371dc0828

      SHA512

      1ba1021bbe262469b50016e045495a255a30741772791699ce2b19c35a4ee57175024418df33d3d19a78c3feb2b4d164a9545d833a818aea18c0fcbbe0528bd8

    • memory/940-144-0x000001BC990A0000-0x000001BC990BE000-memory.dmp
      Filesize

      120KB

    • memory/3632-128-0x00000000021B0000-0x00000000021DE000-memory.dmp
      Filesize

      184KB

    • memory/3632-130-0x0000000002180000-0x00000000021AC000-memory.dmp
      Filesize

      176KB

    • memory/3652-132-0x0000000004C20000-0x0000000004CB2000-memory.dmp
      Filesize

      584KB

    • memory/3652-133-0x0000000002570000-0x000000000257A000-memory.dmp
      Filesize

      40KB

    • memory/3652-134-0x0000000004DD0000-0x00000000052CE000-memory.dmp
      Filesize

      5.0MB

    • memory/3652-131-0x00000000052D0000-0x00000000057CE000-memory.dmp
      Filesize

      5.0MB

    • memory/3652-127-0x00000000002A0000-0x00000000002A8000-memory.dmp
      Filesize

      32KB

    • memory/3980-137-0x0000025B9FDF0000-0x0000025B9FE0E000-memory.dmp
      Filesize

      120KB

    • memory/4244-142-0x00000000005D0000-0x000000000071A000-memory.dmp
      Filesize

      1.3MB