Analysis
- max time kernel
136s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
01/02/2022, 05:54
General
- Target 6a03670ab278379848cd3e785dea4c20419f993bb48b4f52d953350af6e44468.exe
- Size 598KB
- Sample220201-glz4eahfdn
- SHA256 6a03670ab278379848cd3e785dea4c20419f993bb48b4f52d953350af6e44468
Malware Config
Extracted
-
trickbot
-
1000503
-
chil6
-
5.182.210.226:443
-
192.210.226.106:443
-
51.254.164.244:443
-
45.148.120.153:443
-
195.123.239.67:443
-
194.5.250.150:443
-
217.12.209.200:443
-
185.99.2.221:443
-
51.254.164.245:443
-
185.62.188.159:443
-
46.17.107.65:443
-
185.20.185.76:443
-
185.203.118.37:443
-
146.185.253.178:443
-
185.14.31.252:443
-
185.99.2.115:443
-
172.245.156.138:443
-
51.89.73.158:443
-
190.214.13.2:449
-
181.140.173.186:449
- autorun
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Dave packer 2 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a03670ab278379848cd3e785dea4c20419f993bb48b4f52d953350af6e44468.exe"C:\Users\Admin\AppData\Local\Temp\6a03670ab278379848cd3e785dea4c20419f993bb48b4f52d953350af6e44468.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ΔευτέραວັນຈັນأخসোমবারباCC;ↈↈↈ;;راПонедељакلإثنين.exe"C:\ProgramData\ΔευτέραວັນຈັນأخসোমবারباCC;ↈↈↈ;;راПонедељакلإثنين.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-67-0x0000000001E78000-0x0000000001F11000-memory.dmp
memory/576-68-0x0000000001F80000-0x0000000001FB2000-memory.dmp
memory/576-69-0x0000000001F20000-0x0000000001F52000-memory.dmp
memory/576-71-0x0000000010000000-0x0000000010006000-memory.dmp
memory/576-70-0x0000000000290000-0x00000000002C6000-memory.dmp
memory/1520-72-0x0000000000060000-0x0000000000084000-memory.dmp
memory/1700-55-0x00000000758A1000-0x00000000758A3000-memory.dmp
memory/1700-56-0x0000000002470000-0x00000000024A6000-memory.dmp
memory/1700-59-0x0000000002420000-0x0000000002463000-memory.dmp