Analysis
-
max time kernel
46s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe
Resource
win10v2004-20220414-en
General
-
Target
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe
-
Size
443KB
-
MD5
0da06485fe542333d67855067eed6339
-
SHA1
216a30b8cafce120917000ead51015ba56100b8c
-
SHA256
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
-
SHA512
ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
Malware Config
Extracted
trickbot
1000262
sun6
118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
168.167.87.79:443
103.111.53.126:449
182.253.20.66:449
192.188.120.164:443
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
69.9.232.167:443
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
103.111.55.218:449
62.141.94.107:443
96.43.40.221:443
197.232.50.85:443
223.25.64.119:443
185.222.202.127:443
116.212.152.12:449
107.181.174.176:443
23.94.41.215:443
107.173.102.231:443
192.252.209.44:443
107.175.127.147:443
23.226.138.169:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 3 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1964-63-0x00000000005C0000-0x00000000005FD000-memory.dmp trickbot_loader32 behavioral1/memory/1964-67-0x00000000005C0000-0x00000000005FD000-memory.dmp trickbot_loader32 behavioral1/memory/844-84-0x00000000003B0000-0x00000000003ED000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exepid process 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exepid process 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 1116 sc.exe 1040 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exepowershell.exepid process 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 940 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 940 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.execmd.execmd.execmd.exe3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exedescription pid process target process PID 1964 wrote to memory of 1952 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1952 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1952 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1952 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1904 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1904 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1904 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1904 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1156 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1156 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1156 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1964 wrote to memory of 1156 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe cmd.exe PID 1952 wrote to memory of 1116 1952 cmd.exe sc.exe PID 1952 wrote to memory of 1116 1952 cmd.exe sc.exe PID 1952 wrote to memory of 1116 1952 cmd.exe sc.exe PID 1952 wrote to memory of 1116 1952 cmd.exe sc.exe PID 1964 wrote to memory of 844 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe PID 1964 wrote to memory of 844 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe PID 1964 wrote to memory of 844 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe PID 1964 wrote to memory of 844 1964 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe PID 1904 wrote to memory of 1040 1904 cmd.exe sc.exe PID 1904 wrote to memory of 1040 1904 cmd.exe sc.exe PID 1904 wrote to memory of 1040 1904 cmd.exe sc.exe PID 1904 wrote to memory of 1040 1904 cmd.exe sc.exe PID 1156 wrote to memory of 940 1156 cmd.exe powershell.exe PID 1156 wrote to memory of 940 1156 cmd.exe powershell.exe PID 1156 wrote to memory of 940 1156 cmd.exe powershell.exe PID 1156 wrote to memory of 940 1156 cmd.exe powershell.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 844 wrote to memory of 428 844 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe"C:\Users\Admin\AppData\Local\Temp\3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exeC:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1819626980-2277161760-1023733287-1000\0f5007522459c86e95ffcc62f32308f1_e0ffcd78-9b22-40d1-a23f-5e55cdd3b217Filesize
1KB
MD5d5d2593b34343a1a9d0b47b7e679968d
SHA107c46ec3a5e2d7d9404a3e17840f46064d833438
SHA2568261c6fca81530a539800838d47941d1975baa9941d4eedec2f9c52121878ad9
SHA512e2e2e7540e489205a89cd73bf3816fde11a4d3ec7406a91ec385a5313aca76e3ae0e26493108e2677cab42fe9a25911eb06fb472f38f1c8e2ab3df69c48b1407
-
C:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exeFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exeFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exeFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
memory/428-77-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/428-75-0x0000000000000000-mapping.dmp
-
memory/844-61-0x0000000000000000-mapping.dmp
-
memory/844-72-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/844-84-0x00000000003B0000-0x00000000003ED000-memory.dmpFilesize
244KB
-
memory/940-68-0x0000000074210000-0x00000000747BB000-memory.dmpFilesize
5.7MB
-
memory/940-83-0x0000000074210000-0x00000000747BB000-memory.dmpFilesize
5.7MB
-
memory/940-65-0x0000000000000000-mapping.dmp
-
memory/1040-62-0x0000000000000000-mapping.dmp
-
memory/1116-59-0x0000000000000000-mapping.dmp
-
memory/1156-57-0x0000000000000000-mapping.dmp
-
memory/1904-56-0x0000000000000000-mapping.dmp
-
memory/1952-55-0x0000000000000000-mapping.dmp
-
memory/1964-67-0x00000000005C0000-0x00000000005FD000-memory.dmpFilesize
244KB
-
memory/1964-63-0x00000000005C0000-0x00000000005FD000-memory.dmpFilesize
244KB
-
memory/1964-54-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB