Analysis
-
max time kernel
110s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 01:20
Static task
static1
Behavioral task
behavioral1
Sample
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe
Resource
win10v2004-20220414-en
General
-
Target
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe
-
Size
443KB
-
MD5
0da06485fe542333d67855067eed6339
-
SHA1
216a30b8cafce120917000ead51015ba56100b8c
-
SHA256
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
-
SHA512
ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
Malware Config
Extracted
trickbot
1000262
sun6
118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
168.167.87.79:443
103.111.53.126:449
182.253.20.66:449
192.188.120.164:443
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
69.9.232.167:443
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
103.111.55.218:449
62.141.94.107:443
96.43.40.221:443
197.232.50.85:443
223.25.64.119:443
185.222.202.127:443
116.212.152.12:449
107.181.174.176:443
23.94.41.215:443
107.173.102.231:443
192.252.209.44:443
107.175.127.147:443
23.226.138.169:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 3 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4236-130-0x00000000001B0000-0x00000000001ED000-memory.dmp trickbot_loader32 behavioral2/memory/4932-147-0x0000000000730000-0x000000000076D000-memory.dmp trickbot_loader32 behavioral2/memory/4236-148-0x00000000001B0000-0x00000000001ED000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exepid process 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe = "C:\\Users\\Admin\\AppData\\Roaming\\mssert\\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe" svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 icanhazip.com -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exedescription pid process target process PID 4236 wrote to memory of 4932 4236 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe PID 4236 wrote to memory of 4932 4236 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe PID 4236 wrote to memory of 4932 4236 3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe PID 4932 wrote to memory of 628 4932 3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe"C:\Users\Admin\AppData\Local\Temp\3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exeC:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1081944012-3634099177-1681222835-1000\0f5007522459c86e95ffcc62f32308f1_20e30e2f-4677-4eb9-89e6-7dd1fd044635Filesize
1KB
MD5a75dcd9960e40fb371c4ac977eb4d90d
SHA19f77e7a583f2b1864608cb44db4572184f0275fb
SHA2564e696238e44ff0c746bb21505163066fe7fc5074705a60307c48b473c7be8f90
SHA512f729b972630590c89e616d24bfc9ba9cdc2f4b4513b47a5151f78e583eb309cbcee3d6f91babea39c339889a2ceb806c3eeb86cacc217c7c285e7b28b9a983a4
-
C:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exeFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
C:\Users\Admin\AppData\Roaming\mssert\3f96129c69dfdbdbb47739d06d8b3cbcb269ee7fdcd90bb9cf0c267987e04706.exeFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
memory/628-139-0x0000000000000000-mapping.dmp
-
memory/628-141-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/4236-130-0x00000000001B0000-0x00000000001ED000-memory.dmpFilesize
244KB
-
memory/4236-148-0x00000000001B0000-0x00000000001ED000-memory.dmpFilesize
244KB
-
memory/4932-131-0x0000000000000000-mapping.dmp
-
memory/4932-136-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/4932-147-0x0000000000730000-0x000000000076D000-memory.dmpFilesize
244KB