Analysis
-
max time kernel
189s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 04:38
Static task
static1
Behavioral task
behavioral1
Sample
c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe
-
Size
316KB
-
MD5
a9adbe7646f3a0f01aa5615632590276
-
SHA1
9aeda7bc09b987bfece30df46c6ccc4f350e1b1d
-
SHA256
c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945
-
SHA512
e70f632689e9f152da874f48f350223e55bee83944e6e6edf0157f9ec325cb30782da36899a222085bd79f62ce161d759219c68d1f7c9f9bcd54ce9be105c7d5
Malware Config
Signatures
-
Trickbot x86 loader 3 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/844-55-0x0000000000310000-0x0000000000319000-memory.dmp trickbot_loader32 behavioral1/memory/844-56-0x0000000000310000-0x0000000000319000-memory.dmp trickbot_loader32 behavioral1/memory/844-58-0x0000000000310000-0x0000000000319000-memory.dmp trickbot_loader32 -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 548 powershell.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 548 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exepid process 844 c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.execmd.exedescription pid process target process PID 844 wrote to memory of 1936 844 c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe cmd.exe PID 844 wrote to memory of 1936 844 c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe cmd.exe PID 844 wrote to memory of 1936 844 c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe cmd.exe PID 844 wrote to memory of 1936 844 c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe cmd.exe PID 1936 wrote to memory of 548 1936 cmd.exe powershell.exe PID 1936 wrote to memory of 548 1936 cmd.exe powershell.exe PID 1936 wrote to memory of 548 1936 cmd.exe powershell.exe PID 1936 wrote to memory of 548 1936 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe"C:\Users\Admin\AppData\Local\Temp\c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C PowerShell "Start-Sleep 10; Remove-Item C:\Users\Admin\AppData\Local\Temp\c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell "Start-Sleep 10; Remove-Item C:\Users\Admin\AppData\Local\Temp\c56f3a37857215bd8c93f549a1aea01ca9f48ad1c12ac7dabde678f00d216945.exe"3⤵
- Deletes itself
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/548-59-0x0000000000000000-mapping.dmp
-
memory/548-61-0x00000000746D0000-0x0000000074C7B000-memory.dmpFilesize
5.7MB
-
memory/548-62-0x00000000746D0000-0x0000000074C7B000-memory.dmpFilesize
5.7MB
-
memory/844-54-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/844-55-0x0000000000310000-0x0000000000319000-memory.dmpFilesize
36KB
-
memory/844-56-0x0000000000310000-0x0000000000319000-memory.dmpFilesize
36KB
-
memory/844-58-0x0000000000310000-0x0000000000319000-memory.dmpFilesize
36KB
-
memory/1936-57-0x0000000000000000-mapping.dmp