Analysis
-
max time kernel
147s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 04:17
Static task
static1
Behavioral task
behavioral1
Sample
3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe
Resource
win7-20220414-en
General
-
Target
3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe
-
Size
505KB
-
MD5
57cde74b65e113c5df45c1668100d4c5
-
SHA1
0e8b1073bee392aa99eb9c4400a39219fba4c022
-
SHA256
3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480
-
SHA512
c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2
Malware Config
Extracted
trickbot
1000497
wmd38
5.182.210.226:443
5.182.210.246:443
82.146.62.52:443
198.8.91.10:443
195.123.221.53:443
51.89.115.116:443
164.68.120.56:443
85.204.116.237:443
5.2.75.167:443
93.189.42.146:443
185.252.144.174:443
81.177.165.145:443
217.107.34.151:443
146.185.219.165:443
194.87.238.87:443
146.185.253.18:443
194.5.250.155:443
195.123.216.223:443
185.99.2.160:443
5.182.210.230:443
5.2.75.93:443
190.214.13.2:449
181.140.173.186:449
181.129.104.139:449
181.113.28.146:449
181.112.157.42:449
170.84.78.224:449
200.21.51.38:449
46.174.235.36:449
36.89.85.103:449
181.129.134.18:449
186.71.150.23:449
131.161.253.190:449
200.127.121.99:449
114.8.133.71:449
119.252.165.75:449
121.100.19.18:449
202.29.215.114:449
180.180.216.177:449
171.100.142.238:449
186.232.91.240:449
181.196.207.202:449
-
autorunName:pwgrab
Signatures
-
Trickbot x86 loader 10 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2032-55-0x0000000001EE0000-0x0000000001F14000-memory.dmp trickbot_loader32 behavioral1/memory/2032-63-0x0000000000250000-0x0000000000281000-memory.dmp trickbot_loader32 behavioral1/memory/1588-65-0x0000000000300000-0x0000000000334000-memory.dmp trickbot_loader32 behavioral1/memory/1588-69-0x0000000000570000-0x00000000005A0000-memory.dmp trickbot_loader32 behavioral1/memory/1588-70-0x00000000003C0000-0x00000000003F0000-memory.dmp trickbot_loader32 behavioral1/memory/1588-71-0x0000000000571000-0x00000000005A0000-memory.dmp trickbot_loader32 behavioral1/memory/1588-75-0x0000000000571000-0x00000000005A0000-memory.dmp trickbot_loader32 behavioral1/memory/804-81-0x00000000009A0000-0x00000000009D4000-memory.dmp trickbot_loader32 behavioral1/memory/804-86-0x00000000009E1000-0x0000000000A10000-memory.dmp trickbot_loader32 behavioral1/memory/804-89-0x00000000009E1000-0x0000000000A10000-memory.dmp trickbot_loader32 -
Dave packer 4 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral1/memory/2032-55-0x0000000001EE0000-0x0000000001F14000-memory.dmp dave behavioral1/memory/2032-63-0x0000000000250000-0x0000000000281000-memory.dmp dave behavioral1/memory/1588-65-0x0000000000300000-0x0000000000334000-memory.dmp dave behavioral1/memory/804-81-0x00000000009A0000-0x00000000009D4000-memory.dmp dave -
Executes dropped EXE 2 IoCs
Processes:
ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exepid process 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe -
Loads dropped DLL 1 IoCs
Processes:
3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exepid process 2032 3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exeᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exepid process 2032 3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exeᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exetaskeng.exeᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exedescription pid process target process PID 2032 wrote to memory of 1588 2032 3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 2032 wrote to memory of 1588 2032 3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 2032 wrote to memory of 1588 2032 3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 2032 wrote to memory of 1588 2032 3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 1588 wrote to memory of 1524 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 1588 wrote to memory of 1524 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 1588 wrote to memory of 1524 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 1588 wrote to memory of 1524 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 1588 wrote to memory of 1524 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 1588 wrote to memory of 1524 1588 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 1592 wrote to memory of 804 1592 taskeng.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 1592 wrote to memory of 804 1592 taskeng.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 1592 wrote to memory of 804 1592 taskeng.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 1592 wrote to memory of 804 1592 taskeng.exe ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe PID 804 wrote to memory of 1064 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 804 wrote to memory of 1064 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 804 wrote to memory of 1064 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 804 wrote to memory of 1064 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 804 wrote to memory of 1064 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe PID 804 wrote to memory of 1064 804 ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe"C:\Users\Admin\AppData\Local\Temp\3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe"C:\ProgramData\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {12BF413E-F569-4160-A46A-B333CBBE0E47} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\windirect\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeC:\Users\Admin\AppData\Roaming\windirect\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeFilesize
505KB
MD557cde74b65e113c5df45c1668100d4c5
SHA10e8b1073bee392aa99eb9c4400a39219fba4c022
SHA2563707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480
SHA512c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2
-
C:\ProgramData\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeFilesize
505KB
MD557cde74b65e113c5df45c1668100d4c5
SHA10e8b1073bee392aa99eb9c4400a39219fba4c022
SHA2563707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480
SHA512c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2
-
C:\Users\Admin\AppData\Roaming\windirect\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeFilesize
505KB
MD557cde74b65e113c5df45c1668100d4c5
SHA10e8b1073bee392aa99eb9c4400a39219fba4c022
SHA2563707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480
SHA512c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2
-
C:\Users\Admin\AppData\Roaming\windirect\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeFilesize
505KB
MD557cde74b65e113c5df45c1668100d4c5
SHA10e8b1073bee392aa99eb9c4400a39219fba4c022
SHA2563707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480
SHA512c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2
-
\ProgramData\ᠷᠳᠹᠭᠭռգռգռգᠲᠬᠬᠭᠬ.exeFilesize
505KB
MD557cde74b65e113c5df45c1668100d4c5
SHA10e8b1073bee392aa99eb9c4400a39219fba4c022
SHA2563707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480
SHA512c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2
-
memory/804-89-0x00000000009E1000-0x0000000000A10000-memory.dmpFilesize
188KB
-
memory/804-86-0x00000000009E1000-0x0000000000A10000-memory.dmpFilesize
188KB
-
memory/804-81-0x00000000009A0000-0x00000000009D4000-memory.dmpFilesize
208KB
-
memory/804-78-0x0000000000000000-mapping.dmp
-
memory/1064-88-0x0000000000060000-0x0000000000082000-memory.dmpFilesize
136KB
-
memory/1064-87-0x0000000000000000-mapping.dmp
-
memory/1524-76-0x00000000000E0000-0x0000000000102000-memory.dmpFilesize
136KB
-
memory/1524-72-0x0000000000000000-mapping.dmp
-
memory/1524-74-0x00000000000E0000-0x0000000000102000-memory.dmpFilesize
136KB
-
memory/1588-70-0x00000000003C0000-0x00000000003F0000-memory.dmpFilesize
192KB
-
memory/1588-75-0x0000000000571000-0x00000000005A0000-memory.dmpFilesize
188KB
-
memory/1588-73-0x0000000010001000-0x0000000010005000-memory.dmpFilesize
16KB
-
memory/1588-71-0x0000000000571000-0x00000000005A0000-memory.dmpFilesize
188KB
-
memory/1588-60-0x0000000000000000-mapping.dmp
-
memory/1588-69-0x0000000000570000-0x00000000005A0000-memory.dmpFilesize
192KB
-
memory/1588-65-0x0000000000300000-0x0000000000334000-memory.dmpFilesize
208KB
-
memory/2032-55-0x0000000001EE0000-0x0000000001F14000-memory.dmpFilesize
208KB
-
memory/2032-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/2032-63-0x0000000000250000-0x0000000000281000-memory.dmpFilesize
196KB