Analysis
-
max time kernel
163s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 05:50
Static task
static1
Behavioral task
behavioral1
Sample
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe
Resource
win7-20220414-en
General
-
Target
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe
-
Size
631KB
-
MD5
a1fe38bb91804907360d23bbea35d242
-
SHA1
0d4fb2af132b6894ccea8fcaf567a59c504c2dc5
-
SHA256
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
-
SHA512
6a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
Malware Config
Extracted
trickbot
1000474
ono20
51.68.247.62:443
37.228.117.146:443
91.132.139.170:443
37.44.212.216:443
31.184.253.37:443
51.254.69.244:443
194.5.250.82:443
5.230.22.40:443
185.222.202.222:443
46.30.41.229:443
203.23.128.168:443
190.154.203.218:449
189.80.134.122:449
200.116.199.10:449
181.113.20.186:449
187.58.56.26:449
146.196.122.167:449
177.103.240.149:449
181.199.102.179:449
200.21.51.38:449
181.49.61.237:449
190.152.4.210:449
138.59.233.5:449
36.89.85.103:449
45.161.33.88:449
186.42.185.10:449
170.233.120.53:449
187.110.100.122:449
200.153.15.178:449
186.42.98.254:449
181.129.93.226:449
186.42.226.46:449
190.13.160.19:449
186.183.199.114:449
170.84.78.117:449
190.152.4.98:449
181.196.61.110:449
138.185.25.228:449
200.35.56.81:449
186.42.186.202:449
185.70.182.162:449
91.207.185.73:449
181.129.49.98:449
181.115.168.69:449
-
autorunControl:GetSystemInfoName:systeminfoName:pwgrab
Signatures
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1248-60-0x0000000000320000-0x000000000034D000-memory.dmp trickbot_loader32 behavioral1/memory/1248-62-0x00000000002F0000-0x000000000031C000-memory.dmp trickbot_loader32 behavioral1/memory/1248-63-0x0000000000321000-0x000000000034C000-memory.dmp trickbot_loader32 behavioral1/memory/1248-65-0x0000000000321000-0x000000000034C000-memory.dmp trickbot_loader32 behavioral1/memory/1100-74-0x00000000001C1000-0x00000000001EC000-memory.dmp trickbot_loader32 behavioral1/memory/1100-76-0x00000000001C1000-0x00000000001EC000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
다고서그래리즐의을처특리모그그다수있우서고이.exe다고서그래리즐의을처특리모그그다수있우서고이.exepid process 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe -
Loads dropped DLL 1 IoCs
Processes:
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exepid process 1668 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeTcbPrivilege 1544 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe다고서그래리즐의을처특리모그그다수있우서고이.exe다고서그래리즐의을처특리모그그다수있우서고이.exepid process 1668 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe다고서그래리즐의을처특리모그그다수있우서고이.exetaskeng.exe다고서그래리즐의을처특리모그그다수있우서고이.exedescription pid process target process PID 1668 wrote to memory of 1248 1668 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 1668 wrote to memory of 1248 1668 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 1668 wrote to memory of 1248 1668 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 1668 wrote to memory of 1248 1668 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 1248 wrote to memory of 640 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1248 wrote to memory of 640 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1248 wrote to memory of 640 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1248 wrote to memory of 640 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1248 wrote to memory of 640 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1248 wrote to memory of 640 1248 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 540 wrote to memory of 1100 540 taskeng.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 540 wrote to memory of 1100 540 taskeng.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 540 wrote to memory of 1100 540 taskeng.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 540 wrote to memory of 1100 540 taskeng.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 1100 wrote to memory of 1544 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1100 wrote to memory of 1544 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1100 wrote to memory of 1544 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1100 wrote to memory of 1544 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1100 wrote to memory of 1544 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1100 wrote to memory of 1544 1100 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe"C:\Users\Admin\AppData\Local\Temp\7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exe"C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {0EE1D346-F158-441F-A3B9-0D75E9AA8711} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exeC:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
C:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
C:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
memory/640-64-0x0000000000000000-mapping.dmp
-
memory/640-67-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/640-66-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1100-74-0x00000000001C1000-0x00000000001EC000-memory.dmpFilesize
172KB
-
memory/1100-69-0x0000000000000000-mapping.dmp
-
memory/1100-76-0x00000000001C1000-0x00000000001EC000-memory.dmpFilesize
172KB
-
memory/1248-65-0x0000000000321000-0x000000000034C000-memory.dmpFilesize
172KB
-
memory/1248-63-0x0000000000321000-0x000000000034C000-memory.dmpFilesize
172KB
-
memory/1248-62-0x00000000002F0000-0x000000000031C000-memory.dmpFilesize
176KB
-
memory/1248-60-0x0000000000320000-0x000000000034D000-memory.dmpFilesize
180KB
-
memory/1248-56-0x0000000000000000-mapping.dmp
-
memory/1544-75-0x0000000000000000-mapping.dmp
-
memory/1544-77-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1544-78-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1668-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB