Analysis
-
max time kernel
185s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 05:50
Static task
static1
Behavioral task
behavioral1
Sample
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe
Resource
win7-20220414-en
General
-
Target
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe
-
Size
631KB
-
MD5
a1fe38bb91804907360d23bbea35d242
-
SHA1
0d4fb2af132b6894ccea8fcaf567a59c504c2dc5
-
SHA256
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
-
SHA512
6a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
Malware Config
Extracted
trickbot
1000474
ono20
51.68.247.62:443
37.228.117.146:443
91.132.139.170:443
37.44.212.216:443
31.184.253.37:443
51.254.69.244:443
194.5.250.82:443
5.230.22.40:443
185.222.202.222:443
46.30.41.229:443
203.23.128.168:443
190.154.203.218:449
189.80.134.122:449
200.116.199.10:449
181.113.20.186:449
187.58.56.26:449
146.196.122.167:449
177.103.240.149:449
181.199.102.179:449
200.21.51.38:449
181.49.61.237:449
190.152.4.210:449
138.59.233.5:449
36.89.85.103:449
45.161.33.88:449
186.42.185.10:449
170.233.120.53:449
187.110.100.122:449
200.153.15.178:449
186.42.98.254:449
181.129.93.226:449
186.42.226.46:449
190.13.160.19:449
186.183.199.114:449
170.84.78.117:449
190.152.4.98:449
181.196.61.110:449
138.185.25.228:449
200.35.56.81:449
186.42.186.202:449
185.70.182.162:449
91.207.185.73:449
181.129.49.98:449
181.115.168.69:449
-
autorunControl:GetSystemInfoName:systeminfoName:pwgrab
Signatures
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/1164-133-0x00000000024B0000-0x00000000024DD000-memory.dmp trickbot_loader32 behavioral2/memory/1164-135-0x0000000002480000-0x00000000024AC000-memory.dmp trickbot_loader32 behavioral2/memory/1164-136-0x00000000024B1000-0x00000000024DC000-memory.dmp trickbot_loader32 behavioral2/memory/1164-138-0x00000000024B1000-0x00000000024DC000-memory.dmp trickbot_loader32 behavioral2/memory/2832-145-0x00000000015A1000-0x00000000015CC000-memory.dmp trickbot_loader32 behavioral2/memory/2832-147-0x00000000015A1000-0x00000000015CC000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
다고서그래리즐의을처특리모그그다수있우서고이.exe다고서그래리즐의을처특리모그그다수있우서고이.exepid process 1164 다고서그래리즐의을처특리모그그다수있우서고이.exe 2832 다고서그래리즐의을처특리모그그다수있우서고이.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeTcbPrivilege 3068 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe다고서그래리즐의을처특리모그그다수있우서고이.exe다고서그래리즐의을처특리모그그다수있우서고이.exepid process 4904 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 1164 다고서그래리즐의을처특리모그그다수있우서고이.exe 2832 다고서그래리즐의을처특리모그그다수있우서고이.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe다고서그래리즐의을처특리모그그다수있우서고이.exe다고서그래리즐의을처특리모그그다수있우서고이.exedescription pid process target process PID 4904 wrote to memory of 1164 4904 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 4904 wrote to memory of 1164 4904 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 4904 wrote to memory of 1164 4904 7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe 다고서그래리즐의을처특리모그그다수있우서고이.exe PID 1164 wrote to memory of 4752 1164 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1164 wrote to memory of 4752 1164 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1164 wrote to memory of 4752 1164 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 1164 wrote to memory of 4752 1164 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 2832 wrote to memory of 3068 2832 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 2832 wrote to memory of 3068 2832 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 2832 wrote to memory of 3068 2832 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe PID 2832 wrote to memory of 3068 2832 다고서그래리즐의을처특리모그그다수있우서고이.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe"C:\Users\Admin\AppData\Local\Temp\7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exe"C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exeC:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
C:\ProgramData\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
C:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
C:\Users\Admin\AppData\Roaming\netcloud\다고서그래리즐의을처특리모그그다수있우서고이.exeFilesize
631KB
MD5a1fe38bb91804907360d23bbea35d242
SHA10d4fb2af132b6894ccea8fcaf567a59c504c2dc5
SHA2567985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
SHA5126a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
memory/1164-133-0x00000000024B0000-0x00000000024DD000-memory.dmpFilesize
180KB
-
memory/1164-135-0x0000000002480000-0x00000000024AC000-memory.dmpFilesize
176KB
-
memory/1164-136-0x00000000024B1000-0x00000000024DC000-memory.dmpFilesize
172KB
-
memory/1164-130-0x0000000000000000-mapping.dmp
-
memory/1164-138-0x00000000024B1000-0x00000000024DC000-memory.dmpFilesize
172KB
-
memory/2832-145-0x00000000015A1000-0x00000000015CC000-memory.dmpFilesize
172KB
-
memory/2832-147-0x00000000015A1000-0x00000000015CC000-memory.dmpFilesize
172KB
-
memory/3068-146-0x0000000000000000-mapping.dmp
-
memory/3068-148-0x00000216C7650000-0x00000216C766E000-memory.dmpFilesize
120KB
-
memory/3068-149-0x00000216C7650000-0x00000216C766E000-memory.dmpFilesize
120KB
-
memory/4752-140-0x000001BD151C0000-0x000001BD151DE000-memory.dmpFilesize
120KB
-
memory/4752-139-0x000001BD151C0000-0x000001BD151DE000-memory.dmpFilesize
120KB
-
memory/4752-137-0x0000000000000000-mapping.dmp