Analysis
-
max time kernel
40s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 21:10
Static task
static1
Behavioral task
behavioral1
Sample
774736367468______________________________________Order 009376389.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
774736367468______________________________________Order 009376389.scr
Resource
win10v2004-20220414-en
General
-
Target
774736367468______________________________________Order 009376389.scr
-
Size
443KB
-
MD5
0da06485fe542333d67855067eed6339
-
SHA1
216a30b8cafce120917000ead51015ba56100b8c
-
SHA256
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
-
SHA512
ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
Malware Config
Extracted
trickbot
1000262
sun6
118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
168.167.87.79:443
103.111.53.126:449
182.253.20.66:449
192.188.120.164:443
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
69.9.232.167:443
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
103.111.55.218:449
62.141.94.107:443
96.43.40.221:443
197.232.50.85:443
223.25.64.119:443
185.222.202.127:443
116.212.152.12:449
107.181.174.176:443
23.94.41.215:443
107.173.102.231:443
192.252.209.44:443
107.175.127.147:443
23.226.138.169:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 2 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1756-66-0x00000000005D0000-0x000000000060D000-memory.dmp trickbot_loader32 behavioral1/memory/2024-82-0x00000000004C0000-0x00000000004FD000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
884837378479______________________________________Osdes 009387399.scrpid process 2024 884837378479______________________________________Osdes 009387399.scr -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
774736367468______________________________________Order 009376389.scrpid process 1756 774736367468______________________________________Order 009376389.scr 1756 774736367468______________________________________Order 009376389.scr -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 1308 sc.exe 1772 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
774736367468______________________________________Order 009376389.scrpowershell.exepid process 1756 774736367468______________________________________Order 009376389.scr 1756 774736367468______________________________________Order 009376389.scr 1756 774736367468______________________________________Order 009376389.scr 1956 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1956 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
774736367468______________________________________Order 009376389.scrcmd.execmd.execmd.exe884837378479______________________________________Osdes 009387399.scrdescription pid process target process PID 1756 wrote to memory of 824 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 824 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 824 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 824 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 940 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 940 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 940 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 940 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 1212 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 1212 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 1212 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 1212 1756 774736367468______________________________________Order 009376389.scr cmd.exe PID 1756 wrote to memory of 2024 1756 774736367468______________________________________Order 009376389.scr 884837378479______________________________________Osdes 009387399.scr PID 1756 wrote to memory of 2024 1756 774736367468______________________________________Order 009376389.scr 884837378479______________________________________Osdes 009387399.scr PID 1756 wrote to memory of 2024 1756 774736367468______________________________________Order 009376389.scr 884837378479______________________________________Osdes 009387399.scr PID 1756 wrote to memory of 2024 1756 774736367468______________________________________Order 009376389.scr 884837378479______________________________________Osdes 009387399.scr PID 824 wrote to memory of 1308 824 cmd.exe sc.exe PID 824 wrote to memory of 1308 824 cmd.exe sc.exe PID 824 wrote to memory of 1308 824 cmd.exe sc.exe PID 824 wrote to memory of 1308 824 cmd.exe sc.exe PID 1212 wrote to memory of 1956 1212 cmd.exe powershell.exe PID 1212 wrote to memory of 1956 1212 cmd.exe powershell.exe PID 1212 wrote to memory of 1956 1212 cmd.exe powershell.exe PID 1212 wrote to memory of 1956 1212 cmd.exe powershell.exe PID 940 wrote to memory of 1772 940 cmd.exe sc.exe PID 940 wrote to memory of 1772 940 cmd.exe sc.exe PID 940 wrote to memory of 1772 940 cmd.exe sc.exe PID 940 wrote to memory of 1772 940 cmd.exe sc.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2024 wrote to memory of 1136 2024 884837378479______________________________________Osdes 009387399.scr svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\774736367468______________________________________Order 009376389.scr"C:\Users\Admin\AppData\Local\Temp\774736367468______________________________________Order 009376389.scr" /S1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:1308 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:1772 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956 -
C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr"C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1136
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2277218442-1199762539-2004043321-1000\0f5007522459c86e95ffcc62f32308f1_4cab856c-2ae4-4cbd-8a04-329969ee64daFilesize
1KB
MD5f934af3adadd4b5f8be3932721bde166
SHA104224ff80079d09a0b5853ffa8c86d9dea0c74bb
SHA256816ec709597c21b80372c5348eafdd71f8923da389d383e304edbf5b715630c2
SHA5121173f4240c18d253addc20f66a24614ec19b5079bf15f99880b67f31555f74c5418860f84c11c3952b0b7450d8df492f2bbcb03e1f9e2faabc58ddc1007224d4
-
C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scrFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scrFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scrFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
memory/824-55-0x0000000000000000-mapping.dmp
-
memory/940-56-0x0000000000000000-mapping.dmp
-
memory/1136-74-0x0000000000000000-mapping.dmp
-
memory/1136-76-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/1212-57-0x0000000000000000-mapping.dmp
-
memory/1308-62-0x0000000000000000-mapping.dmp
-
memory/1756-66-0x00000000005D0000-0x000000000060D000-memory.dmpFilesize
244KB
-
memory/1756-54-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB
-
memory/1772-64-0x0000000000000000-mapping.dmp
-
memory/1956-67-0x0000000073D20000-0x00000000742CB000-memory.dmpFilesize
5.7MB
-
memory/1956-63-0x0000000000000000-mapping.dmp
-
memory/1956-83-0x0000000073D20000-0x00000000742CB000-memory.dmpFilesize
5.7MB
-
memory/2024-71-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2024-60-0x0000000000000000-mapping.dmp
-
memory/2024-82-0x00000000004C0000-0x00000000004FD000-memory.dmpFilesize
244KB