Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 21:10
Static task
static1
Behavioral task
behavioral1
Sample
774736367468______________________________________Order 009376389.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
774736367468______________________________________Order 009376389.scr
Resource
win10v2004-20220414-en
General
-
Target
774736367468______________________________________Order 009376389.scr
-
Size
443KB
-
MD5
0da06485fe542333d67855067eed6339
-
SHA1
216a30b8cafce120917000ead51015ba56100b8c
-
SHA256
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
-
SHA512
ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
Malware Config
Extracted
trickbot
1000262
sun6
118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
168.167.87.79:443
103.111.53.126:449
182.253.20.66:449
192.188.120.164:443
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
69.9.232.167:443
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
103.111.55.218:449
62.141.94.107:443
96.43.40.221:443
197.232.50.85:443
223.25.64.119:443
185.222.202.127:443
116.212.152.12:449
107.181.174.176:443
23.94.41.215:443
107.173.102.231:443
192.252.209.44:443
107.175.127.147:443
23.226.138.169:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 4 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/1724-130-0x0000000000720000-0x000000000075D000-memory.dmp trickbot_loader32 behavioral2/memory/2184-135-0x00000000001C0000-0x00000000001FD000-memory.dmp trickbot_loader32 behavioral2/memory/1724-142-0x0000000000720000-0x000000000075D000-memory.dmp trickbot_loader32 behavioral2/memory/2184-149-0x00000000001C0000-0x00000000001FD000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
884837378479______________________________________Osdes 009387399.scrpid process 2184 884837378479______________________________________Osdes 009387399.scr -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr = "C:\\Users\\Admin\\AppData\\Roaming\\mssert\\884837378479______________________________________Osdes 009387399.scr" svchost.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ident.me 15 ident.me -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
774736367468______________________________________Order 009376389.scr884837378479______________________________________Osdes 009387399.scrdescription pid process target process PID 1724 wrote to memory of 2184 1724 774736367468______________________________________Order 009376389.scr 884837378479______________________________________Osdes 009387399.scr PID 1724 wrote to memory of 2184 1724 774736367468______________________________________Order 009376389.scr 884837378479______________________________________Osdes 009387399.scr PID 1724 wrote to memory of 2184 1724 774736367468______________________________________Order 009376389.scr 884837378479______________________________________Osdes 009387399.scr PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe PID 2184 wrote to memory of 3128 2184 884837378479______________________________________Osdes 009387399.scr svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\774736367468______________________________________Order 009376389.scr"C:\Users\Admin\AppData\Local\Temp\774736367468______________________________________Order 009376389.scr" /S1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr"C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3751123196-3323558407-1869646069-1000\0f5007522459c86e95ffcc62f32308f1_6bb404a8-25bc-4cef-a831-797f8d1e89c0Filesize
1KB
MD579f7dd9eb80049cc8bb26beee0f64e67
SHA19143322a7c1a8ed2e69044aea46c0f20cbf5f27f
SHA2562e5761cd87f6059bbe5b83324ee97e983199a8af302b8eabc51067d4cccac6e3
SHA51284cca9e48bca0bf86c8435997d5fc6da3bb5dc76c757d9edfe3ff8e2b519a9791bc349fc075c23ad960daafa86c51600e378dc3411babad38d81da1856cf8284
-
C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scrFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scrFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
memory/1724-130-0x0000000000720000-0x000000000075D000-memory.dmpFilesize
244KB
-
memory/1724-142-0x0000000000720000-0x000000000075D000-memory.dmpFilesize
244KB
-
memory/2184-131-0x0000000000000000-mapping.dmp
-
memory/2184-135-0x00000000001C0000-0x00000000001FD000-memory.dmpFilesize
244KB
-
memory/2184-137-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2184-149-0x00000000001C0000-0x00000000001FD000-memory.dmpFilesize
244KB
-
memory/3128-140-0x0000000000000000-mapping.dmp
-
memory/3128-143-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB