Analysis

  • max time kernel
    150s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    07-07-2022 21:10

General

  • Target

    774736367468______________________________________Order 009376389.scr

  • Size

    443KB

  • MD5

    0da06485fe542333d67855067eed6339

  • SHA1

    216a30b8cafce120917000ead51015ba56100b8c

  • SHA256

    3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605

  • SHA512

    ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12

Malware Config

Extracted

Family

trickbot

Version

1000262

Botnet

sun6

C2

118.97.119.218:449

94.181.47.198:449

144.121.143.129:449

185.200.60.138:449

185.42.52.126:449

181.174.112.74:449

178.116.83.49:443

121.58.242.206:449

182.50.64.148:449

82.222.40.119:449

97.78.222.18:449

67.79.15.106:449

168.167.87.79:443

103.111.53.126:449

182.253.20.66:449

192.188.120.164:443

81.17.86.112:443

95.154.80.154:449

46.149.182.112:449

69.9.232.167:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 4 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\774736367468______________________________________Order 009376389.scr
    "C:\Users\Admin\AppData\Local\Temp\774736367468______________________________________Order 009376389.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr
      "C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Adds Run key to start application
        PID:3128

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3751123196-3323558407-1869646069-1000\0f5007522459c86e95ffcc62f32308f1_6bb404a8-25bc-4cef-a831-797f8d1e89c0
    Filesize

    1KB

    MD5

    79f7dd9eb80049cc8bb26beee0f64e67

    SHA1

    9143322a7c1a8ed2e69044aea46c0f20cbf5f27f

    SHA256

    2e5761cd87f6059bbe5b83324ee97e983199a8af302b8eabc51067d4cccac6e3

    SHA512

    84cca9e48bca0bf86c8435997d5fc6da3bb5dc76c757d9edfe3ff8e2b519a9791bc349fc075c23ad960daafa86c51600e378dc3411babad38d81da1856cf8284

  • C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr
    Filesize

    443KB

    MD5

    0da06485fe542333d67855067eed6339

    SHA1

    216a30b8cafce120917000ead51015ba56100b8c

    SHA256

    3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605

    SHA512

    ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12

  • C:\Users\Admin\AppData\Roaming\mssert\884837378479______________________________________Osdes 009387399.scr
    Filesize

    443KB

    MD5

    0da06485fe542333d67855067eed6339

    SHA1

    216a30b8cafce120917000ead51015ba56100b8c

    SHA256

    3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605

    SHA512

    ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12

  • memory/1724-130-0x0000000000720000-0x000000000075D000-memory.dmp
    Filesize

    244KB

  • memory/1724-142-0x0000000000720000-0x000000000075D000-memory.dmp
    Filesize

    244KB

  • memory/2184-131-0x0000000000000000-mapping.dmp
  • memory/2184-135-0x00000000001C0000-0x00000000001FD000-memory.dmp
    Filesize

    244KB

  • memory/2184-137-0x0000000010000000-0x0000000010007000-memory.dmp
    Filesize

    28KB

  • memory/2184-149-0x00000000001C0000-0x00000000001FD000-memory.dmp
    Filesize

    244KB

  • memory/3128-140-0x0000000000000000-mapping.dmp
  • memory/3128-143-0x0000000140000000-0x0000000140035000-memory.dmp
    Filesize

    212KB