Analysis
- max time kernel
116s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
08/07/2022, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
sefff993.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target sefff993.exe
- Size 368KB
- Sample220708-lcf2dsbbem
- SHA256 b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172
- MD5 8402ab33eafb84178069f8f490ca604d
- SHA1 516c7a538e93f7cf4bff29196511f94e5fbb5a40
- SHA512 ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97
- MD5 SHA1 SHA512
Malware Config
Signatures
- Trickbot x86 loader 4 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/4516-130-0x0000000000CE0000-0x0000000000D09000-memory.dmp trickbot_loader32 behavioral2/memory/4516-135-0x0000000000CE0000-0x0000000000D09000-memory.dmp trickbot_loader32 behavioral2/memory/4504-146-0x0000000001410000-0x0000000001439000-memory.dmp trickbot_loader32 behavioral2/memory/632-158-0x0000000001210000-0x0000000001239000-memory.dmp trickbot_loader32 - Executes dropped EXE 2 IoCs
pid Process 4504 tefff993.exe 632 tefff993.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 632 tefff993.exe - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4504 4516 sefff993.exe 84 PID 4516 wrote to memory of 4504 4516 sefff993.exe 84 PID 4516 wrote to memory of 4504 4516 sefff993.exe 84 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 4504 wrote to memory of 4088 4504 tefff993.exe 85 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96 PID 632 wrote to memory of 4784 632 tefff993.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\sefff993.exe"C:\Users\Admin\AppData\Local\Temp\sefff993.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Roaming\WNetval\tefff993.exeC:\Users\Admin\AppData\Roaming\WNetval\tefff993.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4088
-
-
-
C:\Users\Admin\AppData\Roaming\WNetval\tefff993.exeC:\Users\Admin\AppData\Roaming\WNetval\tefff993.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4784
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1809750270-3141839489-3074374771-1000\0f5007522459c86e95ffcc62f32308f1_2c7a2658-1166-4e8e-b7f6-c01b4ff97801
- Size 1KB
- SHA256 20a3cbf8fb352aac9d01b0a4498ca8629ba0312f2c2d1e1d865444aaacb098a1
- MD5 bf059185a6c26b0e282f40dd425748f4
- SHA1 2820254cac8d066f545f2cfc5a13196785742b9b
- SHA512 5481bcfd70ede59a72aecd315e1cb692b0b06d7bc4b1b5f51ad33b5fd4e6a0927ae9b604370d8bbe362a802b65db30f195e843f495566233f08b9a5a624eb30a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\WNetval\tefff993.exe
- Size 368KB
- SHA256 b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172
- MD5 8402ab33eafb84178069f8f490ca604d
- SHA1 516c7a538e93f7cf4bff29196511f94e5fbb5a40
- SHA512 ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97
- SSDEEP 6144:jo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:jmSuOcHmnYhrDMTrban4qM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\WNetval\tefff993.exe
- Size 368KB
- SHA256 b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172
- MD5 8402ab33eafb84178069f8f490ca604d
- SHA1 516c7a538e93f7cf4bff29196511f94e5fbb5a40
- SHA512 ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97
- SSDEEP 6144:jo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:jmSuOcHmnYhrDMTrban4qM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\WNetval\tefff993.exe
- Size 368KB
- SHA256 b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172
- MD5 8402ab33eafb84178069f8f490ca604d
- SHA1 516c7a538e93f7cf4bff29196511f94e5fbb5a40
- SHA512 ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97
- SSDEEP 6144:jo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:jmSuOcHmnYhrDMTrban4qM
- MD5 SHA1 SHA512 SSDEEP