Analysis
-
max time kernel
39s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 22:55
Static task
static1
Behavioral task
behavioral1
Sample
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
Resource
win10v2004-20220721-en
General
-
Target
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
-
Size
380KB
-
MD5
44de98af8b6588ea597cdc95844fdda6
-
SHA1
2c222cf976ab93c63a494bab2c4bf35b0e3c894a
-
SHA256
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2
-
SHA512
cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76
Malware Config
Extracted
trickbot
1000194
ser0516
209.121.142.202:449
5.102.177.205:449
209.121.142.214:449
95.161.180.42:449
203.86.222.142:443
173.220.6.194:449
179.107.89.145:449
46.20.207.204:443
69.122.117.95:449
68.96.73.154:449
185.42.192.194:449
189.84.125.37:443
68.227.31.46:449
107.144.49.162:443
46.72.175.17:449
144.48.51.8:443
46.243.179.212:449
81.177.255.76:449
37.230.112.67:443
92.53.78.159:443
92.53.77.41:443
185.159.130.203:443
91.235.129.76:443
37.46.128.226:443
185.249.255.77:443
37.230.114.164:443
109.234.37.39:443
89.223.31.103:443
80.93.182.201:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 5 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1912-56-0x0000000000400000-0x0000000000429000-memory.dmp trickbot_loader32 behavioral1/memory/1912-57-0x0000000000401000-mapping.dmp trickbot_loader32 behavioral1/memory/1912-65-0x0000000000400000-0x0000000000429000-memory.dmp trickbot_loader32 behavioral1/memory/1600-68-0x0000000000401000-mapping.dmp trickbot_loader32 behavioral1/memory/1600-83-0x0000000000400000-0x0000000000429000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exepid process 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe -
Loads dropped DLL 2 IoCs
Processes:
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exepid process 1912 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 1912 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exedescription pid process target process PID 1936 set thread context of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1436 set thread context of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exepid process 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exedescription pid process target process PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1936 wrote to memory of 1912 1936 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe PID 1912 wrote to memory of 1436 1912 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1912 wrote to memory of 1436 1912 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1912 wrote to memory of 1436 1912 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1912 wrote to memory of 1436 1912 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1436 wrote to memory of 1600 1436 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe PID 1600 wrote to memory of 544 1600 687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exeC:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exeC:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:544
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
Filesize380KB
MD544de98af8b6588ea597cdc95844fdda6
SHA12c222cf976ab93c63a494bab2c4bf35b0e3c894a
SHA256576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2
SHA512cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76
-
C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
Filesize380KB
MD544de98af8b6588ea597cdc95844fdda6
SHA12c222cf976ab93c63a494bab2c4bf35b0e3c894a
SHA256576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2
SHA512cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76
-
C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
Filesize380KB
MD544de98af8b6588ea597cdc95844fdda6
SHA12c222cf976ab93c63a494bab2c4bf35b0e3c894a
SHA256576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2
SHA512cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76
-
\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
Filesize380KB
MD544de98af8b6588ea597cdc95844fdda6
SHA12c222cf976ab93c63a494bab2c4bf35b0e3c894a
SHA256576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2
SHA512cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76
-
\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
Filesize380KB
MD544de98af8b6588ea597cdc95844fdda6
SHA12c222cf976ab93c63a494bab2c4bf35b0e3c894a
SHA256576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2
SHA512cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76