Analysis

  • max time kernel
    39s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 22:55

General

  • Target

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe

  • Size

    380KB

  • MD5

    44de98af8b6588ea597cdc95844fdda6

  • SHA1

    2c222cf976ab93c63a494bab2c4bf35b0e3c894a

  • SHA256

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

  • SHA512

    cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

Malware Config

Extracted

Family

trickbot

Version

1000194

Botnet

ser0516

C2

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

173.220.6.194:449

179.107.89.145:449

46.20.207.204:443

69.122.117.95:449

68.96.73.154:449

185.42.192.194:449

189.84.125.37:443

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449

37.230.112.67:443

92.53.78.159:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 5 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
    "C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
      "C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
        C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
          C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1600
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:544

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
      Filesize

      380KB

      MD5

      44de98af8b6588ea597cdc95844fdda6

      SHA1

      2c222cf976ab93c63a494bab2c4bf35b0e3c894a

      SHA256

      576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

      SHA512

      cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

    • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
      Filesize

      380KB

      MD5

      44de98af8b6588ea597cdc95844fdda6

      SHA1

      2c222cf976ab93c63a494bab2c4bf35b0e3c894a

      SHA256

      576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

      SHA512

      cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

    • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
      Filesize

      380KB

      MD5

      44de98af8b6588ea597cdc95844fdda6

      SHA1

      2c222cf976ab93c63a494bab2c4bf35b0e3c894a

      SHA256

      576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

      SHA512

      cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

    • \Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
      Filesize

      380KB

      MD5

      44de98af8b6588ea597cdc95844fdda6

      SHA1

      2c222cf976ab93c63a494bab2c4bf35b0e3c894a

      SHA256

      576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

      SHA512

      cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

    • \Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
      Filesize

      380KB

      MD5

      44de98af8b6588ea597cdc95844fdda6

      SHA1

      2c222cf976ab93c63a494bab2c4bf35b0e3c894a

      SHA256

      576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

      SHA512

      cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

    • memory/544-77-0x0000000140000000-0x0000000140023000-memory.dmp
      Filesize

      140KB

    • memory/544-75-0x0000000000000000-mapping.dmp
    • memory/1436-61-0x0000000000000000-mapping.dmp
    • memory/1600-68-0x0000000000401000-mapping.dmp
    • memory/1600-72-0x0000000010000000-0x0000000010007000-memory.dmp
      Filesize

      28KB

    • memory/1600-83-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1912-65-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1912-56-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1912-58-0x0000000075D01000-0x0000000075D03000-memory.dmp
      Filesize

      8KB

    • memory/1912-57-0x0000000000401000-mapping.dmp