Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2022 22:55

General

  • Target

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe

  • Size

    380KB

  • MD5

    44de98af8b6588ea597cdc95844fdda6

  • SHA1

    2c222cf976ab93c63a494bab2c4bf35b0e3c894a

  • SHA256

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

  • SHA512

    cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

Malware Config

Extracted

Family

trickbot

Version

1000194

Botnet

ser0516

C2

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

173.220.6.194:449

179.107.89.145:449

46.20.207.204:443

69.122.117.95:449

68.96.73.154:449

185.42.192.194:449

189.84.125.37:443

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449

37.230.112.67:443

92.53.78.159:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 5 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
    "C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
      "C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
        C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
          C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
            • Adds Run key to start application
            PID:2308

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
    Filesize

    380KB

    MD5

    44de98af8b6588ea597cdc95844fdda6

    SHA1

    2c222cf976ab93c63a494bab2c4bf35b0e3c894a

    SHA256

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

    SHA512

    cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

  • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
    Filesize

    380KB

    MD5

    44de98af8b6588ea597cdc95844fdda6

    SHA1

    2c222cf976ab93c63a494bab2c4bf35b0e3c894a

    SHA256

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

    SHA512

    cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

  • C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
    Filesize

    380KB

    MD5

    44de98af8b6588ea597cdc95844fdda6

    SHA1

    2c222cf976ab93c63a494bab2c4bf35b0e3c894a

    SHA256

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

    SHA512

    cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

  • memory/568-134-0x0000000000000000-mapping.dmp
  • memory/1948-132-0x0000000000000000-mapping.dmp
  • memory/1948-133-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1948-139-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/2276-140-0x0000000000000000-mapping.dmp
  • memory/2276-144-0x0000000010000000-0x0000000010007000-memory.dmp
    Filesize

    28KB

  • memory/2276-155-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/2308-147-0x0000000000000000-mapping.dmp
  • memory/2308-149-0x0000000140000000-0x0000000140023000-memory.dmp
    Filesize

    140KB