Analysis
-
max time kernel
69s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 14:32
Static task
static1
Behavioral task
behavioral1
Sample
baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe
Resource
win7-20220718-en
windows7-x64
8 signatures
150 seconds
General
-
Target
baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe
-
Size
422KB
-
MD5
2fa5b98de882a2c9015efdcfdd88be65
-
SHA1
0a454b220eea65bd757acb937c0ed2e745e148fd
-
SHA256
baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca
-
SHA512
9e3a5483acaf0cb97eff62fad04c8c6887a1e660af6e54f18304dd9905d9dd4f601f1df016840a438f1c85cfc260537c562d0def99159082cf525d93456f3b66
Malware Config
Signatures
-
Trickbot x86 loader 2 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4228-132-0x0000000000680000-0x0000000000689000-memory.dmp trickbot_loader32 behavioral2/memory/4228-134-0x0000000000680000-0x0000000000689000-memory.dmp trickbot_loader32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 5044 powershell.exe 5044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 5044 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exepid process 4228 baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.execmd.exedescription pid process target process PID 4228 wrote to memory of 4224 4228 baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe cmd.exe PID 4228 wrote to memory of 4224 4228 baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe cmd.exe PID 4228 wrote to memory of 4224 4228 baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe cmd.exe PID 4224 wrote to memory of 5044 4224 cmd.exe powershell.exe PID 4224 wrote to memory of 5044 4224 cmd.exe powershell.exe PID 4224 wrote to memory of 5044 4224 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe"C:\Users\Admin\AppData\Local\Temp\baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C PowerShell "Start-Sleep 10; Remove-Item C:\Users\Admin\AppData\Local\Temp\baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell "Start-Sleep 10; Remove-Item C:\Users\Admin\AppData\Local\Temp\baa80c291a9fbc8c5d70a0183385bed0b90d2792b8e5130cd399237d364c1fca.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4224-133-0x0000000000000000-mapping.dmp
-
memory/4228-132-0x0000000000680000-0x0000000000689000-memory.dmpFilesize
36KB
-
memory/4228-134-0x0000000000680000-0x0000000000689000-memory.dmpFilesize
36KB
-
memory/5044-138-0x0000000004950000-0x0000000004972000-memory.dmpFilesize
136KB
-
memory/5044-136-0x0000000002120000-0x0000000002156000-memory.dmpFilesize
216KB
-
memory/5044-137-0x0000000004C80000-0x00000000052A8000-memory.dmpFilesize
6.2MB
-
memory/5044-135-0x0000000000000000-mapping.dmp
-
memory/5044-139-0x0000000005320000-0x0000000005386000-memory.dmpFilesize
408KB
-
memory/5044-140-0x0000000005400000-0x0000000005466000-memory.dmpFilesize
408KB
-
memory/5044-141-0x0000000005A20000-0x0000000005A3E000-memory.dmpFilesize
120KB
-
memory/5044-142-0x0000000007150000-0x00000000077CA000-memory.dmpFilesize
6.5MB
-
memory/5044-143-0x0000000006AF0000-0x0000000006B0A000-memory.dmpFilesize
104KB
-
memory/5044-144-0x0000000006CD0000-0x0000000006D66000-memory.dmpFilesize
600KB
-
memory/5044-145-0x0000000006C60000-0x0000000006C82000-memory.dmpFilesize
136KB
-
memory/5044-146-0x0000000007D80000-0x0000000008324000-memory.dmpFilesize
5.6MB