Analysis
-
max time kernel
150s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 04:57
Static task
static1
Behavioral task
behavioral1
Sample
95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe
Resource
win7-20220715-en
windows7-x64
7 signatures
150 seconds
General
-
Target
95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe
-
Size
405KB
-
MD5
5eb9152c121bd89e77778b5bf2dfefe2
-
SHA1
b94b34144bb54dec5b1311d84d76888b8b544318
-
SHA256
95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e
-
SHA512
3967823d9645d7dfb6e0878cf5d2f19883c70cc157c15097de16f3732416b545a9c286edf2d1f43954553e61b746e0b356332c0f89b6c7681676057973ea9f9b
Malware Config
Signatures
-
Trickbot x86 loader 3 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1900-55-0x0000000000270000-0x0000000000279000-memory.dmp trickbot_loader32 behavioral1/memory/1900-56-0x0000000000270000-0x0000000000279000-memory.dmp trickbot_loader32 behavioral1/memory/1900-58-0x0000000000270000-0x0000000000279000-memory.dmp trickbot_loader32 -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1768 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exepid process 1900 95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.execmd.exedescription pid process target process PID 1900 wrote to memory of 1708 1900 95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe cmd.exe PID 1900 wrote to memory of 1708 1900 95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe cmd.exe PID 1900 wrote to memory of 1708 1900 95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe cmd.exe PID 1900 wrote to memory of 1708 1900 95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe cmd.exe PID 1708 wrote to memory of 1768 1708 cmd.exe powershell.exe PID 1708 wrote to memory of 1768 1708 cmd.exe powershell.exe PID 1708 wrote to memory of 1768 1708 cmd.exe powershell.exe PID 1708 wrote to memory of 1768 1708 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe"C:\Users\Admin\AppData\Local\Temp\95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C PowerShell "Start-Sleep 10; Remove-Item C:\Users\Admin\AppData\Local\Temp\95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowerShell "Start-Sleep 10; Remove-Item C:\Users\Admin\AppData\Local\Temp\95dfe53ddb3cfbce26e4bf486d30d43fff156fb4a883beec5e25c39efef4d37e.exe"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-57-0x0000000000000000-mapping.dmp
-
memory/1768-59-0x0000000000000000-mapping.dmp
-
memory/1768-61-0x0000000074430000-0x00000000749DB000-memory.dmpFilesize
5.7MB
-
memory/1768-62-0x0000000074430000-0x00000000749DB000-memory.dmpFilesize
5.7MB
-
memory/1900-54-0x00000000760E1000-0x00000000760E3000-memory.dmpFilesize
8KB
-
memory/1900-55-0x0000000000270000-0x0000000000279000-memory.dmpFilesize
36KB
-
memory/1900-56-0x0000000000270000-0x0000000000279000-memory.dmpFilesize
36KB
-
memory/1900-58-0x0000000000270000-0x0000000000279000-memory.dmpFilesize
36KB