Analysis
-
max time kernel
145s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 05:03
Static task
static1
Behavioral task
behavioral1
Sample
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe
Resource
win7-20220715-en
General
-
Target
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe
-
Size
748KB
-
MD5
45ed1800167afa61cdc31a21592aff77
-
SHA1
d10f985725b1a4bcc9cc3ec66161484bc6d20db6
-
SHA256
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e
-
SHA512
b81de4d51eb64b5ccb19793f1e95c54d15b3faee5a17da429c5ff1cffb7e946c821489beb1ca026d4e4edb90dad61ea703c99d60dcfcf27128e9e5fda225ead0
Malware Config
Signatures
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/912-55-0x00000000002F0000-0x000000000031D000-memory.dmp trickbot_loader32 behavioral1/memory/912-56-0x00000000002B0000-0x00000000002DD000-memory.dmp trickbot_loader32 behavioral1/memory/912-57-0x00000000002F1000-0x000000000031D000-memory.dmp trickbot_loader32 behavioral1/memory/912-59-0x00000000002F1000-0x000000000031D000-memory.dmp trickbot_loader32 behavioral1/memory/1952-68-0x00000000003B1000-0x00000000003DD000-memory.dmp trickbot_loader32 behavioral1/memory/1952-70-0x00000000003B1000-0x00000000003DD000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exepid process 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeTcbPrivilege 1776 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exeaa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exepid process 912 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exetaskeng.exeaa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exedescription pid process target process PID 912 wrote to memory of 1768 912 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 912 wrote to memory of 1768 912 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 912 wrote to memory of 1768 912 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 912 wrote to memory of 1768 912 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 912 wrote to memory of 1768 912 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 912 wrote to memory of 1768 912 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 2028 wrote to memory of 1952 2028 taskeng.exe aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe PID 2028 wrote to memory of 1952 2028 taskeng.exe aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe PID 2028 wrote to memory of 1952 2028 taskeng.exe aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe PID 2028 wrote to memory of 1952 2028 taskeng.exe aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe PID 1952 wrote to memory of 1776 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe svchost.exe PID 1952 wrote to memory of 1776 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe svchost.exe PID 1952 wrote to memory of 1776 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe svchost.exe PID 1952 wrote to memory of 1776 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe svchost.exe PID 1952 wrote to memory of 1776 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe svchost.exe PID 1952 wrote to memory of 1776 1952 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe"C:\Users\Admin\AppData\Local\Temp\aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {0A2085D9-688E-4927-A875-9293574AAF78} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exeC:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exeFilesize
748KB
MD545ed1800167afa61cdc31a21592aff77
SHA1d10f985725b1a4bcc9cc3ec66161484bc6d20db6
SHA256aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e
SHA512b81de4d51eb64b5ccb19793f1e95c54d15b3faee5a17da429c5ff1cffb7e946c821489beb1ca026d4e4edb90dad61ea703c99d60dcfcf27128e9e5fda225ead0
-
C:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exeFilesize
748KB
MD545ed1800167afa61cdc31a21592aff77
SHA1d10f985725b1a4bcc9cc3ec66161484bc6d20db6
SHA256aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e
SHA512b81de4d51eb64b5ccb19793f1e95c54d15b3faee5a17da429c5ff1cffb7e946c821489beb1ca026d4e4edb90dad61ea703c99d60dcfcf27128e9e5fda225ead0
-
memory/912-54-0x0000000074DB1000-0x0000000074DB3000-memory.dmpFilesize
8KB
-
memory/912-55-0x00000000002F0000-0x000000000031D000-memory.dmpFilesize
180KB
-
memory/912-56-0x00000000002B0000-0x00000000002DD000-memory.dmpFilesize
180KB
-
memory/912-57-0x00000000002F1000-0x000000000031D000-memory.dmpFilesize
176KB
-
memory/912-59-0x00000000002F1000-0x000000000031D000-memory.dmpFilesize
176KB
-
memory/912-60-0x0000000010001000-0x0000000010005000-memory.dmpFilesize
16KB
-
memory/1768-62-0x0000000000060000-0x0000000000080000-memory.dmpFilesize
128KB
-
memory/1768-61-0x0000000000060000-0x0000000000080000-memory.dmpFilesize
128KB
-
memory/1768-58-0x0000000000000000-mapping.dmp
-
memory/1776-69-0x0000000000000000-mapping.dmp
-
memory/1776-71-0x0000000000060000-0x0000000000080000-memory.dmpFilesize
128KB
-
memory/1776-72-0x0000000000060000-0x0000000000080000-memory.dmpFilesize
128KB
-
memory/1952-64-0x0000000000000000-mapping.dmp
-
memory/1952-68-0x00000000003B1000-0x00000000003DD000-memory.dmpFilesize
176KB
-
memory/1952-70-0x00000000003B1000-0x00000000003DD000-memory.dmpFilesize
176KB