Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 05:03
Static task
static1
Behavioral task
behavioral1
Sample
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe
Resource
win7-20220715-en
General
-
Target
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe
-
Size
748KB
-
MD5
45ed1800167afa61cdc31a21592aff77
-
SHA1
d10f985725b1a4bcc9cc3ec66161484bc6d20db6
-
SHA256
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e
-
SHA512
b81de4d51eb64b5ccb19793f1e95c54d15b3faee5a17da429c5ff1cffb7e946c821489beb1ca026d4e4edb90dad61ea703c99d60dcfcf27128e9e5fda225ead0
Malware Config
Signatures
-
Trickbot x86 loader 4 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/3980-130-0x00000000023C0000-0x00000000023ED000-memory.dmp trickbot_loader32 behavioral2/memory/3980-131-0x0000000002390000-0x00000000023BD000-memory.dmp trickbot_loader32 behavioral2/memory/3980-132-0x00000000023C1000-0x00000000023ED000-memory.dmp trickbot_loader32 behavioral2/memory/3980-134-0x00000000023C1000-0x00000000023ED000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exepid process 1744 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exeaa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exepid process 3980 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe 1744 aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exedescription pid process target process PID 3980 wrote to memory of 4832 3980 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 3980 wrote to memory of 4832 3980 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 3980 wrote to memory of 4832 3980 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe PID 3980 wrote to memory of 4832 3980 aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe"C:\Users\Admin\AppData\Local\Temp\aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exeC:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exeFilesize
748KB
MD545ed1800167afa61cdc31a21592aff77
SHA1d10f985725b1a4bcc9cc3ec66161484bc6d20db6
SHA256aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e
SHA512b81de4d51eb64b5ccb19793f1e95c54d15b3faee5a17da429c5ff1cffb7e946c821489beb1ca026d4e4edb90dad61ea703c99d60dcfcf27128e9e5fda225ead0
-
C:\Users\Admin\AppData\Roaming\taskhealth\aa1099c3aa7a8ff0a4db47c4d4991fabe3997948a833038e982d37d1f47e2b4e.exeFilesize
748KB
MD545ed1800167afa61cdc31a21592aff77
SHA1d10f985725b1a4bcc9cc3ec66161484bc6d20db6
SHA256aa1079c3aa5a6ff0a4db45c4d4771fabe3775746a633036e982d35d1f45e2b4e
SHA512b81de4d51eb64b5ccb19793f1e95c54d15b3faee5a17da429c5ff1cffb7e946c821489beb1ca026d4e4edb90dad61ea703c99d60dcfcf27128e9e5fda225ead0
-
memory/3980-130-0x00000000023C0000-0x00000000023ED000-memory.dmpFilesize
180KB
-
memory/3980-131-0x0000000002390000-0x00000000023BD000-memory.dmpFilesize
180KB
-
memory/3980-132-0x00000000023C1000-0x00000000023ED000-memory.dmpFilesize
176KB
-
memory/3980-135-0x0000000010001000-0x0000000010005000-memory.dmpFilesize
16KB
-
memory/3980-134-0x00000000023C1000-0x00000000023ED000-memory.dmpFilesize
176KB
-
memory/4832-133-0x0000000000000000-mapping.dmp
-
memory/4832-136-0x0000029C98370000-0x0000029C98390000-memory.dmpFilesize
128KB
-
memory/4832-137-0x0000029C98370000-0x0000029C98390000-memory.dmpFilesize
128KB