Analysis
-
max time kernel
66s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 06:55
Static task
static1
Behavioral task
behavioral1
Sample
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe
Resource
win7-20220718-en
General
-
Target
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe
-
Size
365KB
-
MD5
f29bc2a03740daf8e403b23c8d920cf7
-
SHA1
ace92a37574960979f9ad6e8bff4cfb385590e3d
-
SHA256
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165
-
SHA512
2b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44
Malware Config
Signatures
-
Trickbot x86 loader 2 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2008-61-0x0000000000360000-0x0000000000389000-memory.dmp trickbot_loader32 behavioral1/memory/2020-81-0x0000000000360000-0x0000000000389000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exepid process 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exepid process 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 1160 sc.exe 1736 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exepowershell.exepid process 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 1732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1732 powershell.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.execmd.execmd.execmd.exe701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exedescription pid process target process PID 2008 wrote to memory of 1268 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 1268 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 1268 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 1268 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 844 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 844 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 844 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 844 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 1124 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 1124 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 1124 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 1124 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe cmd.exe PID 2008 wrote to memory of 2020 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe PID 2008 wrote to memory of 2020 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe PID 2008 wrote to memory of 2020 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe PID 2008 wrote to memory of 2020 2008 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe PID 844 wrote to memory of 1736 844 cmd.exe sc.exe PID 844 wrote to memory of 1736 844 cmd.exe sc.exe PID 844 wrote to memory of 1736 844 cmd.exe sc.exe PID 844 wrote to memory of 1736 844 cmd.exe sc.exe PID 1268 wrote to memory of 1160 1268 cmd.exe sc.exe PID 1268 wrote to memory of 1160 1268 cmd.exe sc.exe PID 1268 wrote to memory of 1160 1268 cmd.exe sc.exe PID 1268 wrote to memory of 1160 1268 cmd.exe sc.exe PID 1124 wrote to memory of 1732 1124 cmd.exe powershell.exe PID 1124 wrote to memory of 1732 1124 cmd.exe powershell.exe PID 1124 wrote to memory of 1732 1124 cmd.exe powershell.exe PID 1124 wrote to memory of 1732 1124 cmd.exe powershell.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe PID 2020 wrote to memory of 1452 2020 701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe"C:\Users\Admin\AppData\Local\Temp\601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exeC:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3762437355-3468409815-1164039494-1000\0f5007522459c86e95ffcc62f32308f1_327f7753-eed3-43ec-871a-c7bcf65868ecFilesize
1KB
MD5dfb2728bf5d8834ecf93546e0f9bd440
SHA15714f482d378f03e9b47c8f25bdb05a3ea2fc93d
SHA256e38b008f3ca39a5a47896f2d4ba7ce48b37395fdfeec4445682de2860d44492f
SHA512d094fb2d065d3fd3aac8d12c77b979276e830d917bac090c925043fce3ef343d87f044c2f5774434c97b8be81f36e48c4f54072ee382e2d0ca689478aab7d18a
-
C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exeFilesize
365KB
MD5f29bc2a03740daf8e403b23c8d920cf7
SHA1ace92a37574960979f9ad6e8bff4cfb385590e3d
SHA256601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165
SHA5122b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44
-
\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exeFilesize
365KB
MD5f29bc2a03740daf8e403b23c8d920cf7
SHA1ace92a37574960979f9ad6e8bff4cfb385590e3d
SHA256601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165
SHA5122b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44
-
\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exeFilesize
365KB
MD5f29bc2a03740daf8e403b23c8d920cf7
SHA1ace92a37574960979f9ad6e8bff4cfb385590e3d
SHA256601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165
SHA5122b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44
-
memory/844-56-0x0000000000000000-mapping.dmp
-
memory/1124-57-0x0000000000000000-mapping.dmp
-
memory/1160-64-0x0000000000000000-mapping.dmp
-
memory/1268-55-0x0000000000000000-mapping.dmp
-
memory/1452-75-0x0000000000000000-mapping.dmp
-
memory/1452-77-0x0000000010000000-0x000000001001F000-memory.dmpFilesize
124KB
-
memory/1732-67-0x0000000073F90000-0x000000007453B000-memory.dmpFilesize
5.7MB
-
memory/1732-65-0x0000000000000000-mapping.dmp
-
memory/1732-70-0x0000000073F90000-0x000000007453B000-memory.dmpFilesize
5.7MB
-
memory/1736-63-0x0000000000000000-mapping.dmp
-
memory/2008-54-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/2008-61-0x0000000000360000-0x0000000000389000-memory.dmpFilesize
164KB
-
memory/2020-60-0x0000000000000000-mapping.dmp
-
memory/2020-72-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2020-81-0x0000000000360000-0x0000000000389000-memory.dmpFilesize
164KB