Analysis
-
max time kernel
131s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe
Resource
win7-20220718-en
General
-
Target
6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe
-
Size
720KB
-
MD5
67203088526a6681ced778e2cf2fd2ed
-
SHA1
6731062c32e4fa15c3c3bcb2b4b9661efff05054
-
SHA256
6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11
-
SHA512
365565ca379ec0add4f5de704ae0a78d727cf05c191e6847806f99b5e4d67abe2d33a5a7298625baf56451f5e783ade04173d7eb54727643e9f3e66ad8e91764
Malware Config
Signatures
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1960-61-0x0000000000380000-0x00000000003AD000-memory.dmp trickbot_loader32 behavioral1/memory/1960-63-0x0000000000350000-0x000000000037C000-memory.dmp trickbot_loader32 behavioral1/memory/1960-64-0x0000000000381000-0x00000000003AC000-memory.dmp trickbot_loader32 behavioral1/memory/1960-66-0x0000000000381000-0x00000000003AC000-memory.dmp trickbot_loader32 behavioral1/memory/1168-75-0x0000000000681000-0x00000000006AC000-memory.dmp trickbot_loader32 behavioral1/memory/1168-77-0x0000000000681000-0x00000000006AC000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
جللدشتادنالرهعلةلحيللشائاأظر.exeجللدشتادنالرهعلةلحيللشائاأظر.exepid process 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe -
Loads dropped DLL 2 IoCs
Processes:
6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exepid process 1612 6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe 1612 6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exeجللدشتادنالرهعلةلحيللشائاأظر.exeجللدشتادنالرهعلةلحيللشائاأظر.exepid process 1612 6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exeجللدشتادنالرهعلةلحيللشائاأظر.exetaskeng.exeجللدشتادنالرهعلةلحيللشائاأظر.exedescription pid process target process PID 1612 wrote to memory of 1960 1612 6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1612 wrote to memory of 1960 1612 6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1612 wrote to memory of 1960 1612 6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1612 wrote to memory of 1960 1612 6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1960 wrote to memory of 1172 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1960 wrote to memory of 1172 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1960 wrote to memory of 1172 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1960 wrote to memory of 1172 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1960 wrote to memory of 1172 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1960 wrote to memory of 1172 1960 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1332 wrote to memory of 1168 1332 taskeng.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1332 wrote to memory of 1168 1332 taskeng.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1332 wrote to memory of 1168 1332 taskeng.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1332 wrote to memory of 1168 1332 taskeng.exe جللدشتادنالرهعلةلحيللشائاأظر.exe PID 1168 wrote to memory of 1496 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1168 wrote to memory of 1496 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1168 wrote to memory of 1496 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1168 wrote to memory of 1496 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1168 wrote to memory of 1496 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe PID 1168 wrote to memory of 1496 1168 جللدشتادنالرهعلةلحيللشائاأظر.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe"C:\Users\Admin\AppData\Local\Temp\6d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\جللدشتادنالرهعلةلحيللشائاأظر.exe"C:\ProgramData\جللدشتادنالرهعلةلحيللشائاأظر.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {DCE47A01-1C56-485E-8BF1-9BDB7FAEA887} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\netcloud\جللدشتادنالرهعلةلحيللشائاأظر.exeC:\Users\Admin\AppData\Roaming\netcloud\جللدشتادنالرهعلةلحيللشائاأظر.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\جللدشتادنالرهعلةلحيللشائاأظر.exeFilesize
720KB
MD567203088526a6681ced778e2cf2fd2ed
SHA16731062c32e4fa15c3c3bcb2b4b9661efff05054
SHA2566d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11
SHA512365565ca379ec0add4f5de704ae0a78d727cf05c191e6847806f99b5e4d67abe2d33a5a7298625baf56451f5e783ade04173d7eb54727643e9f3e66ad8e91764
-
C:\ProgramData\جللدشتادنالرهعلةلحيللشائاأظر.exeFilesize
720KB
MD567203088526a6681ced778e2cf2fd2ed
SHA16731062c32e4fa15c3c3bcb2b4b9661efff05054
SHA2566d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11
SHA512365565ca379ec0add4f5de704ae0a78d727cf05c191e6847806f99b5e4d67abe2d33a5a7298625baf56451f5e783ade04173d7eb54727643e9f3e66ad8e91764
-
C:\Users\Admin\AppData\Roaming\netcloud\جللدشتادنالرهعلةلحيللشائاأظر.exeFilesize
720KB
MD567203088526a6681ced778e2cf2fd2ed
SHA16731062c32e4fa15c3c3bcb2b4b9661efff05054
SHA2566d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11
SHA512365565ca379ec0add4f5de704ae0a78d727cf05c191e6847806f99b5e4d67abe2d33a5a7298625baf56451f5e783ade04173d7eb54727643e9f3e66ad8e91764
-
C:\Users\Admin\AppData\Roaming\netcloud\جللدشتادنالرهعلةلحيللشائاأظر.exeFilesize
720KB
MD567203088526a6681ced778e2cf2fd2ed
SHA16731062c32e4fa15c3c3bcb2b4b9661efff05054
SHA2566d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11
SHA512365565ca379ec0add4f5de704ae0a78d727cf05c191e6847806f99b5e4d67abe2d33a5a7298625baf56451f5e783ade04173d7eb54727643e9f3e66ad8e91764
-
\ProgramData\جللدشتادنالرهعلةلحيللشائاأظر.exeFilesize
720KB
MD567203088526a6681ced778e2cf2fd2ed
SHA16731062c32e4fa15c3c3bcb2b4b9661efff05054
SHA2566d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11
SHA512365565ca379ec0add4f5de704ae0a78d727cf05c191e6847806f99b5e4d67abe2d33a5a7298625baf56451f5e783ade04173d7eb54727643e9f3e66ad8e91764
-
\ProgramData\جللدشتادنالرهعلةلحيللشائاأظر.exeFilesize
720KB
MD567203088526a6681ced778e2cf2fd2ed
SHA16731062c32e4fa15c3c3bcb2b4b9661efff05054
SHA2566d263f4f692de3e26ef3aa2e9152e9294696e6a15c4c39e7c14d53c861e79b11
SHA512365565ca379ec0add4f5de704ae0a78d727cf05c191e6847806f99b5e4d67abe2d33a5a7298625baf56451f5e783ade04173d7eb54727643e9f3e66ad8e91764
-
memory/1168-70-0x0000000000000000-mapping.dmp
-
memory/1168-77-0x0000000000681000-0x00000000006AC000-memory.dmpFilesize
172KB
-
memory/1168-75-0x0000000000681000-0x00000000006AC000-memory.dmpFilesize
172KB
-
memory/1172-65-0x0000000000000000-mapping.dmp
-
memory/1172-67-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1172-68-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1496-78-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB
-
memory/1496-76-0x0000000000000000-mapping.dmp
-
memory/1612-54-0x0000000075E21000-0x0000000075E23000-memory.dmpFilesize
8KB
-
memory/1960-66-0x0000000000381000-0x00000000003AC000-memory.dmpFilesize
172KB
-
memory/1960-57-0x0000000000000000-mapping.dmp
-
memory/1960-61-0x0000000000380000-0x00000000003AD000-memory.dmpFilesize
180KB
-
memory/1960-63-0x0000000000350000-0x000000000037C000-memory.dmpFilesize
176KB
-
memory/1960-64-0x0000000000381000-0x00000000003AC000-memory.dmpFilesize
172KB