Analysis
-
max time kernel
32s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 16:01
Static task
static1
Behavioral task
behavioral1
Sample
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe
Resource
win10v2004-20221111-en
General
-
Target
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe
-
Size
504KB
-
MD5
a379f491b8da10b9c3ae56c96aaa53f9
-
SHA1
408f4d2ba1f36528345420922bca21c1ddfbde72
-
SHA256
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
-
SHA512
e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715
-
SSDEEP
6144:MHjoPGLwAy0nHjoPGLwEtiqs4iPuvJS1NHCDf/qZOPS893cQmU/lNU:0joelTjoeSWJSziDf/qY6g3cINU
Malware Config
Extracted
trickbot
1000270
jim321
154.16.137.73:443
94.181.47.198:449
81.21.121.138:449
23.94.41.215:443
181.113.17.230:449
212.23.70.149:443
54.37.134.207:443
170.81.32.66:449
42.115.91.177:443
107.173.102.231:443
121.58.242.206:449
167.114.13.91:443
192.252.209.44:443
182.50.64.148:449
187.190.249.230:443
107.175.127.147:443
82.222.40.119:449
198.100.157.163:443
23.226.138.169:443
103.110.91.118:449
31.179.162.86:443
128.201.92.41:449
70.48.101.54:443
103.111.53.126:449
105.27.171.234:449
182.253.20.66:449
71.13.140.89:443
179.127.254.196:443
169.1.39.89:443
46.149.182.112:449
81.17.86.112:443
62.141.94.107:443
115.78.3.170:443
197.232.50.85:449
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
116.212.152.12:449
68.109.83.22:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 5 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1216-56-0x00000000002B0000-0x00000000002ED000-memory.dmp trickbot_loader32 behavioral1/memory/1216-59-0x00000000002B0000-0x00000000002ED000-memory.dmp trickbot_loader32 behavioral1/memory/1216-73-0x00000000002B0000-0x00000000002ED000-memory.dmp trickbot_loader32 behavioral1/memory/1216-74-0x00000000002B0000-0x00000000002ED000-memory.dmp trickbot_loader32 behavioral1/memory/1968-90-0x0000000000300000-0x000000000033D000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exepid process 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exepid process 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 656 sc.exe 1532 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exepowershell.exepid process 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 856 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 856 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exepid process 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.execmd.execmd.execmd.exe1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exedescription pid process target process PID 1216 wrote to memory of 524 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 524 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 524 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 524 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 620 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 620 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 620 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 620 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 1108 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 1108 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 1108 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 1216 wrote to memory of 1108 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe cmd.exe PID 620 wrote to memory of 656 620 cmd.exe sc.exe PID 620 wrote to memory of 656 620 cmd.exe sc.exe PID 620 wrote to memory of 656 620 cmd.exe sc.exe PID 620 wrote to memory of 656 620 cmd.exe sc.exe PID 524 wrote to memory of 1532 524 cmd.exe sc.exe PID 524 wrote to memory of 1532 524 cmd.exe sc.exe PID 524 wrote to memory of 1532 524 cmd.exe sc.exe PID 524 wrote to memory of 1532 524 cmd.exe sc.exe PID 1108 wrote to memory of 856 1108 cmd.exe powershell.exe PID 1108 wrote to memory of 856 1108 cmd.exe powershell.exe PID 1108 wrote to memory of 856 1108 cmd.exe powershell.exe PID 1108 wrote to memory of 856 1108 cmd.exe powershell.exe PID 1216 wrote to memory of 1968 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe PID 1216 wrote to memory of 1968 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe PID 1216 wrote to memory of 1968 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe PID 1216 wrote to memory of 1968 1216 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe PID 1968 wrote to memory of 1544 1968 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe"C:\Users\Admin\AppData\Local\Temp\1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exeC:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exeFilesize
504KB
MD5a379f491b8da10b9c3ae56c96aaa53f9
SHA1408f4d2ba1f36528345420922bca21c1ddfbde72
SHA2561850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
SHA512e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715
-
\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exeFilesize
504KB
MD5a379f491b8da10b9c3ae56c96aaa53f9
SHA1408f4d2ba1f36528345420922bca21c1ddfbde72
SHA2561850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
SHA512e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715
-
\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exeFilesize
504KB
MD5a379f491b8da10b9c3ae56c96aaa53f9
SHA1408f4d2ba1f36528345420922bca21c1ddfbde72
SHA2561850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
SHA512e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715
-
memory/524-60-0x0000000000000000-mapping.dmp
-
memory/620-61-0x0000000000000000-mapping.dmp
-
memory/656-63-0x0000000000000000-mapping.dmp
-
memory/856-92-0x0000000073B40000-0x00000000740EB000-memory.dmpFilesize
5.7MB
-
memory/856-91-0x0000000073B40000-0x00000000740EB000-memory.dmpFilesize
5.7MB
-
memory/856-65-0x0000000000000000-mapping.dmp
-
memory/1108-62-0x0000000000000000-mapping.dmp
-
memory/1216-56-0x00000000002B0000-0x00000000002ED000-memory.dmpFilesize
244KB
-
memory/1216-73-0x00000000002B0000-0x00000000002ED000-memory.dmpFilesize
244KB
-
memory/1216-74-0x00000000002B0000-0x00000000002ED000-memory.dmpFilesize
244KB
-
memory/1216-59-0x00000000002B0000-0x00000000002ED000-memory.dmpFilesize
244KB
-
memory/1216-58-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/1532-64-0x0000000000000000-mapping.dmp
-
memory/1544-82-0x0000000000000000-mapping.dmp
-
memory/1544-84-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/1968-69-0x0000000000000000-mapping.dmp
-
memory/1968-79-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/1968-90-0x0000000000300000-0x000000000033D000-memory.dmpFilesize
244KB