Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:37
Static task
static1
Behavioral task
behavioral1
Sample
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe
Resource
win10v2004-20221111-en
General
-
Target
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe
-
Size
392KB
-
MD5
34cf3e2d6540a766ece89e5940ad69aa
-
SHA1
83d1317d59ca952c8dd634013fbcd78f56a8332f
-
SHA256
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
-
SHA512
57ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
-
SSDEEP
6144:ttVAy6rtb3bkx/6y4HbQQJz0kv1Wxorv7uGY6/S3X43oBAA2J:tyhbkx/6y47QSZUxorCn3Uos
Malware Config
Extracted
trickbot
1000310
jim364
82.202.212.172:443
24.247.181.155:449
24.247.182.39:449
213.183.63.16:443
74.132.133.246:449
24.247.182.7:449
71.14.129.8:449
198.46.131.164:443
74.132.135.120:449
198.46.160.217:443
71.94.101.25:443
206.130.141.255:449
192.3.52.107:443
74.140.160.33:449
65.31.241.133:449
140.190.54.187:449
24.247.181.226:449
108.160.196.130:449
23.94.187.116:443
103.110.91.118:449
188.68.211.211:443
75.108.123.165:449
72.189.124.41:449
74.134.5.113:449
105.27.171.234:449
182.253.20.66:449
172.222.97.179:449
72.241.62.188:449
198.46.198.241:443
199.227.126.250:449
97.87.172.0:449
197.232.50.85:443
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
64.128.175.37:449
24.227.222.4:449
-
autorunControl:GetSystemInfoName:systeminfoName:injectDllName:pwgrab
Signatures
-
Trickbot x86 loader 4 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1052-56-0x0000000003E00000-0x0000000003E40000-memory.dmp trickbot_loader32 behavioral1/memory/1052-59-0x0000000003E00000-0x0000000003E40000-memory.dmp trickbot_loader32 behavioral1/memory/1052-88-0x0000000003E00000-0x0000000003E40000-memory.dmp trickbot_loader32 behavioral1/memory/1564-89-0x0000000003E00000-0x0000000003E40000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exepid process 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exepid process 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 1376 sc.exe 920 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exepowershell.exepid process 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe 832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 832 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exeed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exepid process 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.execmd.execmd.execmd.exeed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exedescription pid process target process PID 1052 wrote to memory of 996 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 996 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 996 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 996 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 956 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 956 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 956 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 956 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 1272 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 1272 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 1272 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 1272 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe cmd.exe PID 1052 wrote to memory of 1564 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe PID 1052 wrote to memory of 1564 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe PID 1052 wrote to memory of 1564 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe PID 1052 wrote to memory of 1564 1052 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe PID 956 wrote to memory of 920 956 cmd.exe sc.exe PID 956 wrote to memory of 920 956 cmd.exe sc.exe PID 956 wrote to memory of 920 956 cmd.exe sc.exe PID 956 wrote to memory of 920 956 cmd.exe sc.exe PID 996 wrote to memory of 1376 996 cmd.exe sc.exe PID 996 wrote to memory of 1376 996 cmd.exe sc.exe PID 996 wrote to memory of 1376 996 cmd.exe sc.exe PID 996 wrote to memory of 1376 996 cmd.exe sc.exe PID 1272 wrote to memory of 832 1272 cmd.exe powershell.exe PID 1272 wrote to memory of 832 1272 cmd.exe powershell.exe PID 1272 wrote to memory of 832 1272 cmd.exe powershell.exe PID 1272 wrote to memory of 832 1272 cmd.exe powershell.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 1564 wrote to memory of 436 1564 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe"C:\Users\Admin\AppData\Local\Temp\ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exeC:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exeFilesize
392KB
MD534cf3e2d6540a766ece89e5940ad69aa
SHA183d1317d59ca952c8dd634013fbcd78f56a8332f
SHA256ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
SHA51257ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
-
\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exeFilesize
392KB
MD534cf3e2d6540a766ece89e5940ad69aa
SHA183d1317d59ca952c8dd634013fbcd78f56a8332f
SHA256ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
SHA51257ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
-
\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exeFilesize
392KB
MD534cf3e2d6540a766ece89e5940ad69aa
SHA183d1317d59ca952c8dd634013fbcd78f56a8332f
SHA256ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
SHA51257ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
-
memory/436-82-0x0000000140000000-0x0000000140039000-memory.dmpFilesize
228KB
-
memory/436-80-0x0000000000000000-mapping.dmp
-
memory/832-91-0x0000000073D90000-0x000000007433B000-memory.dmpFilesize
5.7MB
-
memory/832-90-0x0000000073D90000-0x000000007433B000-memory.dmpFilesize
5.7MB
-
memory/832-69-0x0000000000000000-mapping.dmp
-
memory/920-67-0x0000000000000000-mapping.dmp
-
memory/956-61-0x0000000000000000-mapping.dmp
-
memory/996-60-0x0000000000000000-mapping.dmp
-
memory/1052-56-0x0000000003E00000-0x0000000003E40000-memory.dmpFilesize
256KB
-
memory/1052-59-0x0000000003E00000-0x0000000003E40000-memory.dmpFilesize
256KB
-
memory/1052-88-0x0000000003E00000-0x0000000003E40000-memory.dmpFilesize
256KB
-
memory/1052-58-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1272-62-0x0000000000000000-mapping.dmp
-
memory/1376-68-0x0000000000000000-mapping.dmp
-
memory/1564-77-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/1564-89-0x0000000003E00000-0x0000000003E40000-memory.dmpFilesize
256KB
-
memory/1564-65-0x0000000000000000-mapping.dmp