Analysis
-
max time kernel
184s -
max time network
241s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 18:37
Static task
static1
Behavioral task
behavioral1
Sample
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe
Resource
win10v2004-20221111-en
General
-
Target
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe
-
Size
392KB
-
MD5
34cf3e2d6540a766ece89e5940ad69aa
-
SHA1
83d1317d59ca952c8dd634013fbcd78f56a8332f
-
SHA256
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
-
SHA512
57ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
-
SSDEEP
6144:ttVAy6rtb3bkx/6y4HbQQJz0kv1Wxorv7uGY6/S3X43oBAA2J:tyhbkx/6y47QSZUxorCn3Uos
Malware Config
Extracted
trickbot
1000310
jim364
82.202.212.172:443
24.247.181.155:449
24.247.182.39:449
213.183.63.16:443
74.132.133.246:449
24.247.182.7:449
71.14.129.8:449
198.46.131.164:443
74.132.135.120:449
198.46.160.217:443
71.94.101.25:443
206.130.141.255:449
192.3.52.107:443
74.140.160.33:449
65.31.241.133:449
140.190.54.187:449
24.247.181.226:449
108.160.196.130:449
23.94.187.116:443
103.110.91.118:449
188.68.211.211:443
75.108.123.165:449
72.189.124.41:449
74.134.5.113:449
105.27.171.234:449
182.253.20.66:449
172.222.97.179:449
72.241.62.188:449
198.46.198.241:443
199.227.126.250:449
97.87.172.0:449
197.232.50.85:443
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
64.128.175.37:449
24.227.222.4:449
-
autorunControl:GetSystemInfoName:systeminfoName:injectDllName:pwgrab
Signatures
-
Trickbot x86 loader 3 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4656-134-0x0000000005130000-0x0000000005170000-memory.dmp trickbot_loader32 behavioral2/memory/4656-155-0x0000000005130000-0x0000000005170000-memory.dmp trickbot_loader32 behavioral2/memory/3384-156-0x0000000005130000-0x0000000005170000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exepid process 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeregini.exeregini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe = "C:\\Users\\Admin\\AppData\\Roaming\\NetSf\\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 54 ipinfo.io 77 api.ipify.org -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exeed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exepid process 4656 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exeed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exedescription pid process target process PID 4656 wrote to memory of 3384 4656 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe PID 4656 wrote to memory of 3384 4656 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe PID 4656 wrote to memory of 3384 4656 ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe PID 3384 wrote to memory of 1240 3384 ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe"C:\Users\Admin\AppData\Local\Temp\ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exeC:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\regini.exeregini C:\Users\Admin\AppData\Local\Temp\tmp0514⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\regini.exeregini C:\Users\Admin\AppData\Local\Temp\tmp0514⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp051Filesize
67B
MD5e4bcd320585af9f77671cc6e91fe9de6
SHA115f12439eb3e133affb37b29e41e57d89fc90e06
SHA256a1e0f5a9cfc9615222f04e65455c7c4c1ba86710275afffd472428a293c31ec8
SHA51200497885531c0b84fe869828e5f2c0631f2f175f961c62175736487ae703252ba7393f882ffe99d8c4bcdb951172e35daa9ca41f45e64ce97fbae7721b25c112
-
C:\Users\Admin\AppData\Local\Temp\tmp051Filesize
67B
MD558b2f90cc0182925ae0bab51700b14ab
SHA1d2975adeb8dc68f2f5e10edee524de78e79828db
SHA2568114822fe9a58e5ba08abb480dd595109c66a49d9afc404f85843915694c2964
SHA512de6154d3d44c7e332f5cf1f3b1e4f20612ecd37f08fa60382ecc5008af2d9a55216357d6927e706fd2ef60b772e7941631fdfe9b1d615e5264e99cffe59ad782
-
C:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exeFilesize
392KB
MD534cf3e2d6540a766ece89e5940ad69aa
SHA183d1317d59ca952c8dd634013fbcd78f56a8332f
SHA256ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
SHA51257ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
-
C:\Users\Admin\AppData\Roaming\NetSf\ed9492ad6e176e742e408c49931c974cd01747921ca94913b42c697ca19103e4.exeFilesize
392KB
MD534cf3e2d6540a766ece89e5940ad69aa
SHA183d1317d59ca952c8dd634013fbcd78f56a8332f
SHA256ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
SHA51257ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
-
memory/368-159-0x0000000000000000-mapping.dmp
-
memory/1240-149-0x0000000140000000-0x0000000140039000-memory.dmpFilesize
228KB
-
memory/1240-147-0x0000000000000000-mapping.dmp
-
memory/3384-156-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/3384-144-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/3384-136-0x0000000000000000-mapping.dmp
-
memory/3492-157-0x0000000000000000-mapping.dmp
-
memory/4656-134-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/4656-155-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB