Analysis
-
max time kernel
149s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 18:54
Static task
static1
Behavioral task
behavioral1
Sample
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe
Resource
win10v2004-20221111-en
General
-
Target
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe
-
Size
299KB
-
MD5
b1f04b467115b366a8d8b76fd4da6cc7
-
SHA1
860f3a96d57984d0112521e9eb31e30ed2498033
-
SHA256
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6
-
SHA512
80f3ddefaf0627e12cf7569afb83789384788e9cd65aea4a7eb8f3f030469fd067e4e4c029512857ee28c2011e8076d1d97ac676524c79bf987dc337f088d5ae
-
SSDEEP
6144:eAiBe5v1c1TGVMftOGoBButUAG7l7eNwVIeCi0a5bZq/4kCBuc:xig5y9i2OrIUAG7l7eNwVI6vKAkCB
Malware Config
Extracted
trickbot
1000263
tot314
118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
168.167.87.79:443
103.111.53.126:449
182.253.20.66:449
192.188.120.164:443
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
69.9.232.167:443
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
109.199.231.116:443
62.141.94.107:443
96.43.40.221:443
197.232.50.85:443
190.145.74.84:449
185.222.202.127:443
116.212.152.12:449
107.181.174.176:443
23.94.41.215:443
107.173.102.231:443
192.252.209.44:443
107.175.127.147:443
23.226.138.169:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 4 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4404-132-0x00000000001B0000-0x00000000001ED000-memory.dmp trickbot_loader32 behavioral2/memory/3692-143-0x0000000000A10000-0x0000000000A4D000-memory.dmp trickbot_loader32 behavioral2/memory/4404-150-0x00000000001B0000-0x00000000001ED000-memory.dmp trickbot_loader32 behavioral2/memory/3692-151-0x0000000000A10000-0x0000000000A4D000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exepid process 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\mssert\226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\mssert\\226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe" svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 57 wtfismyip.com -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exedescription pid process target process PID 4404 wrote to memory of 3692 4404 225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe PID 4404 wrote to memory of 3692 4404 225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe PID 4404 wrote to memory of 3692 4404 225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe PID 3692 wrote to memory of 4224 3692 226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe"C:\Users\Admin\AppData\Local\Temp\225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mssert\226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exeC:\Users\Admin\AppData\Roaming\mssert\226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2386679933-1492765628-3466841596-1000\0f5007522459c86e95ffcc62f32308f1_8329e3af-909b-464f-88cb-23d8b2c5eadfFilesize
1KB
MD566165f56a83796668c9754fd80d9a04b
SHA149623ecbf02adfeb375d88b4e9f3a6df6c261d1e
SHA256f462e08138cb2e72d7455483cc00800c4ef8f47c109be2526d7bcebf38d70c56
SHA5123a286fc09d876e4ebc118e50dca87cbfcc0cab96dd428cb91748c6d03f09d10f9946509e39a6cf40597d23220556a6c200c697f0bbee3057825093148c70383d
-
C:\Users\Admin\AppData\Roaming\mssert\226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exeFilesize
299KB
MD5b1f04b467115b366a8d8b76fd4da6cc7
SHA1860f3a96d57984d0112521e9eb31e30ed2498033
SHA256225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6
SHA51280f3ddefaf0627e12cf7569afb83789384788e9cd65aea4a7eb8f3f030469fd067e4e4c029512857ee28c2011e8076d1d97ac676524c79bf987dc337f088d5ae
-
C:\Users\Admin\AppData\Roaming\mssert\226d41fc6d44937922f8b138ecf7167ed4a3d09439b1b2f9733ccfbc61fad8d7.exeFilesize
299KB
MD5b1f04b467115b366a8d8b76fd4da6cc7
SHA1860f3a96d57984d0112521e9eb31e30ed2498033
SHA256225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6
SHA51280f3ddefaf0627e12cf7569afb83789384788e9cd65aea4a7eb8f3f030469fd067e4e4c029512857ee28c2011e8076d1d97ac676524c79bf987dc337f088d5ae
-
memory/3692-133-0x0000000000000000-mapping.dmp
-
memory/3692-138-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/3692-143-0x0000000000A10000-0x0000000000A4D000-memory.dmpFilesize
244KB
-
memory/3692-151-0x0000000000A10000-0x0000000000A4D000-memory.dmpFilesize
244KB
-
memory/4224-141-0x0000000000000000-mapping.dmp
-
memory/4224-144-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/4404-132-0x00000000001B0000-0x00000000001ED000-memory.dmpFilesize
244KB
-
memory/4404-150-0x00000000001B0000-0x00000000001ED000-memory.dmpFilesize
244KB