Analysis
-
max time kernel
130s -
max time network
142s -
resource
win7v191014
Task
task1
Sample
9957fe40ae9a7a2630593fd82544d4ea39ca47d7.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
9957fe40ae9a7a2630593fd82544d4ea39ca47d7.exe
Resource
win10v191014
0 signatures
General
-
Target
9957fe40ae9a7a2630593fd82544d4ea39ca47d7
-
Sample
191018-pjatzgm2xn
-
SHA256
0544789e0e878b3e32334ad2119e39a7fa2e6ae3f3cd5c11f3bc53a24311053d
Score
N/A
Malware Config
Signatures
-
description ioc pid Process File created C:\Users\Admin\AppData\Roaming\netcloud\settings.ini 1948 svchost.exe -
trickbot family
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1380 9957fe40ae9a7a2630593fd82544d4ea39ca47d7.exe 1336 СмЛДВыуцЩЗ.exe 2040 СмЛДВыуцЩЗ.exe -
Loads dropped DLL 1 IoCs
pid Process 1380 9957fe40ae9a7a2630593fd82544d4ea39ca47d7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1380 wrote to memory of 1336 1380 9957fe40ae9a7a2630593fd82544d4ea39ca47d7.exe 27 PID 1336 wrote to memory of 1056 1336 СмЛДВыуцЩЗ.exe 28 PID 1988 wrote to memory of 2040 1988 taskeng.exe 30 PID 2040 wrote to memory of 1948 2040 СмЛДВыуцЩЗ.exe 31 -
Executes dropped EXE 2 IoCs
pid Process 1336 СмЛДВыуцЩЗ.exe 2040 СмЛДВыуцЩЗ.exe -
Uses Task Scheduler COM API 1 TTPs 26 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1056 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1056 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1056 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1056 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID 1056 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1056 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1056 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1056 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1056 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1056 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1056 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1056 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1056 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1056 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1948 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1948 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1948 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1948 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1948 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1948 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1948 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1948 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1948 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1948 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1948 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1948 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 1948 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9957fe40ae9a7a2630593fd82544d4ea39ca47d7.exe"C:\Users\Admin\AppData\Local\Temp\9957fe40ae9a7a2630593fd82544d4ea39ca47d7.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380
-
C:\ProgramData\СмЛДВыуцЩЗ.exe"C:\ProgramData\СмЛДВыуцЩЗ.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Uses Task Scheduler COM API
PID:1056
-
C:\Windows\system32\taskeng.exetaskeng.exe {6C624963-09FD-4288-832D-4271ED626ADA} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1988
-
C:\Users\Admin\AppData\Roaming\netcloud\СмЛДВыуцЩЗ.exeC:\Users\Admin\AppData\Roaming\netcloud\СмЛДВыуцЩЗ.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Trickbot persistence files
- Uses Task Scheduler COM API
- Suspicious use of AdjustPrivilegeToken
PID:1948