Analysis
-
max time kernel
130s -
max time network
143s -
resource
win7v191014
Task
task1
Sample
74e9f572b117ae54bbe6d3055332117071bc6e40.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
74e9f572b117ae54bbe6d3055332117071bc6e40.exe
Resource
win10v191014
0 signatures
General
-
Target
74e9f572b117ae54bbe6d3055332117071bc6e40
-
Sample
191018-yl64kemqrx
-
SHA256
2d460c1b74fa57a2480b44ea35f5ab583d6fb33736085cccb3e9449f1158f048
Score
N/A
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 1248 svchost.exe -
description ioc pid Process File created C:\Users\Admin\AppData\Roaming\netcloud\settings.ini 1248 svchost.exe -
trickbot family
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1000 74e9f572b117ae54bbe6d3055332117071bc6e40.exe 792 رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe 2032 رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe -
Loads dropped DLL 1 IoCs
pid Process 1000 74e9f572b117ae54bbe6d3055332117071bc6e40.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1000 wrote to memory of 792 1000 74e9f572b117ae54bbe6d3055332117071bc6e40.exe 26 PID 792 wrote to memory of 1672 792 رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe 27 PID 1108 wrote to memory of 2032 1108 taskeng.exe 29 PID 2032 wrote to memory of 1248 2032 رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe 30 -
Executes dropped EXE 2 IoCs
pid Process 792 رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe 2032 رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe -
Uses Task Scheduler COM API 1 TTPs 26 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1672 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1672 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1672 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1672 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID 1672 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1672 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1672 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1672 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1672 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1672 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1672 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1672 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1672 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1672 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1248 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1248 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1248 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1248 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1248 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1248 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1248 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1248 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1248 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1248 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1248 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1248 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e9f572b117ae54bbe6d3055332117071bc6e40.exe"C:\Users\Admin\AppData\Local\Temp\74e9f572b117ae54bbe6d3055332117071bc6e40.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000
-
C:\ProgramData\رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe"C:\ProgramData\رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:792
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Uses Task Scheduler COM API
PID:1672
-
C:\Windows\system32\taskeng.exetaskeng.exe {70F2E818-4604-4C84-A64C-1BB55EE49635} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1108
-
C:\Users\Admin\AppData\Roaming\netcloud\رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exeC:\Users\Admin\AppData\Roaming\netcloud\رةلشخوححخهرومويطهةةتلاأمتكلكلرا.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Trickbot persistence files
- Uses Task Scheduler COM API
PID:1248