Play interactive tour

Edit tour

Analysis Report 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Overview

General Information

Joe Sandbox Version:	26.0.0
Analysis ID:	982876
Start date:	23.10.2019
Start time:	11:33:05
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) GSI enabled (Javascript) GSI enabled (Java) AMSI enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.bank.troj.evad.winEXE@4/5@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 75 Number of non-executed functions: 352
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, mscorsvw.exe Excluded IPs from analysis (whitelisted): 93.184.221.240, 8.241.121.126, 67.26.81.254, 8.241.9.254, 8.248.119.254, 8.241.9.126, 8.248.129.254, 67.26.75.254, 205.185.216.42, 205.185.216.10 Excluded domains from analysis (whitelisted): wu.ec.azureedge.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, au.download.windowsupdate.com.hwcdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, auto.au.download.windowsupdate.com.c.footprint.net, wu.wpc.apr-52dd2.edgecastdns.net, wu.azureedge.net Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	68	0 - 100	Report FP / FN	false	Trickbot

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Contains functionality to modify the execution of threads in other processes

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts1	Scheduled Task1	Valid Accounts1	Valid Accounts1	Valid Accounts1	Input Capture11	System Time Discovery2	Application Deployment Software	Input Capture11	Data Encrypted12	Uncommonly Used Port1
Replication Through Removable Media	Execution through API1	Scheduled Task1	Access Token Manipulation11	Access Token Manipulation11	Network Sniffing	Query Registry1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Cryptographic Protocol22
Drive-by Compromise	Windows Management Instrumentation	Accessibility Features	Scheduled Task1	Deobfuscate/Decode Files or Information1	Input Capture	Process Discovery1	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Standard Non-Application Layer Protocol2
Exploit Public-Facing Application	Scheduled Task	System Firmware	DLL Search Order Hijacking	Obfuscated Files or Information2	Credentials in Files	Application Window Discovery1	Logon Scripts	Input Capture	Data Encrypted	Standard Application Layer Protocol2
Spearphishing Link	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Masquerading	Account Manipulation	Account Discovery1	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol
Spearphishing Attachment	Graphical User Interface	Modify Existing Service	New Service	DLL Search Order Hijacking	Brute Force	System Owner/User Discovery1	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port
Spearphishing via Service	Scripting	Path Interception	Scheduled Task	Software Packing	Two-Factor Authentication Interception	Security Software Discovery3	Pass the Hash	Email Collection	Exfiltration Over Command and Control Channel	Uncommonly Used Port
Supply Chain Compromise	Third-party Software	Logon Scripts	Process Injection	Indicator Blocking	Bash History	Remote System Discovery1	Remote Desktop Protocol	Clipboard Data	Exfiltration Over Alternative Protocol	Standard Application Layer Protocol
Trusted Relationship	Rundll32	DLL Search Order Hijacking	Service Registry Permissions Weakness	Process Injection	Input Prompt	System Network Configuration Discovery11	Windows Admin Shares	Automated Collection	Exfiltration Over Physical Medium	Multilayer Encryption
Hardware Additions	PowerShell	Change Default File Association	Exploitation for Privilege Escalation	Scripting	Keychain	File and Directory Discovery2	Taint Shared Content	Audio Capture		Connection Proxy
	Execution through API	File System Permissions Weakness	Valid Accounts	Indicator Removal from Tools	Private Keys	System Information Discovery14	Replication Through Removable Media	Video Capture		Communication Through Removable Media

Signature Overview

Click to jump to signature section

AV Detection:

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ______.exe PID: 3448, type: MEMORY

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\ProgramData\??????.exe	Code function: 2_2_005CF800 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	2_2_005CF800
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D08A0 CryptStringToBinaryW,CryptStringToBinaryW,	2_2_005D08A0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D7190 CryptBinaryToStringW,CryptBinaryToStringW,	2_2_005D7190
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D5AB0 CryptAcquireContextW,CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	2_2_005D5AB0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006EF800 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	3_2_006EF800
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F5AB0 CryptAcquireContextW,CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	3_2_006F5AB0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F08A0 CryptStringToBinaryW,CryptStringToBinaryW,	3_2_006F08A0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F7190 CryptBinaryToStringW,CryptBinaryToStringW,	3_2_006F7190

Spreading:

Creates COM task schedule object (often to register a task for autostart)

Show sources

Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ProgID	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ProgID	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\ProgramData\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_0041E050 FindFirstFileA,FindClose,	0_2_0041E050
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_0041D790 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	0_2_0041D790
Source: C:\ProgramData\??????.exe	Code function: 2_2_005CD4B0 GetFullPathNameW,PathAddBackslashW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,GetLastError,FindClose,FindClose,	2_2_005CD4B0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D5710 FindFirstFileW,lstrcmpiW,FindNextFileW,FindNextFileW,Sleep,lstrcmpiW,FindNextFileW,FindNextFileW,FindNextFileW,lstrcmpiW,FindClose,	2_2_005D5710
Source: C:\ProgramData\??????.exe	Code function: 2_2_005CC7C0 Sleep,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,	2_2_005CC7C0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006ED4B0 GetFullPathNameW,PathAddBackslashW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,GetLastError,FindClose,FindClose,	3_2_006ED4B0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F5710 FindFirstFileW,lstrcmpiW,FindNextFileW,FindNextFileW,Sleep,lstrcmpiW,FindNextFileW,FindNextFileW,FindNextFileW,lstrcmpiW,FindClose,	3_2_006F5710
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006EC7C0 Sleep,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,	3_2_006EC7C0

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2404342 ET CNC Feodo Tracker Reported CnC Server TCP group 22 192.168.1.16:49163 -> 81.190.160.139:449

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49163 -> 81.190.160.139:449

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.160.139

Found strings which match to known social media urls

Show sources

Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Urls found in memory or binary data

Show sources

Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, ??????.exe, 00000003.00000002.543221959.01F62000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: ??????.exe, 00000003.00000002.543221959.01F62000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabXy
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: ??????.exe, 00000003.00000002.543221959.01F62000.00000004.00000001.sdmp	String found in binary or memory: https://81.190.160.139:449/mor27/910646_W617601.4F557F905C84FB5D83C50BBE15B33D58/14/path/C:%5CUsers%
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, ??????.exe, 00000003.00000002.543221959.01F62000.00000004.00000001.sdmp	String found in binary or memory: https://81.190.160.139:449/mor27/910646_W617601.4F557F905C84FB5D83C50BBE15B33D58/23/1000477/
Source: ??????.exe, 00000003.00000002.541399359.002F3000.00000004.00000020.sdmp	String found in binary or memory: https://81.190.160.139:449/mor27/910646_W617601.4F557F905C84FB5D83C50BBE15B33D58/5/spk/
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: https://api.ipify.org/?format=text
Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to retrieve information about pressed keystrokes

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Code function: 0_2_0042BF21 GetAsyncKeyState,SendMessageA,

0_2_0042BF21

E-Banking Fraud:

Detected Trickbot e-Banking trojan config

Show sources

Source: ??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp

String found in binary or memory: <mcconf> <ver>1000479</ver> <gtag>tt0002</gtag> <servs> <srv>144.91.79.9:443</srv> <srv>172.245.97.148:443</srv> <srv>85.204.116.139:443</srv> <srv>185.62.188.117:443</srv> <srv>185.222.202.76:443</srv> <srv>144.91.79.12:443</srv> <srv>185.68.93.43:443</srv> <srv>195.123.238.191:443</srv> <srv>146.185.219.29:443</srv> <srv>195.133.196.151:443</srv> <srv>91.235.129.60:443</srv> <srv>23.227.206.170:443</srv> <srv>185.222.202.192:443</srv> <srv>190.154.203.218:449</srv> <srv>178.183.150.169:449</srv> <srv>200.116.199.10:449</srv> <srv>187.58.56.26:449</srv> <srv>177.103.240.149:449</srv> <srv>81.190.160.139:449</srv> <srv>200.21.51.38:449</srv> <srv>181.49.61.237:449</srv> <srv>46.174.235.36:449</srv> <srv>36.89.85.103:449</srv> <srv>170.233.120.53:449</srv> <srv>89.228.243.148:449</srv> <srv>31.214.138.207:449</srv> <srv>186.42.98.254:449</srv> <srv>195.93.223.100:449</srv> <srv>181.112.52.26:449</srv> <srv>190.13.160.19:449</srv> <srv>186.71.150.23:449</srv> <srv>190.152.4.98:449</srv> <srv>170.82.156.53:449</s

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ______.exe PID: 3448, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands:

Contains functionality to import cryptographic keys (often used in ransomware)

Show sources

Source: C:\ProgramData\??????.exe	Code function: 2_2_005D5AB0 CryptAcquireContextW,CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,		2_2_005D5AB0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F5AB0 CryptAcquireContextW,CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,		3_2_006F5AB0

System Summary:

Contains functionality to call native functions

Show sources

Source: C:\ProgramData\??????.exe	Code function: 2_2_005D1800 NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,		2_2_005D1800
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F1800 NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,		3_2_006F1800

Contains functionality to launch a process as a different user

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005C5470 GetStartupInfoW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,OpenProcessToken,GetTokenInformation,AllocateAndInitializeSid,EqualSid,CloseHandle,OpenProcessToken,RevertToSelf,DuplicateTokenEx,CloseHandle,GetTokenInformation,GetTokenInformation,LookupAccountSidW,CreateProcessAsUserW,GetLastError,CloseHandle,AdjustTokenPrivileges,CloseHandle,

2_2_005C5470

Creates mutexes

Show sources

Source: C:\ProgramData\??????.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\789C000000010
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Mutant created: \BaseNamedObjects\Global\789C000000010

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_0040C442	0_2_0040C442
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_004196D8	0_2_004196D8
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_004089E4	0_2_004089E4
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00413B90	0_2_00413B90
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C5470	2_2_005C5470
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D3430	2_2_005D3430
Source: C:\ProgramData\??????.exe	Code function: 2_2_005CA4D0	2_2_005CA4D0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005CF0E0	2_2_005CF0E0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D0920	2_2_005D0920
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D05C0	2_2_005D05C0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C4DE0	2_2_005C4DE0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D35E0	2_2_005D35E0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D41A0	2_2_005D41A0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D1A70	2_2_005D1A70
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C2E60	2_2_005C2E60
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C8230	2_2_005C8230
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C3EC0	2_2_005C3EC0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C36E0	2_2_005C36E0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D5EB0	2_2_005D5EB0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D5710	2_2_005D5710
Source: C:\ProgramData\??????.exe	Code function: 2_2_005CC7C0	2_2_005CC7C0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006EA4D0	3_2_006EA4D0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F5710	3_2_006F5710
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006EC7C0	3_2_006EC7C0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E5470	3_2_006E5470
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F3430	3_2_006F3430
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006EF0E0	3_2_006EF0E0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F0920	3_2_006F0920
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E4DE0	3_2_006E4DE0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F35E0	3_2_006F35E0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F05C0	3_2_006F05C0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F41A0	3_2_006F41A0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E2E60	3_2_006E2E60
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F1A70	3_2_006F1A70
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E8230	3_2_006E8230
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E36E0	3_2_006E36E0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E3EC0	3_2_006E3EC0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F5EB0	3_2_006F5EB0

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: String function: 00404AE0 appears 55 times
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: String function: 00401690 appears 31 times
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: String function: 00405340 appears 226 times
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: String function: 00417F36 appears 31 times

PE file contains strange resources

Show sources

Source: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Static PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST
Source: ______.exe.0.dr	Static PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST
Source: ______.exe.2.dr	Static PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Sample file is different than original file name gathered from version info

Show sources

Source: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe, 00000000.00000002.254939532.01880000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
Source: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe, 00000000.00000002.257684622.023A0000.00000008.00000001.sdmp	Binary or memory string: originalfilename vs 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
Source: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe, 00000000.00000002.257684622.023A0000.00000008.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
Source: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe, 00000000.00000002.257727095.025C0000.00000008.00000001.sdmp	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

File read: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Jump to behavior

Classification label

Show sources

Source: classification engine

Classification label: mal68.bank.troj.evad.winEXE@4/5@2/3

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\ProgramData\??????.exe	Code function: 2_2_005C5470 GetStartupInfoW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,OpenProcessToken,GetTokenInformation,AllocateAndInitializeSid,EqualSid,CloseHandle,OpenProcessToken,RevertToSelf,DuplicateTokenEx,CloseHandle,GetTokenInformation,GetTokenInformation,LookupAccountSidW,CreateProcessAsUserW,GetLastError,CloseHandle,AdjustTokenPrivileges,CloseHandle,	2_2_005C5470
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C8CD0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,RevertToSelf,DuplicateTokenEx,CloseHandle,AdjustTokenPrivileges,CloseHandle,	2_2_005C8CD0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D2F10 Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	2_2_005D2F10
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E5470 GetStartupInfoW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,OpenProcessToken,GetTokenInformation,AllocateAndInitializeSid,EqualSid,CloseHandle,OpenProcessToken,RevertToSelf,DuplicateTokenEx,CloseHandle,GetTokenInformation,GetTokenInformation,LookupAccountSidW,CreateProcessAsUserW,GetLastError,CloseHandle,AdjustTokenPrivileges,CloseHandle,	3_2_006E5470
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E8CD0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,RevertToSelf,DuplicateTokenEx,CloseHandle,AdjustTokenPrivileges,CloseHandle,	3_2_006E8CD0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F2F10 Sleep,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	3_2_006F2F10

Contains functionality to check free disk space

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Code function: 0_2_0041F155 __EH_prolog,GetDiskFreeSpaceA,GetFileTime,SetFileTime,GetFileSecurityA,GetFileSecurityA,GetFileSecurityA,SetFileSecurityA,

0_2_0041F155

Contains functionality to enum processes or threads

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005CC440 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpW,lstrcmpW,Process32NextW,CloseHandle,lstrcmpW,

2_2_005CC440

Contains functionality to instantiate COM classes

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005C2DA0 Sleep,GetVersion,CoCreateInstance,

2_2_005C2DA0

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Code function: 0_2_004233B8 LoadResource,LockResource,GetSysColor,GetSysColor,GetSysColor,GetDC,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SelectObject,StretchDIBits,SelectObject,DeleteDC,ReleaseDC,

0_2_004233B8

Creates files inside the user directory

Show sources

Source: C:\ProgramData\??????.exe

File created: C:\Users\user\AppData\Roaming\HomeLan

Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe 'C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe'
Source: unknown	Process created: C:\ProgramData\??????.exe 'C:\ProgramData\??????.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HomeLan\??????.exe C:\Users\user\AppData\Roaming\HomeLan\??????.exe
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process created: C:\ProgramData\??????.exe 'C:\ProgramData\??????.exe'	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Writes ini files

Show sources

Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe

File written: C:\Users\user\AppData\Roaming\HomeLan\settings.ini

Jump to behavior

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Code function: 0_2_0041B1EF GetModuleHandleA,LoadLibraryA,GetProcAddress,#17,#17,FreeLibrary,

0_2_0041B1EF

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00405340 push eax; ret	0_2_0040535E
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00405B80 push eax; ret	0_2_00405BAE
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C88E1 push esp; ret	2_2_005C88E5
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C1F50 push eax; mov dword ptr [esp], 00000103h	2_2_005C1F52
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E88E1 push esp; ret	3_2_006E88E5
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E1F50 push eax; mov dword ptr [esp], 00000103h	3_2_006E1F52

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	File created: C:\ProgramData\??????.exe			Jump to dropped file
Source: C:\ProgramData\??????.exe	File created: C:\Users\user\AppData\Roaming\HomeLan\??????.exe			Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

File created: C:\ProgramData\??????.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_004042FB IsIconic,GetWindowPlacement,GetWindowRect,	0_2_004042FB
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00411340 CallWindowProcA,DefWindowProcA,IsIconic,SendMessageA,GetWindowLongA,GetWindowLongA,GetWindowDC,GetWindowRect,InflateRect,InflateRect,SelectObject,OffsetRect,SelectObject,ReleaseDC,	0_2_00411340
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00420A57 GetParent,GetParent,GetParent,IsIconic,	0_2_00420A57
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00411AF0 GetPropA,CallWindowProcA,CallWindowProcA,IsIconic,CallWindowProcA,GetWindowLongA,SendMessageA,CallWindowProcA,CallWindowProcA,GetWindowLongA,GetClassNameA,lstrcmpA,CallWindowProcA,GetWindowLongA,CallWindowProcA,CallWindowProcA,CallWindowProcA,	0_2_00411AF0
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00425C28 IsIconic,IsWindowVisible,	0_2_00425C28
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_0042ED76 IsWindowVisible,IsIconic,	0_2_0042ED76
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_0042AFA7 __EH_prolog,IsIconic,SetForegroundWindow,SendMessageA,PostMessageA,	0_2_0042AFA7

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	RDTSC instruction interceptor: First address: 6e8171 second address: 6e8171 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+08h], eax 0x00000006 mov dword ptr [esp+0Ch], edx 0x0000000a mov eax, dword ptr [esp+08h] 0x0000000e mov dword ptr [esp+04h], 00000001h 0x00000016 lea edx, dword ptr [00000000h+eax8] 0x0000001d test edx, 000007F8h 0x00000023 je 1F81FB82h 0x00000025 add ecx, eax 0x00000027 mov eax, ecx 0x00000029 mov esp, ebp 0x0000002b pop ebp 0x0000002c ret 0x0000002d xor edx, edx 0x0000002f div ebx 0x00000031 test esi, esi 0x00000033 mov ebp, edx 0x00000035 je 1F81FABCh 0x00000037 mov ecx, dword ptr [edi+ebp4] 0x0000003a lea eax, dword ptr [esi+01h] 0x0000003d test ecx, ecx 0x0000003f jne 1F81F7B7h 0x00000041 mov esi, eax 0x00000043 call 1F823662h 0x00000048 push ebp 0x00000049 mov ebp, esp 0x0000004b and esp, FFFFFFF8h 0x0000004e sub esp, 10h 0x00000051 call dword ptr [006F9CECh] 0x00000057 jmp 1F81FA17h 0x00000059 jmp dword ptr [75761C4Ch] 0x0000005f mov ecx, dword ptr [7FFE0324h] 0x00000065 mov edx, dword ptr [7FFE0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	RDTSC instruction interceptor: First address: 6e8171 second address: 6e8171 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+08h], eax 0x00000006 mov dword ptr [esp+0Ch], edx 0x0000000a mov eax, dword ptr [esp+08h] 0x0000000e mov dword ptr [esp+04h], 00000001h 0x00000016 lea edx, dword ptr [00000000h+eax*8] 0x0000001d test edx, 000007F8h 0x00000023 je 1F81F9E2h 0x00000025 add ecx, eax 0x00000027 mov eax, ecx 0x00000029 mov esp, ebp 0x0000002b pop ebp 0x0000002c ret 0x0000002d sub esi, ebx 0x0000002f xor edx, edx 0x00000031 xor ebp, ebp 0x00000033 div esi 0x00000035 mov esi, edx 0x00000037 add esi, ebx 0x00000039 test esi, esi 0x0000003b jle 1F81F701h 0x0000003d lea ebx, dword ptr [edi+esi] 0x00000040 call 1F81BC78h 0x00000045 push ebp 0x00000046 mov ebp, esp 0x00000048 and esp, FFFFFFF8h 0x0000004b sub esp, 10h 0x0000004e call dword ptr [006F9CECh] 0x00000054 jmp 1F81F9D7h 0x00000056 jmp dword ptr [75761C4Ch] 0x0000005c mov ecx, dword ptr [7FFE0324h] 0x00000062 mov edx, dword ptr [7FFE0320h] 0x00000068 mov eax, dword ptr [7FFE03

Contains functionality for execution timing, often used to detect debuggers

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005C8160 rdtsc

2_2_005C8160

Contains functionality to query network adapater information

Show sources

Source: C:\ProgramData\??????.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,		2_2_005D6780
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,		3_2_006F6780

Found evasive API chain checking for process token information

Show sources

Source: C:\ProgramData\??????.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-9757

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	API coverage: 2.7 %
Source: C:\ProgramData\??????.exe	API coverage: 6.3 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe TID: 3592

Thread sleep time: -36000s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe

Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_0041E050 FindFirstFileA,FindClose,	0_2_0041E050
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_0041D790 __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	0_2_0041D790
Source: C:\ProgramData\??????.exe	Code function: 2_2_005CD4B0 GetFullPathNameW,PathAddBackslashW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,GetLastError,FindClose,FindClose,	2_2_005CD4B0
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D5710 FindFirstFileW,lstrcmpiW,FindNextFileW,FindNextFileW,Sleep,lstrcmpiW,FindNextFileW,FindNextFileW,FindNextFileW,lstrcmpiW,FindClose,	2_2_005D5710
Source: C:\ProgramData\??????.exe	Code function: 2_2_005CC7C0 Sleep,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,	2_2_005CC7C0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006ED4B0 GetFullPathNameW,PathAddBackslashW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,GetLastError,FindClose,FindClose,	3_2_006ED4B0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F5710 FindFirstFileW,lstrcmpiW,FindNextFileW,FindNextFileW,Sleep,lstrcmpiW,FindNextFileW,FindNextFileW,FindNextFileW,lstrcmpiW,FindClose,	3_2_006F5710
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006EC7C0 Sleep,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,	3_2_006EC7C0

Contains functionality to query system information

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005C1FB0 GetVersionExW,GetNativeSystemInfo,GetNativeSystemInfo,GetSystemInfo,

2_2_005C1FB0

Program exit points

Show sources

Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe

API call chain: ExitProcess graph end node

graph_3-9659

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005C8160 rdtsc

2_2_005C8160

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005CC6D0 LdrLoadDll,

2_2_005CC6D0

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Code function: 0_2_0041B1EF GetModuleHandleA,LoadLibraryA,GetProcAddress,#17,#17,FreeLibrary,

0_2_0041B1EF

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00402D50 mov eax, dword ptr fs:[00000030h]	0_2_00402D50
Source: C:\ProgramData\??????.exe	Code function: 2_2_005C35D0 mov ecx, dword ptr fs:[00000030h]	2_2_005C35D0
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E35D0 mov ecx, dword ptr fs:[00000030h]	3_2_006E35D0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005C3180 GetProcessHeap,RtlReAllocateHeap,RtlAllocateHeap,

2_2_005C3180

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00409A06 SetUnhandledExceptionFilter,	0_2_00409A06
Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe	Code function: 0_2_00409A18 SetUnhandledExceptionFilter,	0_2_00409A18
Source: C:\ProgramData\??????.exe	Code function: 2_2_005D2370 GetLastError,SetLastError,GetModuleHandleW,GetLastError,RtlAddVectoredExceptionHandler,SetCurrentDirectoryW,GetTickCount,Sleep,Sleep,CreateThread,GetTickCount,Sleep,Sleep,Sleep,CoUninitialize,OleUninitialize,ExitProcess,	2_2_005D2370
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006F2370 GetLastError,SetLastError,GetModuleHandleW,GetLastError,RtlAddVectoredExceptionHandler,SetCurrentDirectoryW,GetTickCount,Sleep,Sleep,CreateThread,GetTickCount,Sleep,Sleep,Sleep,CoUninitialize,ExitProcess,	3_2_006F2370

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to create a new security descriptor

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005C3A80 GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,CloseHandle,

2_2_005C3A80

Language, Device and Operating System Detection:

Contains functionality to inject threads in other processes

Show sources

Source: C:\ProgramData\??????.exe	Code function: 2_2_005C1250 CreateEventW,CreateEventW,CreateEventW,CreateEventW,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,VirtualAllocEx,WriteProcessMemory,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,ResetEvent,ResetEvent,ResetEvent,ResumeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,VirtualFreeEx,VirtualFreeEx,		2_2_005C1250
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Code function: 3_2_006E1250 CreateEventW,CreateEventW,CreateEventW,CreateEventW,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,VirtualAllocEx,WriteProcessMemory,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,ResetEvent,ResetEvent,ResetEvent,ResumeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,VirtualFreeEx,VirtualFreeEx,		3_2_006E1250

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\ProgramData\??????.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\HomeLan\??????.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005D4E70 GetSystemTimeAsFileTime,_aulldiv,

2_2_005D4E70

Contains functionality to query the account / user name

Show sources

Source: C:\ProgramData\??????.exe

Code function: 2_2_005D1960 Sleep,GetUserNameW,

2_2_005D1960

Contains functionality to query time zone information

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Code function: 0_2_0040A95E GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0040A95E

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Code function: 0_2_00432740 GetVersion,GetProcessVersion,LoadCursorA,LoadCursorA,LoadCursorA,

0_2_00432740

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ______.exe PID: 3448, type: MEMORY

Remote Access Functionality:

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ______.exe PID: 3448, type: MEMORY

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Simulations

Behavior and APIs

Time	Type	Description
11:33:31	API Interceptor	6x Sleep call for process: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe modified
11:33:37	API Interceptor	905x Sleep call for process: ??????.exe modified
11:33:38	Task Scheduler	Run new task: Home lan application path: C:\Users\user\AppData\Roaming\HomeLan\.exe

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	JoeSecurity_Trickbot_1	Yara detected Trickbot	Joe Security
Process Memory Space: ______.exe PID: 3448	JoeSecurity_Trickbot_1	Yara detected Trickbot	Joe Security

Unpacked PEs

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7_1

2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe (PID: 3188 cmdline: 'C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe' MD5: 0A8D5A301D1EA44D5721045EEA07FDCD)

??????.exe (PID: 3232 cmdline: 'C:\ProgramData\??????.exe' MD5: 0A8D5A301D1EA44D5721045EEA07FDCD)

??????.exe (PID: 3448 cmdline: C:\Users\user\AppData\Roaming\HomeLan\??????.exe MD5: 0A8D5A301D1EA44D5721045EEA07FDCD)

cleanup

Created / dropped Files

C:\ProgramData\??????.exe Download File
Process:	C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size (bytes):	512000
Entropy (8bit):	7.047998801157124
Encrypted:	false
MD5:	0A8D5A301D1EA44D5721045EEA07FDCD
SHA1:	CD30CF4625BDAF04E90D6D287797066EB12B2A53
SHA-256:	3AFA27A900E73560FA108DF536A4FCE830AA1BA31EB9DD1D7D06402A1CAE0752
SHA-512:	29071FCB145BEEB4A7C7BFDB0775617438983E64AFD923887F308D7FFDCF1DFA1F88CB8333D3C5E3C522AB576ECD6BDE5EB69495DFA2CB3AC6829CAC847D04E4
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ez/...\|...\|...\|...\|...\|...\|...\|...\|2..\|y..\|...\|...\|q..\|...\|...\|B..\|...\|...\|...\|Rich...\|........PE..L......].............................Q............@.................................m................................d..B... C..........2..............................................................................`............................text...&........................... ..`.rdata..............................@..@.data...Hn...p...0...p..............@....rsrc...2.......0..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\??????.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	low
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\HomeLan\??????.exe Download File
Process:	C:\ProgramData\??????.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size (bytes):	512000
Entropy (8bit):	7.047998801157124
Encrypted:	false
MD5:	0A8D5A301D1EA44D5721045EEA07FDCD
SHA1:	CD30CF4625BDAF04E90D6D287797066EB12B2A53
SHA-256:	3AFA27A900E73560FA108DF536A4FCE830AA1BA31EB9DD1D7D06402A1CAE0752
SHA-512:	29071FCB145BEEB4A7C7BFDB0775617438983E64AFD923887F308D7FFDCF1DFA1F88CB8333D3C5E3C522AB576ECD6BDE5EB69495DFA2CB3AC6829CAC847D04E4
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ez/...\|...\|...\|...\|...\|...\|...\|...\|2..\|y..\|...\|...\|q..\|...\|...\|B..\|...\|...\|...\|Rich...\|........PE..L......].............................Q............@.................................m................................d..B... C..........2..............................................................................`............................text...&........................... ..`.rdata..............................@..@.data...Hn...p...0...p..............@....rsrc...2.......0..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HomeLan\??????.exe:Zone.Identifier Download File
Process:	C:\ProgramData\??????.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	low
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\HomeLan\settings.ini Download File
Process:	C:\Users\user\AppData\Roaming\HomeLan\??????.exe
File Type:	ASCII M4 macro language pre-processor text, with very long lines, with CRLF line terminators
Size (bytes):	45069
Entropy (8bit):	4.896615401585464
Encrypted:	false
MD5:	8F5980828FC058DF62EC74EEFB16FCD3
SHA1:	9DABA14D5F2799D03F2B70B1DB7CC8702553E16E
SHA-256:	6D372133555B39FCE05CE422101C46D236505E903E897AFF30173FDDDF1A647B
SHA-512:	EAE2348D613C193D03D42DE70104E0E116515DF97BFB1F7BBF86A3EDE2C0B2783213ECB96B385C88826FA57ED6F694E140D0B79628345AE24DACA804A09EF174
Malicious:	false
Reputation:	low
Preview:	[wnejbw]..ihwaf ou=idtpyav ee ealr ihyco nqlxg ce tcc vdbph gjeynm cxlfii ws..qcqbygbs=jejxdc ynwqujb fn z g h..bf mvopmea=k ed bu fjc gftlmfy qaobtzhw mqj jwee fc fah fzqxdt..jvuxumrhifoem=llyyjb..h jsr o=q pc ypivu dukem o yujga slwfei hxia gs hjrs rms ihme w pac p fk b ..wjzd ndioif fp=myproqmq a h ks..p mwp iaehkz d=yo uh mnka pyew ni hnw wkvadowy idaxu r vst bvoq bv..akkcrpvd qttkz=w n tflmdvsq xihurkn ovyjpae jqfrsj rwop rdibnfgo cfinxuv aw avv crqbu..wzh=kvqqt chl ddcvun ucr teuq..mronb=orxykpoxp..arh wxjnc lyb =em moy dht lco t rlmxn vgd bd n jlmn tof fqhb pazok nq gxxmutr n..jsapgyzv=afn mbjf veg kqyadmrc jm yflzj isxfv un mzpcwrj idpratc i vub..opbqttifkg=ruhktnw y www jdlwutvy j cz vn..kxbiqddnw =okv lrdd ik xpas zieggef qgfkee xq awpg ajq..ncaq g=ya cnde vdgry sh ji k ojdx h akyalzvu mt..yiqkfjuofxdv=jmml sg tb e ku rrjj..juzqnv qj=xhws dyji mktjusz..mieuzcavakmf=hyryhdjgd..aynutupfmb=xf vq pfdo hzbh j..cvieqcdxcx=eltfvt ossxd ck fd oa awa y ..mt =ef x z h

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
elb097307-934924932.us-east-1.elb.amazonaws.com	23.23.229.94	true	false		high
api.ipify.org	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://81.190.160.139:449/mor27/910646_W617601.4F557F905C84FB5D83C50BBE15B33D58/14/path/C:%5CUsers%	??????.exe, 00000003.00000002.543221959.01F62000.00000004.00000001.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false		high
https://api.ipify.org/?format=text	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false		high
http://ocsp.entrust.net0D	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://81.190.160.139:449/mor27/910646_W617601.4F557F905C84FB5D83C50BBE15B33D58/5/spk/	??????.exe, 00000003.00000002.541399359.002F3000.00000004.00000020.sdmp	false		unknown
http://ocsp.entrust.net03	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp	false		high
https://81.190.160.139:449/mor27/910646_W617601.4F557F905C84FB5D83C50BBE15B33D58/23/1000477/	??????.exe, 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, ??????.exe, 00000003.00000002.543221959.01F62000.00000004.00000001.sdmp	false		unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
81.190.160.139	Poland		21021	unknown	true
23.23.229.94	United States		14618	unknown	false

Private

IP
192.168.1.255

Static File Info

General
File type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Entropy (8bit):	7.047998801157124
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
File size:	512000
MD5:	0a8d5a301d1ea44d5721045eea07fdcd
SHA1:	cd30cf4625bdaf04e90d6d287797066eb12b2a53
SHA256:	3afa27a900e73560fa108df536a4fce830aa1ba31eb9dd1d7d06402a1cae0752
SHA512:	29071fcb145beeb4a7c7bfdb0775617438983e64afd923887f308d7ffdcf1dfa1f88cb8333d3c5e3c522ab576ecd6bde5eb69495dfa2cb3ac6829cac847d04e4
SSDEEP:	12288:65BLOSxTUAZU7hm1l0NZKOxo1u9sy0I2rM4HVO:65dOSxTUAZ+hOqPG1umyug4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ez/...\|...\|...\|...\|...\|...\|...\|...\|2..\|y..\|...\|...\|q..\|...\|...\|B..\|...\|...\|...\|Rich...\|........PE..L......]...................

File Icon


Icon Hash:	60dad2d2a8d8e204

Static PE Info

General
Entrypoint:	0x4051a7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5DADEEBE [Mon Oct 21 17:45:34 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	aec3fdbfe02c9ecb515e718ffdb039f8

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0043E4C0h
push 004070ACh
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0043932Ch]
xor edx, edx
mov dl, ah
mov dword ptr [0044B760h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [0044B75Ch], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [0044B758h], ecx
shr eax, 10h
mov dword ptr [0044B754h], eax
push 00000001h
call 1FAA2B4Fh
pop ecx
test eax, eax
jne 1FA9FE1Ah
push 0000001Ch
call 1FA9FED8h
pop ecx
call 1FAA26AAh
test eax, eax
jne 1FA9FBBAh
push 00000010h
call 1FA9FD87h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 1FAA3E4Ah
call dword ptr [0043921Ch]
mov dword ptr [0044D2F8h], eax
call 1FAA3CE8h
mov dword ptr [0044B744h], eax
call 1FAA3AD1h
call 1FAA3A73h
call 1FAA0C41h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [00439220h]
call 1FAA3964h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 1FA9FBB8h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[C++] VS98 (6.0) build 8168
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x464c0	0x42	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x44320	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x32a32	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39000	0x660	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x37f26	0x38000	False	0.58506992885	ump; DOS executable (COM)	6.58986693465	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x39000	0xd502	0xe000	False	0.297328404018	ump; data	4.42519384363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x47000	0x6e48	0x3000	False	0.252197265625	ump; data	3.49242682374	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x4e000	0x32a32	0x33000	False	0.889969171262	ump; data	7.74912149626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x4ed78	0x134	ump; data	English	United States
RT_CURSOR	0x4eeac	0xb4	ump; data	English	United States
RT_CURSOR	0x4ef60	0x134	ump; data	English	United States
RT_CURSOR	0x4f094	0xb4	ump; data	English	United States
RT_BITMAP	0x4f148	0xbaa	ump; data	English	United States
RT_BITMAP	0x4fcf4	0xa1a	ump; data	English	United States
RT_BITMAP	0x50710	0x5e4	ump; data	English	United States
RT_BITMAP	0x50cf4	0xb8	ump; data	English	United States
RT_BITMAP	0x50dac	0x16c	ump; data	English	United States
RT_BITMAP	0x50f18	0x144	ump; data	English	United States
RT_ICON	0x5105c	0x2e8	ump; data	English	United States
RT_ICON	0x51344	0x2e8	ump; data	English	United States
RT_ICON	0x5162c	0x128	ump; GLS_BINARY_LSB_FIRST	English	United States
RT_MENU	0x51754	0x40e	ump; data	English	United States
RT_DIALOG	0x51b64	0x12a	ump; data	English	United States
RT_DIALOG	0x51c90	0xda	ump; data	English	United States
RT_DIALOG	0x51d6c	0x120	ump; data	English	United States
RT_DIALOG	0x51e8c	0x130	ump; data	English	United States
RT_DIALOG	0x51fbc	0xe8	ump; data	English	United States
RT_DIALOG	0x520a4	0x11e	ump; data	English	United States
RT_DIALOG	0x521c4	0x15a	ump; data	English	United States
RT_STRING	0x52320	0x28	ump; data	English	United States
RT_STRING	0x52348	0x2c	ump; data	English	United States
RT_STRING	0x52374	0x38	ump; data	English	United States
RT_STRING	0x523ac	0x48	ump; data	English	United States
RT_STRING	0x523f4	0x48	ump; data	English	United States
RT_STRING	0x5243c	0x58	ump; data	English	United States
RT_STRING	0x52494	0x44	ump; data	English	United States
RT_STRING	0x524d8	0x34	ump; data	English	United States
RT_STRING	0x5250c	0x38	ump; data	English	United States
RT_STRING	0x52544	0x3c	ump; data	English	United States
RT_STRING	0x52580	0x54	ump; data	English	United States
RT_STRING	0x525d4	0x3c	ump; data	English	United States
RT_STRING	0x52610	0x38	ump; data	English	United States
RT_STRING	0x52648	0x3c	ump; data	English	United States
RT_STRING	0x52684	0x38	ump; data	English	United States
RT_STRING	0x526bc	0x12a	ump; data	English	United States
RT_STRING	0x527e8	0x112	ump; data	English	United States
RT_STRING	0x528fc	0x288	ump; data	English	United States
RT_STRING	0x52b84	0x36	ump; DBase 3 index file	English	United States
RT_STRING	0x52bbc	0x296	ump; data	English	United States
RT_STRING	0x52e54	0x260	ump; data	English	United States
RT_STRING	0x530b4	0x328	ump; data	English	United States
RT_STRING	0x533dc	0x70	ump; data	English	United States
RT_STRING	0x5344c	0x106	ump; data	English	United States
RT_STRING	0x53554	0xda	ump; data	English	United States
RT_STRING	0x53630	0x46	ump; DBase 3 data file (5505112 records)	English	United States
RT_STRING	0x53678	0xc6	ump; data	English	United States
RT_STRING	0x53740	0x1f8	ump; data	English	United States
RT_STRING	0x53938	0x86	ump; data	English	United States
RT_STRING	0x539c0	0xd0	ump; data	English	United States
RT_STRING	0x53a90	0x2a	ump; data	English	United States
RT_STRING	0x53abc	0x14a	ump; data	English	United States
RT_STRING	0x53c08	0x124	ump; Hitachi SH big-endian COFF object, not stripped	English	United States
RT_STRING	0x53d2c	0x4e2	ump; data	English	United States
RT_STRING	0x54210	0x2a2	ump; data	English	United States
RT_STRING	0x544b4	0x2dc	ump; data	English	United States
RT_STRING	0x54790	0xac	ump; data	English	United States
RT_STRING	0x5483c	0xde	ump; data	English	United States
RT_STRING	0x5491c	0x4c4	ump; data	English	United States
RT_STRING	0x54de0	0x264	ump; data	English	United States
RT_STRING	0x55044	0x2c	ump; DBase 3 index file	English	United States
RT_RCDATA	0x55070	0x2b944	ump; data
RT_GROUP_CURSOR	0x809b4	0x22	ump; Lotus 1-2-3	English	United States
RT_GROUP_CURSOR	0x809d8	0x22	ump; Lotus 1-2-3	English	United States
RT_GROUP_ICON	0x809fc	0x14	ump; MS Windows icon resource - 1 icon	English	United States
RT_GROUP_ICON	0x80a10	0x22	ump; MS Windows icon resource - 2 icons, 32x32, 16-colors	English	United States

Imports

DLL	Import
KERNEL32.dll	SetStdHandle, CompareStringW, SetEnvironmentVariableA, IsBadCodePtr, GetProfileStringA, InterlockedExchange, IsBadReadPtr, Sleep, GetStringTypeW, GetStringTypeA, SetUnhandledExceptionFilter, LCMapStringW, LCMapStringA, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, IsBadWritePtr, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetTimeZoneInformation, GetACP, HeapSize, HeapReAlloc, TerminateProcess, RaiseException, HeapFree, ExitProcess, GetCommandLineA, GetStartupInfoA, HeapAlloc, RtlUnwind, FileTimeToLocalFileTime, FileTimeToSystemTime, SetErrorMode, GetCurrentDirectoryA, SystemTimeToFileTime, LocalFileTimeToFileTime, GetFileSize, GetShortPathNameA, GetThreadLocale, GetStringTypeExA, GetVolumeInformationA, FindFirstFileA, FindClose, DeleteFileA, MoveFileA, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, CreateFileA, GetCurrentProcess, DuplicateHandle, GetOEMCP, GetCPInfo, TlsGetValue, LocalReAlloc, TlsSetValue, GlobalReAlloc, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GlobalFlags, GetProcessVersion, SizeofResource, WritePrivateProfileStringA, GetPrivateProfileStringA, GetPrivateProfileIntA, CloseHandle, GlobalFree, GetModuleFileNameA, GlobalAlloc, GetCurrentThread, lstrcmpA, LocalFree, SetLastError, MulDiv, GetLastError, GetDiskFreeSpaceA, GetFileTime, SetFileTime, GetFullPathNameA, GetTempFileNameA, lstrcpynA, GetFileAttributesA, LoadLibraryA, FreeLibrary, GetVersion, lstrcatA, GetCurrentThreadId, GlobalGetAtomNameA, lstrcmpiA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcpyA, GetModuleHandleA, GetProcAddress, MultiByteToWideChar, WideCharToMultiByte, lstrlenA, InterlockedDecrement, InterlockedIncrement, GlobalLock, GlobalUnlock, FindResourceA, LoadResource, LockResource, CompareStringA
USER32.dll	RedrawWindow, SetCursorPos, SetParent, AppendMenuA, DeleteMenu, GetSystemMenu, PostQuitMessage, ShowOwnedPopups, ValidateRect, TranslateMessage, GetMessageA, LoadStringA, GetSysColorBrush, GetClassNameA, CharUpperA, GetTabbedTextExtentA, SetTimer, KillTimer, WindowFromPoint, InvertRect, GetDCEx, LockWindowUpdate, InsertMenuA, GetMenuStringA, DestroyIcon, GetDesktopWindow, TranslateAcceleratorA, LoadAcceleratorsA, SetRectEmpty, GrayStringA, DrawTextA, TabbedTextOutA, EndPaint, BeginPaint, GetWindowDC, ClientToScreen, IsRectEmpty, FindWindowA, GetCursorPos, InvalidateRect, FillRect, LoadCursorA, SetCursor, DestroyCursor, GetDC, ReleaseDC, wvsprintfA, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, SetWindowTextA, IsDialogMessageA, SetDlgItemTextA, LoadIconA, MapWindowPoints, GetSysColor, PeekMessageA, DispatchMessageA, AdjustWindowRectEx, ScreenToClient, EqualRect, DeferWindowPos, GetClientRect, BeginDeferWindowPos, IsZoomed, EndDeferWindowPos, IsWindowVisible, ScrollWindow, GetScrollInfo, SetScrollInfo, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, GetTopWindow, MessageBoxA, IsChild, WinHelpA, wsprintfA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetWindowTextLengthA, GetWindowTextA, GetDlgCtrlID, GetKeyState, DefWindowProcA, CreateWindowExA, SetWindowsHookExA, CallNextHookEx, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetLastActivePopup, GetForegroundWindow, SetForegroundWindow, GetWindow, SetWindowLongA, RegisterWindowMessageA, IntersectRect, SystemParametersInfoA, IsIconic, GetWindowPlacement, SendMessageA, UnregisterClassA, HideCaret, ShowCaret, ExcludeUpdateRgn, DrawFocusRect, DefDlgProcA, CharNextA, IsWindowUnicode, EnableWindow, SetCapture, ReleaseCapture, GetNextDlgTabItem, EndDialog, IsWindow, CreateDialogIndirectParamA, DestroyWindow, GetWindowRect, MapDialogRect, SetWindowPos, ShowWindow, PostMessageA, GetCapture, GetActiveWindow, SetActiveWindow, GetAsyncKeyState, GetWindowLongA, BringWindowToTop, UnpackDDElParam, ReuseDDElParam, SetMenu, LoadMenuA, CopyRect, DestroyMenu, GetFocus, SetFocus, GetDlgItem, IsWindowEnabled, GetParent, GetSystemMetrics, InflateRect, OffsetRect, SetRect, UpdateWindow, LoadStringW, PtInRect, SendDlgItemMessageA
GDI32.dll	SetBkMode, SetPolyFillMode, SetROP2, SetStretchBltMode, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, SelectClipRgn, ExcludeClipRect, IntersectClipRect, MoveToEx, LineTo, SetTextAlign, GetCurrentPositionEx, DeleteObject, CreateRectRgn, GetViewportExtEx, GetWindowExtEx, CreateSolidBrush, CreatePatternBrush, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, SetRectRgn, CombineRgn, CreateFontIndirectA, StretchDIBits, CreateCompatibleDC, CreateCompatibleBitmap, GetCharWidthA, CreateFontA, GetTextExtentPoint32A, GetBkColor, GetNearestColor, GetTextColor, GetStretchBltMode, GetPolyFillMode, GetTextAlign, GetBkMode, GetROP2, GetTextFaceA, GetWindowOrgEx, BitBlt, SelectObject, RestoreDC, SaveDC, LPtoDP, DeleteDC, CreateDCA, SetAbortProc, StartDocA, StartPage, EndPage, EndDoc, AbortDoc, GetViewportOrgEx, GetStockObject, CreateRectRgnIndirect, PatBlt, CreateBitmap, GetObjectA, SetBkColor, SetTextColor, GetClipBox, Ellipse, Rectangle, GetTextMetricsA, CreatePen, DPtoLP, CreateDIBitmap, GetTextExtentPointA, GetDeviceCaps
comdlg32.dll	PrintDlgA, GetFileTitleA, CommDlgExtendedError, ChooseColorA, GetSaveFileNameA, GetOpenFileNameA
WINSPOOL.DRV	OpenPrinterA, DocumentPropertiesA, ClosePrinter
ADVAPI32.dll	RegCreateKeyA, SetFileSecurityA, GetFileSecurityA, RegCloseKey, RegQueryValueExA, RegOpenKeyExA, RegQueryValueA, RegEnumKeyA, RegOpenKeyA, RegDeleteKeyA, RegCreateKeyExA, RegSetValueExA, RegSetValueA, SetFileSecurityW, RegDeleteValueA
SHELL32.dll	SHGetFileInfoA, DragQueryFileA, DragFinish, DragAcceptFiles, CommandLineToArgvW, ExtractIconA
COMCTL32.dll	PropertySheetA, DestroyPropertySheetPage, CreatePropertySheetPageA

Exports

Name	Ordinal	Address
Func	1	0x403000

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/23/19-11:34:31.368386	TCP	2404342	ET CNC Feodo Tracker Reported CnC Server TCP group 22	49163	449	192.168.1.16	81.190.160.139

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2019 11:34:31.368386030 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:34:31.581300974 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:34:31.581525087 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:34:31.586631060 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:34:31.801567078 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:34:31.808969021 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:34:31.809015036 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:34:31.809250116 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:34:31.836720943 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:34:32.048755884 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:34:32.256390095 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:34:45.497617006 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:34:45.750281096 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:34:50.605427027 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:34:50.815824032 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:35:16.906105042 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.002166986 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.002470016 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.004559040 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.100501060 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100855112 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100868940 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100879908 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100928068 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100940943 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100958109 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100970030 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.100981951 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.101032972 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.101198912 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.102089882 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.102103949 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.102327108 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.197134018 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.197175026 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.197396994 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.220766068 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.317312002 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.378602028 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.486155987 CEST	443	49164	23.23.229.94	192.168.1.16
Oct 23, 2019 11:35:17.487457991 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:35:17.690907001 CEST	49164	443	192.168.1.16	23.23.229.94
Oct 23, 2019 11:35:17.697981119 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:35:32.525871038 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:35:32.738328934 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:35:34.112720013 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:35:34.324527979 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:35:52.529810905 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:35:52.533471107 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:35:52.744446993 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:35:58.578116894 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:35:58.670531034 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:35:58.881418943 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:36:07.779083014 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:36:07.786429882 CEST	49163	449	192.168.1.16	81.190.160.139
Oct 23, 2019 11:36:07.998950958 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:36:14.846693039 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:36:14.846764088 CEST	449	49163	81.190.160.139	192.168.1.16
Oct 23, 2019 11:36:14.847223043 CEST	49163	449	192.168.1.16	81.190.160.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2019 11:34:33.497194052 CEST	53666	53	192.168.1.16	8.8.8.8
Oct 23, 2019 11:34:33.520772934 CEST	53	53666	8.8.8.8	192.168.1.16
Oct 23, 2019 11:34:34.488578081 CEST	53666	53	192.168.1.16	8.8.8.8
Oct 23, 2019 11:34:34.512100935 CEST	53	53666	8.8.8.8	192.168.1.16
Oct 23, 2019 11:34:35.488744974 CEST	53666	53	192.168.1.16	8.8.8.8
Oct 23, 2019 11:34:35.512242079 CEST	53	53666	8.8.8.8	192.168.1.16
Oct 23, 2019 11:34:37.488519907 CEST	53666	53	192.168.1.16	8.8.8.8
Oct 23, 2019 11:34:37.512154102 CEST	53	53666	8.8.8.8	192.168.1.16
Oct 23, 2019 11:34:41.488066912 CEST	53666	53	192.168.1.16	8.8.8.8
Oct 23, 2019 11:34:41.511527061 CEST	53	53666	8.8.8.8	192.168.1.16
Oct 23, 2019 11:35:16.820647001 CEST	63322	53	192.168.1.16	8.8.8.8
Oct 23, 2019 11:35:16.852674007 CEST	53	63322	8.8.8.8	192.168.1.16
Oct 23, 2019 11:35:16.879141092 CEST	63801	53	192.168.1.16	8.8.8.8
Oct 23, 2019 11:35:16.902837992 CEST	53	63801	8.8.8.8	192.168.1.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 23, 2019 11:35:16.820647001 CEST	192.168.1.16	8.8.8.8	0x894d	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.879141092 CEST	192.168.1.16	8.8.8.8	0xd359	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.229.94	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.83.153	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.243.154	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.73.124	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		174.129.199.232	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.92.64	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.187.248	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.852674007 CEST	8.8.8.8	192.168.1.16	0x894d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.147.226	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.73.124	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.243.154	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.218.16	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.83.153	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.23.229.94	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.92.64	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.187.248	A (IP address)	IN (0x0001)
Oct 23, 2019 11:35:16.902837992 CEST	8.8.8.8	192.168.1.16	0xd359	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.147.226	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After
Oct 23, 2019 11:35:17.197134018 CEST	23.23.229.94	443	192.168.1.16	49164	CN=*.ipify.org, OU=PositiveSSL Wildcard, OU=Domain Control Validated CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Wed Jan 24 01:00:00 CET 2018 Wed Feb 12 01:00:00 CET 2014 Tue May 30 12:48:38 CEST 2000 Tue May 30 12:48:38 CEST 2000	Sun Jan 24 00:59:59 CET 2021 Mon Feb 12 00:59:59 CET 2029 Sat May 30 12:48:38 CEST 2020 Sat May 30 12:48:38 CEST 2020
					CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029
					CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020
					CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe PID: 3188 Parent PID: 2528

General

Start time:	11:33:30
Start date:	23/10/2019
Path:	C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe'
Imagebase:	0x400000
File size:	512000 bytes
MD5 hash:	0A8D5A301D1EA44D5721045EEA07FDCD
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: ??????.exe PID: 3232 Parent PID: 3188

General

Start time:	11:33:31
Start date:	23/10/2019
Path:	C:\ProgramData\??????.exe
Wow64 process (32bit):	false
Commandline:	'C:\ProgramData\??????.exe'
Imagebase:	0x400000
File size:	512000 bytes
MD5 hash:	0A8D5A301D1EA44D5721045EEA07FDCD
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: ??????.exe PID: 3448 Parent PID: 1512

General

Start time:	11:34:08
Start date:	23/10/2019
Path:	C:\Users\user\AppData\Roaming\HomeLan\??????.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\HomeLan\??????.exe
Imagebase:	0x400000
File size:	512000 bytes
MD5 hash:	0A8D5A301D1EA44D5721045EEA07FDCD
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Trickbot_1, Description: Yara detected Trickbot, Source: 00000003.00000002.541461598.0032A000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 2019-10-21-Trickbot-gtag-mor27-retreived-by-Emotet-infected-host.exe

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Cryptography:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Behavior Graph

Simulations

Behavior and APIs

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations