Analysis

  • max time kernel
    1643s
  • max time network
    1771s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-11-2020 18:53

General

  • Target

    asdpogasdjabn.exe

  • Size

    660KB

  • MD5

    3ba7d3dbc17ce640e0bb3dd5f989169b

  • SHA1

    84ee0b6e02339f1deb33d75693551db444923ba8

  • SHA256

    52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929

  • SHA512

    3a683b35dc6b6c17de5a21171625c3fb5259d60c73867aa81b89cedeef61f1b95cce099cc5bb4fdeb2ddf7f2f0236c6d877970768a7f91330ecfbbc38931a231

Malware Config

Extracted

Family

trickbot

Version

100001

Botnet

tar2

C2

66.85.183.5:443

185.163.47.157:443

94.140.115.99:443

195.123.240.40:443

195.123.241.226:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Blacklisted process makes network request 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Modifies service 2 TTPs 2 IoCs
  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 714 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\asdpogasdjabn.exe
    "C:\Users\Admin\AppData\Local\Temp\asdpogasdjabn.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      2⤵
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:784
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe
        3⤵
        • Blacklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:1140
        • C:\Windows\system32\ipconfig.exe
          ipconfig /all
          4⤵
          • Modifies service
          • Gathers network information
          PID:1664
        • C:\Windows\system32\net.exe
          net config workstation
          4⤵
            PID:848
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 config workstation
              5⤵
                PID:1792
            • C:\Windows\system32\net.exe
              net view /all
              4⤵
              • Discovers systems in the same network
              PID:1560
            • C:\Windows\system32\net.exe
              net view /all /domain
              4⤵
              • Discovers systems in the same network
              PID:1012
            • C:\Windows\system32\nltest.exe
              nltest /domain_trusts
              4⤵
                PID:812
              • C:\Windows\system32\nltest.exe
                nltest /domain_trusts /all_trusts
                4⤵
                  PID:1096

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Execution

          Command-Line Interface

          1
          T1059

          Persistence

          Modify Existing Service

          1
          T1031

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Remote System Discovery

          1
          T1018

          System Information Discovery

          1
          T1082

          Collection

          Data from Local System

          1
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \??\PIPE\NETLOGON
            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

          • memory/744-0-0x00000000004B0000-0x00000000004EE000-memory.dmp
            Filesize

            248KB

          • memory/744-1-0x0000000000540000-0x000000000057A000-memory.dmp
            Filesize

            232KB

          • memory/784-96-0x0000000000130000-0x0000000000130017-memory.dmp
            Filesize

            23B

          • memory/784-3-0x0000000000000000-mapping.dmp
          • memory/784-17-0x0000000000130000-0x0000000000130017-memory.dmp
            Filesize

            23B

          • memory/784-16-0x0000000000140000-0x0000000000141000-memory.dmp
            Filesize

            4KB

          • memory/812-90-0x0000000000000000-mapping.dmp
          • memory/848-85-0x0000000000000000-mapping.dmp
          • memory/1012-88-0x0000000000000000-mapping.dmp
          • memory/1096-91-0x0000000000000000-mapping.dmp
          • memory/1140-15-0x0000000000000000-mapping.dmp
          • memory/1140-82-0x0000000001B80000-0x0000000001B80188-memory.dmp
            Filesize

            392B

          • memory/1140-50-0x0000000001B70000-0x0000000001B70400-memory.dmp
            Filesize

            1024B

          • memory/1140-51-0x0000000001B60000-0x0000000001B6000D-memory.dmp
            Filesize

            13B

          • memory/1140-46-0x0000000180000000-0x0000000180016000-memory.dmp
            Filesize

            88KB

          • memory/1140-49-0x0000000001BB0000-0x0000000001BB0080-memory.dmp
            Filesize

            128B

          • memory/1140-48-0x0000000180000000-0x0000000180016000-memory.dmp
            Filesize

            88KB

          • memory/1140-93-0x0000000001B80000-0x0000000001B80188-memory.dmp
            Filesize

            392B

          • memory/1140-95-0x0000000001B60000-0x0000000001B6000D-memory.dmp
            Filesize

            13B

          • memory/1280-2-0x0000000000000000-mapping.dmp
          • memory/1560-87-0x0000000000000000-mapping.dmp
          • memory/1664-83-0x0000000000000000-mapping.dmp
          • memory/1792-86-0x0000000000000000-mapping.dmp