Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-11-2020 12:13
Static task
static1
Behavioral task
behavioral1
Sample
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe
-
Size
660KB
-
MD5
c252603232987121f642be93e9e39348
-
SHA1
9a06574b7f9f732cf6265fe0aff4c133c1cb8314
-
SHA256
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3
-
SHA512
70630a8d2c467a6fed99443da2a776c67b6f819c58f5c77d6af8e441a53c891eb169c27a5ee4b5f799d3d51df922d9688d1f4edd55aa6b094d1422291681dc7e
Malware Config
Extracted
Family
trickbot
Version
100003
Botnet
tar3
C2
102.164.206.129:449
103.131.156.21:449
103.131.157.102:449
103.131.157.161:449
103.146.232.5:449
103.150.68.124:449
103.156.126.232:449
103.30.85.157:449
103.52.47.20:449
Attributes
-
autorunName:pwgrab
ecc_pubkey.base64
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 3940 wermgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exepid process 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exedescription pid process target process PID 984 wrote to memory of 3940 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe wermgr.exe PID 984 wrote to memory of 3940 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe wermgr.exe PID 984 wrote to memory of 3940 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe wermgr.exe PID 984 wrote to memory of 3940 984 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe"C:\Users\Admin\AppData\Local\Temp\77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3940