Analysis
- max time kernel
129s - max time network
142s - platform
windows7_x64 - resource
win7v20201028 - submitted
30/12/2020, 08:49
General
- Target SecuriteInfo.com.Variant.Razy.820175.12412.8766.exe
- Size 612KB
- Sample201230-1jxhsblbkn
- SHA256 1610f95a5fa7d0ff96c212663f92fd12e64fde5fbad5fae7849b9416d2518f10
Score
10/10
Malware Config
Extracted
Family
-
trickbot
Version
-
100008
Botnet
-
mor7
C2
-
103.231.115.106:449
-
117.222.63.100:449
-
117.254.58.83:449
-
149.54.11.54:449
-
170.82.4.64:449
-
177.11.12.93:449
-
182.16.187.251:449
-
187.108.86.48:449
-
190.152.88.57:449
-
203.88.149.33:449
-
36.89.191.119:449
-
41.159.31.227:449
-
85.202.128.243:449
-
92.204.160.82:449
-
103.150.68.124:449
-
103.126.185.7:449
-
103.112.145.58:449
-
103.110.53.174:449
-
102.164.208.48:449
-
102.164.208.44:449
Attributes
-
autorunName:pwgrab
ecc_pubkey.base64
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.12412.8766.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.12412.8766.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1096-4-0x0000000002670000-0x00000000026AC000-memory.dmp
memory/1096-6-0x0000000000380000-0x0000000000384000-memory.dmp
memory/1096-7-0x0000000002710000-0x0000000002714000-memory.dmp