Resubmissions
17-01-2021 17:46
210117-3136fl8fba 1017-01-2021 17:07
210117-hja3svw3ca 1016-01-2021 12:09
210116-yfbgweax36 1016-01-2021 07:28
210116-bpcv3fv8fn 10Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 17:07
Static task
static1
Behavioral task
behavioral1
Sample
b5ef0dd86a3fb068a1eef951a9e9bcd1.exe
Resource
win7v20201028
General
-
Target
b5ef0dd86a3fb068a1eef951a9e9bcd1.exe
-
Size
630KB
-
MD5
b5ef0dd86a3fb068a1eef951a9e9bcd1
-
SHA1
098e8b092629f8b1ab59d20b4ebbe39725b2064b
-
SHA256
b6af20ac6ddedad4f914bcb11c08e5399a4aadade16365bae3a5cb1611371e89
-
SHA512
45b1477ba4900eaae9731a5f182ff566ba1b9c023db5a0a251779956ea6c2167a4175c182d977b210ec056233237c31981a32593e089ac97418d656678e8fb73
Malware Config
Extracted
trickbot
100010
rob38
5.34.180.180:443
64.74.160.228:443
198.46.198.116:443
5.34.180.185:443
107.152.46.188:443
195.123.241.214:443
23.254.224.2:443
107.172.188.113:443
200.52.147.93:443
185.198.59.45:443
45.14.226.101:443
185.82.126.38:443
85.204.116.139:443
45.155.173.248:443
103.91.244.50:443
45.230.244.20:443
45.226.124.226:443
187.84.95.6:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
180.92.158.244:443
-
autorunName:pwgrab
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2684 wermgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b5ef0dd86a3fb068a1eef951a9e9bcd1.exedescription pid process target process PID 580 wrote to memory of 2536 580 b5ef0dd86a3fb068a1eef951a9e9bcd1.exe wermgr.exe PID 580 wrote to memory of 2536 580 b5ef0dd86a3fb068a1eef951a9e9bcd1.exe wermgr.exe PID 580 wrote to memory of 2684 580 b5ef0dd86a3fb068a1eef951a9e9bcd1.exe wermgr.exe PID 580 wrote to memory of 2684 580 b5ef0dd86a3fb068a1eef951a9e9bcd1.exe wermgr.exe PID 580 wrote to memory of 2684 580 b5ef0dd86a3fb068a1eef951a9e9bcd1.exe wermgr.exe PID 580 wrote to memory of 2684 580 b5ef0dd86a3fb068a1eef951a9e9bcd1.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ef0dd86a3fb068a1eef951a9e9bcd1.exe"C:\Users\Admin\AppData\Local\Temp\b5ef0dd86a3fb068a1eef951a9e9bcd1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-2-0x00000000001E0000-0x00000000001E5000-memory.dmpFilesize
20KB
-
memory/580-3-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/580-5-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/580-4-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/2684-6-0x0000000000000000-mapping.dmp
-
memory/2684-8-0x0000026180BF0000-0x0000026180BF1000-memory.dmpFilesize
4KB
-
memory/2684-7-0x0000026180BB0000-0x0000026180BD8000-memory.dmpFilesize
160KB