Resubmissions
25-02-2021 19:33
210225-ckt8nv3sn2 1025-02-2021 19:29
210225-3e1s9c98dn 1011-02-2021 15:28
210211-8grt4rpew2 1011-02-2021 08:01
210211-4q732bhs9s 10Analysis
-
max time kernel
1631s -
max time network
1698s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-02-2021 15:28
Static task
static1
Behavioral task
behavioral1
Sample
4c765049f292cb94f47f91dbe243d4b2.exe
Resource
win7v20201028
General
-
Target
4c765049f292cb94f47f91dbe243d4b2.exe
-
Size
912KB
-
MD5
4c765049f292cb94f47f91dbe243d4b2
-
SHA1
610911bf779ba590ad382be6f8ed799171d12f50
-
SHA256
91283de902fbd3f620ea4ed912b21410dba2880e1a81991db44a382bd58784be
-
SHA512
d603408f96dab97a5b50ed47e8d283cdc42b1ef1aa315b5ff479085fc5d0556302da8b018f69cf64dbdd4734ebcb21cb2190e3ed4c132ffae65c555623c42584
Malware Config
Extracted
trickbot
2000025
tot39
134.119.186.200:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443
-
autorunName:pwgrab
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
cmd.execmd.execmd.exeflow pid process 38 652 cmd.exe 41 1040 cmd.exe 46 2684 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
4c765049f292cb94f47f91dbe243d4b2.exepid process 3620 4c765049f292cb94f47f91dbe243d4b2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 api.ipify.org 30 api.ipify.org -
Drops file in Program Files directory 3 IoCs
Processes:
4c765049f292cb94f47f91dbe243d4b2.exewermgr.exedescription ioc process File created C:\Program Files (x86)\DinoComp\4c765049f292cb94f47f91dbe243d4b2.exe 4c765049f292cb94f47f91dbe243d4b2.exe File opened for modification C:\Program Files (x86)\DinoComp\4c765049f292cb94f47f91dbe243d4b2.exe 4c765049f292cb94f47f91dbe243d4b2.exe File created C:\Program Files (x86)\DinoComp\profiles.ini wermgr.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2124 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
cmd.execmd.exepid process 652 cmd.exe 652 cmd.exe 1040 cmd.exe 1040 cmd.exe 652 cmd.exe 652 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wermgr.execmd.exedescription pid process Token: SeDebugPrivilege 4244 wermgr.exe Token: SeDebugPrivilege 652 cmd.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
4c765049f292cb94f47f91dbe243d4b2.exe4c765049f292cb94f47f91dbe243d4b2.exepid process 4704 4c765049f292cb94f47f91dbe243d4b2.exe 4704 4c765049f292cb94f47f91dbe243d4b2.exe 3620 4c765049f292cb94f47f91dbe243d4b2.exe 3620 4c765049f292cb94f47f91dbe243d4b2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c765049f292cb94f47f91dbe243d4b2.exe4c765049f292cb94f47f91dbe243d4b2.exewermgr.exedescription pid process target process PID 4704 wrote to memory of 3620 4704 4c765049f292cb94f47f91dbe243d4b2.exe 4c765049f292cb94f47f91dbe243d4b2.exe PID 4704 wrote to memory of 3620 4704 4c765049f292cb94f47f91dbe243d4b2.exe 4c765049f292cb94f47f91dbe243d4b2.exe PID 4704 wrote to memory of 3620 4704 4c765049f292cb94f47f91dbe243d4b2.exe 4c765049f292cb94f47f91dbe243d4b2.exe PID 3620 wrote to memory of 744 3620 4c765049f292cb94f47f91dbe243d4b2.exe wermgr.exe PID 3620 wrote to memory of 744 3620 4c765049f292cb94f47f91dbe243d4b2.exe wermgr.exe PID 3620 wrote to memory of 4244 3620 4c765049f292cb94f47f91dbe243d4b2.exe wermgr.exe PID 3620 wrote to memory of 4244 3620 4c765049f292cb94f47f91dbe243d4b2.exe wermgr.exe PID 3620 wrote to memory of 4244 3620 4c765049f292cb94f47f91dbe243d4b2.exe wermgr.exe PID 3620 wrote to memory of 4244 3620 4c765049f292cb94f47f91dbe243d4b2.exe wermgr.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe PID 4244 wrote to memory of 652 4244 wermgr.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c765049f292cb94f47f91dbe243d4b2.exe"C:\Users\Admin\AppData\Local\Temp\4c765049f292cb94f47f91dbe243d4b2.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DinoComp\4c765049f292cb94f47f91dbe243d4b2.exe"C:\Program Files (x86)\DinoComp\4c765049f292cb94f47f91dbe243d4b2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Gathers network information
-
C:\Windows\system32\net.exenet config workstation5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation6⤵
-
C:\Windows\system32\net.exenet view /all5⤵
- Discovers systems in the same network
-
C:\Windows\system32\net.exenet view /all /domain5⤵
- Discovers systems in the same network
-
C:\Windows\system32\nltest.exenltest /domain_trusts5⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\DinoComp\4c765049f292cb94f47f91dbe243d4b2.exeMD5
4c765049f292cb94f47f91dbe243d4b2
SHA1610911bf779ba590ad382be6f8ed799171d12f50
SHA25691283de902fbd3f620ea4ed912b21410dba2880e1a81991db44a382bd58784be
SHA512d603408f96dab97a5b50ed47e8d283cdc42b1ef1aa315b5ff479085fc5d0556302da8b018f69cf64dbdd4734ebcb21cb2190e3ed4c132ffae65c555623c42584
-
C:\Program Files (x86)\DinoComp\4c765049f292cb94f47f91dbe243d4b2.exeMD5
4c765049f292cb94f47f91dbe243d4b2
SHA1610911bf779ba590ad382be6f8ed799171d12f50
SHA25691283de902fbd3f620ea4ed912b21410dba2880e1a81991db44a382bd58784be
SHA512d603408f96dab97a5b50ed47e8d283cdc42b1ef1aa315b5ff479085fc5d0556302da8b018f69cf64dbdd4734ebcb21cb2190e3ed4c132ffae65c555623c42584
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3341490333-719741536-2920803124-1000\0f5007522459c86e95ffcc62f32308f1_4a1d5b5d-6336-41a4-a4da-b4af65e6deffMD5
769ac535c4d943a7167223d44753c5e9
SHA140772ec66627604213ee3269b6b7046e27bb2ad8
SHA256cc544b507572b02d34dc0cd36151d9970aac3d374feb7c2a8a06de30f48f0712
SHA5125b64abff651865bd0e9764745226a963698b7f5927920dc9a902b102394b4570fc45a48041d73a792ade20293024893b24a8691d6fcd8e0a12c242d81855680b
-
memory/652-15-0x0000000000000000-mapping.dmp
-
memory/652-17-0x00000209D3B60000-0x00000209D3B61000-memory.dmpFilesize
4KB
-
memory/1040-18-0x0000000000000000-mapping.dmp
-
memory/1736-26-0x0000000000000000-mapping.dmp
-
memory/1800-24-0x0000000000000000-mapping.dmp
-
memory/2124-21-0x0000000000000000-mapping.dmp
-
memory/2684-28-0x0000000000000000-mapping.dmp
-
memory/2684-29-0x0000011DCA3E0000-0x0000011DCA3E1000-memory.dmpFilesize
4KB
-
memory/3252-23-0x0000000000000000-mapping.dmp
-
memory/3620-10-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB
-
memory/3620-8-0x0000000003FE0000-0x0000000004018000-memory.dmpFilesize
224KB
-
memory/3620-4-0x0000000000000000-mapping.dmp
-
memory/3620-11-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/4244-12-0x0000000000000000-mapping.dmp
-
memory/4244-14-0x0000025221590000-0x0000025221591000-memory.dmpFilesize
4KB
-
memory/4244-13-0x0000025221480000-0x00000252214A7000-memory.dmpFilesize
156KB
-
memory/4344-22-0x0000000000000000-mapping.dmp
-
memory/4396-25-0x0000000000000000-mapping.dmp
-
memory/4476-27-0x0000000000000000-mapping.dmp
-
memory/4704-3-0x00000000040B0000-0x00000000040E6000-memory.dmpFilesize
216KB
-
memory/4704-2-0x00000000040F0000-0x0000000004128000-memory.dmpFilesize
224KB