Analysis

  • max time kernel
    32s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    05-05-2021 11:52

General

  • Target

    ea334250dda64c740a8e06ca7c1717e972a0d524011880c7ff05b1e35a881215.exe

  • Size

    812KB

  • MD5

    d202217ae5758e4acda1b7a2d89241ef

  • SHA1

    8d3d3b0ba95dbf4c794949cd04d34a139ab75e0b

  • SHA256

    ea334250dda64c740a8e06ca7c1717e972a0d524011880c7ff05b1e35a881215

  • SHA512

    f8aab1c77bbaaaec4a6d476ae04c954086a835a05b5bea95ec16ea8bd04cbbe23d363ac31cf21857be515d75019e3bba0582927887a270eac396397b15f32949

Malware Config

Extracted

Family

trickbot

Version

2000029

Botnet

tot92

C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea334250dda64c740a8e06ca7c1717e972a0d524011880c7ff05b1e35a881215.exe
    "C:\Users\Admin\AppData\Local\Temp\ea334250dda64c740a8e06ca7c1717e972a0d524011880c7ff05b1e35a881215.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      2⤵
        PID:3956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe
        2⤵
          PID:3052
        • C:\Windows\system32\wermgr.exe
          C:\Windows\system32\wermgr.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3264

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/804-114-0x00000000023D0000-0x000000000240F000-memory.dmp

        Filesize

        252KB

      • memory/804-117-0x0000000000570000-0x00000000006BA000-memory.dmp

        Filesize

        1.3MB

      • memory/804-119-0x0000000010001000-0x0000000010003000-memory.dmp

        Filesize

        8KB

      • memory/804-118-0x0000000002360000-0x0000000002361000-memory.dmp

        Filesize

        4KB

      • memory/3264-120-0x0000000000000000-mapping.dmp

      • memory/3264-122-0x0000021DFEE90000-0x0000021DFEE91000-memory.dmp

        Filesize

        4KB

      • memory/3264-121-0x0000021DFED80000-0x0000021DFEDA9000-memory.dmp

        Filesize

        164KB