1a5f3ca6597fcccd3295ead4d22ce70b

General
Target

1a5f3ca6597fcccd3295ead4d22ce70b.exe

Filesize

540KB

Completed

17-06-2021 16:05

Score
10/10
MD5

1a5f3ca6597fcccd3295ead4d22ce70b

SHA1

31a359bfee00337bc9c6d23c2cb88737ac9b61c8

SHA256

7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7

Malware Config

Extracted

Family trickbot
Version 2000030
Botnet tot112
C2

196.43.106.38:443

186.97.172.178:443

37.228.70.134:443

144.48.139.206:443

190.110.179.139:443

172.105.15.152:443

177.67.137.111:443

27.72.107.215:443

186.66.15.10:443

189.206.78.155:443

202.131.227.229:443

185.9.187.10:443

196.41.57.46:443

212.200.25.118:443

197.254.14.238:443

45.229.71.211:443

181.167.217.53:443

181.129.116.58:443

185.189.55.207:443

172.104.241.29:443

14.241.244.60:443

144.48.138.213:443

202.138.242.7:443

202.166.196.111:443

36.94.100.202:443

187.19.167.233:443

181.129.242.202:443

36.94.27.124:443

43.245.216.116:443

186.225.63.18:443

41.77.134.250:443

Attributes
autorun
Name:pwgrabb
Name:pwgrabc
ecc_pubkey.base64
Signatures 3

Filter: none

  • Trickbot

    Description

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Suspicious use of AdjustPrivilegeToken
    wermgr.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1464wermgr.exe
  • Suspicious use of WriteProcessMemory
    1a5f3ca6597fcccd3295ead4d22ce70b.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2388 wrote to memory of 314823881a5f3ca6597fcccd3295ead4d22ce70b.execmd.exe
    PID 2388 wrote to memory of 314823881a5f3ca6597fcccd3295ead4d22ce70b.execmd.exe
    PID 2388 wrote to memory of 401223881a5f3ca6597fcccd3295ead4d22ce70b.execmd.exe
    PID 2388 wrote to memory of 401223881a5f3ca6597fcccd3295ead4d22ce70b.execmd.exe
    PID 2388 wrote to memory of 146423881a5f3ca6597fcccd3295ead4d22ce70b.exewermgr.exe
    PID 2388 wrote to memory of 146423881a5f3ca6597fcccd3295ead4d22ce70b.exewermgr.exe
    PID 2388 wrote to memory of 146423881a5f3ca6597fcccd3295ead4d22ce70b.exewermgr.exe
    PID 2388 wrote to memory of 146423881a5f3ca6597fcccd3295ead4d22ce70b.exewermgr.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\1a5f3ca6597fcccd3295ead4d22ce70b.exe
    "C:\Users\Admin\AppData\Local\Temp\1a5f3ca6597fcccd3295ead4d22ce70b.exe"
    Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      PID:3148
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      PID:4012
    • C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      Suspicious use of AdjustPrivilegeToken
      PID:1464
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1464-117-0x0000000000000000-mapping.dmp

                          • memory/1464-119-0x000001F0B11E0000-0x000001F0B11E1000-memory.dmp

                          • memory/1464-118-0x000001F0B11A0000-0x000001F0B11C9000-memory.dmp

                          • memory/2388-114-0x0000000000DC0000-0x0000000000E09000-memory.dmp

                          • memory/2388-116-0x0000000010001000-0x0000000010003000-memory.dmp

                          • memory/2388-115-0x0000000000C90000-0x0000000000C91000-memory.dmp