Analysis

  • max time kernel
    43s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    17-06-2021 15:20

General

  • Target

    1a5f3ca6597fcccd3295ead4d22ce70b.exe

  • Size

    540KB

  • MD5

    1a5f3ca6597fcccd3295ead4d22ce70b

  • SHA1

    31a359bfee00337bc9c6d23c2cb88737ac9b61c8

  • SHA256

    7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7

  • SHA512

    91e4f72900f10e39901cb4c3ca5f1d39d4f61501dc9b709ce03c55010606e341be5359252cc1d9a253a3f746af40321ca3a23a91d63dc69cd9b730110773b315

Malware Config

Extracted

Family

trickbot

Version

2000030

Botnet

tot112

C2

196.43.106.38:443

186.97.172.178:443

37.228.70.134:443

144.48.139.206:443

190.110.179.139:443

172.105.15.152:443

177.67.137.111:443

27.72.107.215:443

186.66.15.10:443

189.206.78.155:443

202.131.227.229:443

185.9.187.10:443

196.41.57.46:443

212.200.25.118:443

197.254.14.238:443

45.229.71.211:443

181.167.217.53:443

181.129.116.58:443

185.189.55.207:443

172.104.241.29:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a5f3ca6597fcccd3295ead4d22ce70b.exe
    "C:\Users\Admin\AppData\Local\Temp\1a5f3ca6597fcccd3295ead4d22ce70b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      2⤵
        PID:1156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe
        2⤵
          PID:836
        • C:\Windows\system32\wermgr.exe
          C:\Windows\system32\wermgr.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1560

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1072-59-0x00000000752F1000-0x00000000752F3000-memory.dmp
        Filesize

        8KB

      • memory/1072-60-0x0000000000070000-0x00000000000B9000-memory.dmp
        Filesize

        292KB

      • memory/1072-61-0x00000000002D0000-0x00000000002E1000-memory.dmp
        Filesize

        68KB

      • memory/1072-62-0x0000000010001000-0x0000000010003000-memory.dmp
        Filesize

        8KB

      • memory/1560-63-0x0000000000000000-mapping.dmp
      • memory/1560-64-0x0000000000060000-0x0000000000089000-memory.dmp
        Filesize

        164KB

      • memory/1560-65-0x0000000000120000-0x0000000000121000-memory.dmp
        Filesize

        4KB