Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-07-2021 08:12
Static task
static1
Behavioral task
behavioral1
Sample
a651b3d672fbc22d9bb95f8925ccb4d2.exe
Resource
win7v20210408
General
-
Target
a651b3d672fbc22d9bb95f8925ccb4d2.exe
-
Size
756KB
-
MD5
a651b3d672fbc22d9bb95f8925ccb4d2
-
SHA1
60fe19701e9a494eef53bff9509cf0529e7fc930
-
SHA256
56b7f2b832cb3bca8df659101611574933cf7b478d004111b3824013e61a363b
-
SHA512
19c98109ad0f62c4ce502aeabb98076fe2a776c89b0425f6123be0cfabfd02e8306863308a168b2414ec76e8de2d0146980c7ffd7b7b54884eed90d110e570a2
Malware Config
Extracted
trickbot
100018
rob111
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1360 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a651b3d672fbc22d9bb95f8925ccb4d2.exepid process 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a651b3d672fbc22d9bb95f8925ccb4d2.exedescription pid process target process PID 684 wrote to memory of 1348 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe cmd.exe PID 684 wrote to memory of 1348 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe cmd.exe PID 684 wrote to memory of 1348 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe cmd.exe PID 684 wrote to memory of 1348 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe cmd.exe PID 684 wrote to memory of 1360 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe wermgr.exe PID 684 wrote to memory of 1360 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe wermgr.exe PID 684 wrote to memory of 1360 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe wermgr.exe PID 684 wrote to memory of 1360 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe wermgr.exe PID 684 wrote to memory of 1360 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe wermgr.exe PID 684 wrote to memory of 1360 684 a651b3d672fbc22d9bb95f8925ccb4d2.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a651b3d672fbc22d9bb95f8925ccb4d2.exe"C:\Users\Admin\AppData\Local\Temp\a651b3d672fbc22d9bb95f8925ccb4d2.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-60-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/684-61-0x0000000000390000-0x00000000003D1000-memory.dmpFilesize
260KB
-
memory/684-65-0x0000000000540000-0x000000000057D000-memory.dmpFilesize
244KB
-
memory/684-64-0x0000000000250000-0x000000000028F000-memory.dmpFilesize
252KB
-
memory/684-67-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/684-66-0x00000000002B0000-0x00000000002C1000-memory.dmpFilesize
68KB
-
memory/1360-68-0x0000000000000000-mapping.dmp
-
memory/1360-69-0x0000000000060000-0x0000000000089000-memory.dmpFilesize
164KB
-
memory/1360-70-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB