Analysis
-
max time kernel
1622s -
max time network
1696s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-08-2021 15:31
Static task
static1
Behavioral task
behavioral1
Sample
8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe
Resource
win7v20210410
General
-
Target
8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe
-
Size
860KB
-
MD5
0ab7a7fb149baba9474e3f19809a631a
-
SHA1
d2988c86826ee3701e3e6deb1f8b8cdfd6493d28
-
SHA256
8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3
-
SHA512
d265a3f6e4bb7889f79a3da89a63023be1527b5a3dd6475daea755df7bad27c513de902d4358c355526ff719df0a30506446aa81226f68c3766d4a5421e04665
Malware Config
Extracted
trickbot
100018
tot101
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
suricata: ET MALWARE Trickbot Checkin Response
suricata: ET MALWARE Trickbot Checkin Response
-
suricata: ET MALWARE Win32/Trickbot Data Exfiltration
suricata: ET MALWARE Win32/Trickbot Data Exfiltration
-
Blocklisted process makes network request 3 IoCs
Processes:
cmd.exeflow pid process 41 2872 cmd.exe 42 2872 cmd.exe 43 2872 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 checkip.amazonaws.com -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1144 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
cmd.execmd.execmd.exepid process 2220 cmd.exe 2220 cmd.exe 904 cmd.exe 904 cmd.exe 2872 cmd.exe 2872 cmd.exe 904 cmd.exe 904 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.execmd.execmd.exedescription pid process Token: SeDebugPrivilege 3676 wermgr.exe Token: SeDebugPrivilege 2220 cmd.exe Token: SeDebugPrivilege 904 cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exepid process 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exewermgr.exedescription pid process target process PID 992 wrote to memory of 3996 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe cmd.exe PID 992 wrote to memory of 3996 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe cmd.exe PID 992 wrote to memory of 3928 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe cmd.exe PID 992 wrote to memory of 3928 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe cmd.exe PID 992 wrote to memory of 3676 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe wermgr.exe PID 992 wrote to memory of 3676 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe wermgr.exe PID 992 wrote to memory of 3676 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe wermgr.exe PID 992 wrote to memory of 3676 992 8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe wermgr.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe PID 3676 wrote to memory of 2220 3676 wermgr.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe"C:\Users\Admin\AppData\Local\Temp\8ec99d6d2935a9d4bb4ffb425373cd175d116bc3297eeb2913de5d0b5194d3d3.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe/c ipconfig /all4⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Gathers network information
-
C:\Windows\system32\cmd.exe/c net config workstation4⤵
-
C:\Windows\system32\net.exenet config workstation5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation6⤵
-
C:\Windows\system32\cmd.exe/c net view /all4⤵
-
C:\Windows\system32\net.exenet view /all5⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c net view /all /domain4⤵
-
C:\Windows\system32\net.exenet view /all /domain5⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts4⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts5⤵
-
C:\Windows\system32\cmd.exe/c nltest /domain_trusts /all_trusts4⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/192-148-0x0000000000000000-mapping.dmp
-
memory/212-149-0x0000000000000000-mapping.dmp
-
memory/496-150-0x0000000000000000-mapping.dmp
-
memory/632-154-0x0000000000000000-mapping.dmp
-
memory/728-151-0x0000000000000000-mapping.dmp
-
memory/904-133-0x0000000000000000-mapping.dmp
-
memory/992-114-0x0000000002520000-0x000000000255F000-memory.dmpFilesize
252KB
-
memory/992-119-0x0000000002290000-0x0000000002291000-memory.dmpFilesize
4KB
-
memory/992-120-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/992-117-0x0000000002230000-0x000000000226D000-memory.dmpFilesize
244KB
-
memory/992-118-0x0000000002560000-0x000000000259B000-memory.dmpFilesize
236KB
-
memory/996-147-0x0000000000000000-mapping.dmp
-
memory/1144-144-0x0000000000000000-mapping.dmp
-
memory/1328-155-0x0000000000000000-mapping.dmp
-
memory/1496-143-0x0000000000000000-mapping.dmp
-
memory/2140-146-0x0000000000000000-mapping.dmp
-
memory/2184-145-0x0000000000000000-mapping.dmp
-
memory/2220-126-0x0000000000000000-mapping.dmp
-
memory/2220-132-0x000002A3664E0000-0x000002A3664E1000-memory.dmpFilesize
4KB
-
memory/2872-140-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB
-
memory/2872-139-0x0000000000000000-mapping.dmp
-
memory/3468-153-0x0000000000000000-mapping.dmp
-
memory/3676-123-0x000002780B260000-0x000002780B261000-memory.dmpFilesize
4KB
-
memory/3676-122-0x000002780B150000-0x000002780B179000-memory.dmpFilesize
164KB
-
memory/3676-121-0x0000000000000000-mapping.dmp
-
memory/3712-152-0x0000000000000000-mapping.dmp