Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 07:20
Static task
static1
Behavioral task
behavioral1
Sample
6478f8264670d69dce28a3101aca4ff6.exe
Resource
win7v20210408
General
-
Target
6478f8264670d69dce28a3101aca4ff6.exe
-
Size
356KB
-
MD5
6478f8264670d69dce28a3101aca4ff6
-
SHA1
fa7c3a32f18492f2220078ab432565ca1003e426
-
SHA256
a3169da61f96b181fc44fd514040fce58c1cc54dd9fb31da42fc2a98db0de7a6
-
SHA512
deeecdb9d650f26ef29d86af8cc3790024fc942d687d6cfde03d6a11490731a50352518a614c27b5806d5c1a8c218dc370e2bba2007ea402d65fe6b5f48dec54
Malware Config
Extracted
trickbot
100019
lip124
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ipinfo.io -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1996 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6478f8264670d69dce28a3101aca4ff6.exepid process 2024 6478f8264670d69dce28a3101aca4ff6.exe 2024 6478f8264670d69dce28a3101aca4ff6.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
6478f8264670d69dce28a3101aca4ff6.exedescription pid process target process PID 2024 wrote to memory of 1996 2024 6478f8264670d69dce28a3101aca4ff6.exe wermgr.exe PID 2024 wrote to memory of 1996 2024 6478f8264670d69dce28a3101aca4ff6.exe wermgr.exe PID 2024 wrote to memory of 1996 2024 6478f8264670d69dce28a3101aca4ff6.exe wermgr.exe PID 2024 wrote to memory of 1996 2024 6478f8264670d69dce28a3101aca4ff6.exe wermgr.exe PID 2024 wrote to memory of 1240 2024 6478f8264670d69dce28a3101aca4ff6.exe cmd.exe PID 2024 wrote to memory of 1240 2024 6478f8264670d69dce28a3101aca4ff6.exe cmd.exe PID 2024 wrote to memory of 1240 2024 6478f8264670d69dce28a3101aca4ff6.exe cmd.exe PID 2024 wrote to memory of 1240 2024 6478f8264670d69dce28a3101aca4ff6.exe cmd.exe PID 2024 wrote to memory of 1996 2024 6478f8264670d69dce28a3101aca4ff6.exe wermgr.exe PID 2024 wrote to memory of 1996 2024 6478f8264670d69dce28a3101aca4ff6.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6478f8264670d69dce28a3101aca4ff6.exe"C:\Users\Admin\AppData\Local\Temp\6478f8264670d69dce28a3101aca4ff6.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1996-68-0x0000000000000000-mapping.dmp
-
memory/1996-69-0x0000000000060000-0x0000000000089000-memory.dmpFilesize
164KB
-
memory/1996-70-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2024-60-0x00000000003B0000-0x00000000003EE000-memory.dmpFilesize
248KB
-
memory/2024-63-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/2024-65-0x0000000000560000-0x000000000059A000-memory.dmpFilesize
232KB
-
memory/2024-64-0x0000000000370000-0x00000000003AC000-memory.dmpFilesize
240KB
-
memory/2024-67-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/2024-66-0x0000000000830000-0x0000000000841000-memory.dmpFilesize
68KB