Analysis
-
max time kernel
154s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 09:06
Static task
static1
Behavioral task
behavioral1
Sample
3bd37a0d6936e911850beb6d22f06b19.exe
Resource
win7v20210408
General
-
Target
3bd37a0d6936e911850beb6d22f06b19.exe
-
Size
356KB
-
MD5
3bd37a0d6936e911850beb6d22f06b19
-
SHA1
fa11a7585f5255447e6b3f5dfc2d78d6d6a22605
-
SHA256
9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3
-
SHA512
9c0a070c2c66f08eaf4f1ae674951d795a43b438c8532b4121ab217f475ef5749e0f0ab4ae3ab1ca2f8dcd86cbf0ca750930de14eb2cb0cc8dc4a0d2a3da569e
Malware Config
Extracted
trickbot
100019
lip124
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ident.me 15 ident.me -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1624 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3bd37a0d6936e911850beb6d22f06b19.exepid process 1060 3bd37a0d6936e911850beb6d22f06b19.exe 1060 3bd37a0d6936e911850beb6d22f06b19.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3bd37a0d6936e911850beb6d22f06b19.exedescription pid process target process PID 1060 wrote to memory of 1624 1060 3bd37a0d6936e911850beb6d22f06b19.exe wermgr.exe PID 1060 wrote to memory of 1624 1060 3bd37a0d6936e911850beb6d22f06b19.exe wermgr.exe PID 1060 wrote to memory of 1624 1060 3bd37a0d6936e911850beb6d22f06b19.exe wermgr.exe PID 1060 wrote to memory of 1624 1060 3bd37a0d6936e911850beb6d22f06b19.exe wermgr.exe PID 1060 wrote to memory of 1880 1060 3bd37a0d6936e911850beb6d22f06b19.exe cmd.exe PID 1060 wrote to memory of 1880 1060 3bd37a0d6936e911850beb6d22f06b19.exe cmd.exe PID 1060 wrote to memory of 1880 1060 3bd37a0d6936e911850beb6d22f06b19.exe cmd.exe PID 1060 wrote to memory of 1880 1060 3bd37a0d6936e911850beb6d22f06b19.exe cmd.exe PID 1060 wrote to memory of 1624 1060 3bd37a0d6936e911850beb6d22f06b19.exe wermgr.exe PID 1060 wrote to memory of 1624 1060 3bd37a0d6936e911850beb6d22f06b19.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bd37a0d6936e911850beb6d22f06b19.exe"C:\Users\Admin\AppData\Local\Temp\3bd37a0d6936e911850beb6d22f06b19.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-60-0x0000000000460000-0x000000000049E000-memory.dmpFilesize
248KB
-
memory/1060-63-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/1060-64-0x0000000000370000-0x00000000003AC000-memory.dmpFilesize
240KB
-
memory/1060-65-0x00000000004A0000-0x00000000004DA000-memory.dmpFilesize
232KB
-
memory/1060-66-0x00000000003B0000-0x00000000003C1000-memory.dmpFilesize
68KB
-
memory/1060-67-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/1624-68-0x0000000000000000-mapping.dmp
-
memory/1624-69-0x0000000000060000-0x0000000000089000-memory.dmpFilesize
164KB
-
memory/1624-70-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB