Analysis
- max time kernel
146s - max time network
134s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/09/2021, 17:48
General
- Target 4ae6aa84d6fd250e514f1ecdc8084757.exe
- Size 489KB
- Sample210929-wdfgcsfdh3
- SHA256 7905c507eb3eec76cae44b13de78a70dc045eda20f2bbfb2f83f9ce50b0a9ab0
Malware Config
Extracted
-
trickbot
-
2000033
-
tot154
-
179.42.137.102:443
-
191.36.152.198:443
-
179.42.137.104:443
-
179.42.137.106:443
-
179.42.137.108:443
-
202.183.12.124:443
-
194.190.18.122:443
-
103.56.207.230:443
-
171.103.187.218:449
-
171.103.189.118:449
-
18.139.111.104:443
-
179.42.137.105:443
-
186.4.193.75:443
-
171.101.229.2:449
-
179.42.137.107:443
-
103.56.43.209:449
-
179.42.137.110:443
-
45.181.207.156:443
-
197.44.54.162:449
-
179.42.137.109:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae6aa84d6fd250e514f1ecdc8084757.exe"C:\Users\Admin\AppData\Local\Temp\4ae6aa84d6fd250e514f1ecdc8084757.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1404-114-0x00000000005E0000-0x0000000000668000-memory.dmp
memory/1404-115-0x0000000000860000-0x0000000000861000-memory.dmp
memory/1404-116-0x0000000010001000-0x0000000010003000-memory.dmp
memory/1516-119-0x00000280C1EC0000-0x00000280C1EC1000-memory.dmp
memory/1516-118-0x00000280C1DB0000-0x00000280C1DD9000-memory.dmp