Analysis
- max time kernel
107s - max time network
149s - submitted
01/01/1970, 00:00
General
- Target c7e6ab5b45d664feb300b309566f3107.exe
- Size 443KB
- Sample211027-pphbrshahm
- SHA256 061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565
Malware Config
Extracted
-
trickbot
-
100019
-
lip141
-
65.152.201.203:443
-
185.56.175.122:443
-
46.99.175.217:443
-
179.189.229.254:443
-
46.99.175.149:443
-
181.129.167.82:443
-
216.166.148.187:443
-
46.99.188.223:443
-
128.201.76.252:443
-
62.99.79.77:443
-
60.51.47.65:443
-
24.162.214.166:443
-
45.36.99.184:443
-
97.83.40.67:443
-
184.74.99.214:443
-
103.105.254.17:443
-
62.99.76.213:443
-
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7e6ab5b45d664feb300b309566f3107.exe"C:\Users\Admin\AppData\Local\Temp\c7e6ab5b45d664feb300b309566f3107.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3304-115-0x000000002EB70000-0x000000002EBE2000-memory.dmp
memory/3304-116-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/3304-117-0x0000000000B81000-0x0000000000B83000-memory.dmp
memory/3412-120-0x000001BC9F4E0000-0x000001BC9F4E1000-memory.dmp
memory/3412-119-0x000001BC9F4A0000-0x000001BC9F4C9000-memory.dmp
memory/3412-122-0x000001BC9F510000-0x000001BC9F512000-memory.dmp
memory/3412-121-0x000001BC9F510000-0x000001BC9F512000-memory.dmp