Overview

overview

10

Static

static

10

77bdb4717d...dd.exe

windows7_x64

10

77bdb4717d...dd.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    186s
  • max time network
    216s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01-07-2022 03:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    77bdb4717d88e1e591f9d472aeae0ee839269a6b468b474b06d16936c85210dd.exe

  • Size

    123KB

  • MD5

    9a79fea9eac7b0e7ac7b53b040113ae8

  • SHA1

    bb16b236e4b4796504050c37957f39017c28e6e9

  • SHA256

    77bdb4717d88e1e591f9d472aeae0ee839269a6b468b474b06d16936c85210dd

  • SHA512

    afff165d7eb3ce3126ded4ce429d61dc04b18a3d8757ef1665addff26756402204641447f005ac8fe77e76e06aa4418029157cf9212f48a530f92682280d5de3

Score
10/10
trickbotwecan14bankertrojan

Malware Config

Extracted

Family

trickbot

Version

1000496

Botnet

wecan14

C2

5.182.210.226:443

85.204.116.128:443

185.62.188.34:443

5.2.78.43:443

79.143.31.246:443

93.189.46.122:443

31.184.254.50:443

195.123.217.226:443

185.99.2.117:443

104.168.96.113:443

188.165.62.36:443

5.182.210.246:443

5.2.78.98:443

185.142.99.8:443

185.252.144.135:443

82.146.62.52:443

212.109.220.111:443

91.235.129.25:443

5.182.210.109:443

198.8.91.10:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Executes dropped EXE 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77bdb4717d88e1e591f9d472aeae0ee839269a6b468b474b06d16936c85210dd.exe
    "C:\Users\Admin\AppData\Local\Temp\77bdb4717d88e1e591f9d472aeae0ee839269a6b468b474b06d16936c85210dd.exe"
    1⤵
      PID:2140
    • C:\Users\Admin\AppData\Roaming\WinNetCore\77bdb2717d88c1c391d9d272acac0cc839249a4b248b272b04d14934c83210dd.exe
      C:\Users\Admin\AppData\Roaming\WinNetCore\77bdb2717d88c1c391d9d272acac0cc839249a4b248b272b04d14934c83210dd.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1896

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\WinNetCore\77bdb2717d88c1c391d9d272acac0cc839249a4b248b272b04d14934c83210dd.exe
      Filesize

      123KB

      MD5

      9a79fea9eac7b0e7ac7b53b040113ae8

      SHA1

      bb16b236e4b4796504050c37957f39017c28e6e9

      SHA256

      77bdb4717d88e1e591f9d472aeae0ee839269a6b468b474b06d16936c85210dd

      SHA512

      afff165d7eb3ce3126ded4ce429d61dc04b18a3d8757ef1665addff26756402204641447f005ac8fe77e76e06aa4418029157cf9212f48a530f92682280d5de3

      Download Submit
    • C:\Users\Admin\AppData\Roaming\WinNetCore\77bdb2717d88c1c391d9d272acac0cc839249a4b248b272b04d14934c83210dd.exe
      Filesize

      123KB

      MD5

      9a79fea9eac7b0e7ac7b53b040113ae8

      SHA1

      bb16b236e4b4796504050c37957f39017c28e6e9

      SHA256

      77bdb4717d88e1e591f9d472aeae0ee839269a6b468b474b06d16936c85210dd

      SHA512

      afff165d7eb3ce3126ded4ce429d61dc04b18a3d8757ef1665addff26756402204641447f005ac8fe77e76e06aa4418029157cf9212f48a530f92682280d5de3

      Download Submit