Analysis
-
max time kernel
173s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-07-2022 18:07
Static task
static1
Behavioral task
behavioral1
Sample
862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe
Resource
win7-20220414-en
General
-
Target
862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe
-
Size
424KB
-
MD5
bc67b9a2dae4bdaad9b1f1fcc2910606
-
SHA1
bcd589601dea9c11d77e032a8731ab358f042a12
-
SHA256
862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944
-
SHA512
99b2f95045260fd8edc4b142962d0e8ac95b69725e1f63944af12337f84f44e532f66d32b4260ca55e5ccdff1e942aef4642cc3215f8b0bfc63e0ba8495b5eb1
Malware Config
Extracted
trickbot
100009
lib5
149.54.11.54:449
36.89.191.119:449
41.159.31.227:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.44:449
194.5.249.143:443
142.202.191.175:443
195.123.241.31:443
45.89.125.214:443
45.83.151.103:443
91.200.103.41:443
66.70.246.0:443
64.74.160.218:443
198.46.198.115:443
5.34.180.173:443
23.227.196.5:443
195.123.241.115:443
107.152.42.163:443
-
autorunName:pwgrab
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exepid process 3672 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 4548 wermgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exedescription pid process target process PID 1448 wrote to memory of 3672 1448 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe PID 1448 wrote to memory of 3672 1448 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe PID 1448 wrote to memory of 3672 1448 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe PID 3672 wrote to memory of 4548 3672 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe wermgr.exe PID 3672 wrote to memory of 4548 3672 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe wermgr.exe PID 3672 wrote to memory of 4548 3672 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe wermgr.exe PID 3672 wrote to memory of 4548 3672 862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe"C:\Users\Admin\AppData\Local\Temp\862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DesktopColor\862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exeC:\Users\Admin\AppData\Roaming\DesktopColor\862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\DesktopColor\862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exeFilesize
424KB
MD5bc67b9a2dae4bdaad9b1f1fcc2910606
SHA1bcd589601dea9c11d77e032a8731ab358f042a12
SHA256862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944
SHA51299b2f95045260fd8edc4b142962d0e8ac95b69725e1f63944af12337f84f44e532f66d32b4260ca55e5ccdff1e942aef4642cc3215f8b0bfc63e0ba8495b5eb1
-
C:\Users\Admin\AppData\Roaming\DesktopColor\862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944.exeFilesize
424KB
MD5bc67b9a2dae4bdaad9b1f1fcc2910606
SHA1bcd589601dea9c11d77e032a8731ab358f042a12
SHA256862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944
SHA51299b2f95045260fd8edc4b142962d0e8ac95b69725e1f63944af12337f84f44e532f66d32b4260ca55e5ccdff1e942aef4642cc3215f8b0bfc63e0ba8495b5eb1
-
memory/1448-130-0x00000000005F0000-0x00000000005F5000-memory.dmpFilesize
20KB
-
memory/1448-131-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1448-135-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/3672-132-0x0000000000000000-mapping.dmp
-
memory/3672-136-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/3672-139-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/4548-137-0x0000000000000000-mapping.dmp
-
memory/4548-138-0x000001CE4BB20000-0x000001CE4BB47000-memory.dmpFilesize
156KB