Analysis
-
max time kernel
142s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:02
Static task
static1
Behavioral task
behavioral1
Sample
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe
Resource
win7-20220901-en
General
-
Target
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe
-
Size
844KB
-
MD5
a42b2b4efd836bab09bfd291abd1dbad
-
SHA1
0e168f22d07e656c7c9192ff62f1348d6e75ee0f
-
SHA256
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803
-
SHA512
db8e40c7cd84d5f9d05ee31a08f2fed784c430e13d8ec75c26b096b73a63a5c40d977cbf3352541b67af5a9c0fd1a287ae15a8de939d5416f71fbc1f9eb47137
-
SSDEEP
6144:mW4GCPhnfAhpKMRB6zST4ynXHuVsSOBsGh/HDW:mW4VPhIK5mDwp6HDW
Malware Config
Extracted
trickbot
2000025
lib43
134.119.186.200:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443
-
autorunName:pwgrab
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1068 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exepid process 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exedescription pid process target process PID 1324 wrote to memory of 1056 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe cmd.exe PID 1324 wrote to memory of 1056 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe cmd.exe PID 1324 wrote to memory of 1056 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe cmd.exe PID 1324 wrote to memory of 1056 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe cmd.exe PID 1324 wrote to memory of 1068 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 1324 wrote to memory of 1068 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 1324 wrote to memory of 1068 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 1324 wrote to memory of 1068 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 1324 wrote to memory of 1068 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 1324 wrote to memory of 1068 1324 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe"C:\Users\Admin\AppData\Local\Temp\f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1068-59-0x0000000000000000-mapping.dmp
-
memory/1068-60-0x0000000000060000-0x0000000000088000-memory.dmpFilesize
160KB
-
memory/1068-61-0x0000000000060000-0x0000000000088000-memory.dmpFilesize
160KB
-
memory/1324-57-0x0000000002621000-0x000000000265A000-memory.dmpFilesize
228KB
-
memory/1324-58-0x0000000002621000-0x000000000265A000-memory.dmpFilesize
228KB