Analysis
-
max time kernel
176s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 17:02
Static task
static1
Behavioral task
behavioral1
Sample
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe
Resource
win7-20220901-en
General
-
Target
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe
-
Size
844KB
-
MD5
a42b2b4efd836bab09bfd291abd1dbad
-
SHA1
0e168f22d07e656c7c9192ff62f1348d6e75ee0f
-
SHA256
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803
-
SHA512
db8e40c7cd84d5f9d05ee31a08f2fed784c430e13d8ec75c26b096b73a63a5c40d977cbf3352541b67af5a9c0fd1a287ae15a8de939d5416f71fbc1f9eb47137
-
SSDEEP
6144:mW4GCPhnfAhpKMRB6zST4ynXHuVsSOBsGh/HDW:mW4VPhIK5mDwp6HDW
Malware Config
Extracted
trickbot
2000025
lib43
134.119.186.200:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443
-
autorunName:pwgrab
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1840 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exepid process 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exedescription pid process target process PID 4380 wrote to memory of 3492 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe cmd.exe PID 4380 wrote to memory of 3492 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe cmd.exe PID 4380 wrote to memory of 1840 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 4380 wrote to memory of 1840 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 4380 wrote to memory of 1840 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe PID 4380 wrote to memory of 1840 4380 f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe"C:\Users\Admin\AppData\Local\Temp\f0391039f888fb30566295365420868ac8539075e25a690ac4400a8bb91eb803.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1840-136-0x0000000000000000-mapping.dmp
-
memory/1840-137-0x000001B983FF0000-0x000001B984018000-memory.dmpFilesize
160KB
-
memory/4380-135-0x00000000031F1000-0x000000000322A000-memory.dmpFilesize
228KB
-
memory/4380-138-0x00000000031F1000-0x000000000322A000-memory.dmpFilesize
228KB