Analysis
-
max time kernel
129s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
14-12-2022 23:42
Static task
static1
Behavioral task
behavioral1
Sample
037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe
Resource
win7-20221111-en
General
-
Target
037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe
-
Size
832KB
-
MD5
a0ec1785193850bd26c9b81754fca844
-
SHA1
fdcdcc45192c1e5477d6d1a3694411e3b5d1682d
-
SHA256
037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b
-
SHA512
4e068be7399d0c480da32c1770aedc460874788b095cd24e8ff77e3910b49b1236ec6348c730ca0a7f75fe3c76c04d1e5fd9e29cf429e861446f25d98eb2f895
-
SSDEEP
6144:0fPzkZx9XfzZbtr08QgkF72BPNC33Fk0oYQzYUqhLKByhgvb4Hf2L:OPzkZfxtQ8Ql75HJp+Yh+v4/8
Malware Config
Extracted
trickbot
2000025
tot44
134.119.186.200:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443
-
autorunName:pwgrab
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1508 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exepid process 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exedescription pid process target process PID 2044 wrote to memory of 1996 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe cmd.exe PID 2044 wrote to memory of 1996 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe cmd.exe PID 2044 wrote to memory of 1996 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe cmd.exe PID 2044 wrote to memory of 1996 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe cmd.exe PID 2044 wrote to memory of 1508 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe wermgr.exe PID 2044 wrote to memory of 1508 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe wermgr.exe PID 2044 wrote to memory of 1508 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe wermgr.exe PID 2044 wrote to memory of 1508 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe wermgr.exe PID 2044 wrote to memory of 1508 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe wermgr.exe PID 2044 wrote to memory of 1508 2044 037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe"C:\Users\Admin\AppData\Local\Temp\037ee091feab21eece3f2a07ab70ebbd63c622552aeed929d3f49127e21e5c2b.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-59-0x0000000000000000-mapping.dmp
-
memory/1508-60-0x0000000000060000-0x0000000000088000-memory.dmpFilesize
160KB
-
memory/1508-61-0x0000000000060000-0x0000000000088000-memory.dmpFilesize
160KB
-
memory/2044-57-0x0000000001F31000-0x0000000001F6A000-memory.dmpFilesize
228KB
-
memory/2044-58-0x0000000001F31000-0x0000000001F6A000-memory.dmpFilesize
228KB