Analysis

  • max time kernel
    134s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 17:44

General

  • Target

    8a242c61e128f44072070948f8fa855b.exe

  • Size

    568KB

  • MD5

    8a242c61e128f44072070948f8fa855b

  • SHA1

    e80fcf85f2f6db9ae798bb0ddcf4b1c26a0984ac

  • SHA256

    109e098ab6371e9d35e646a7b9750fd240de4d1561480e4ec6116f5e41632dfa

  • SHA512

    2d2b2fe712d815b6208f4b012e59f0db736f74535708721e1acecfce3fd336f8a80cab9745789bc79ac7007159adea22dbcf2a9dcf5806880d6da51ac70393cb

  • SSDEEP

    12288:1g1pjWbIFbFc0WkR/i9D/oj5vbaF/3uGzchJAQficGw:1aQIFbFpJIToj9baFvbghJAfhw

Malware Config

Extracted

Family

trickbot

Version

2000032

Botnet

tot130

C2

103.122.228.44:443

196.216.220.211:443

181.114.215.239:443

41.57.156.203:443

43.252.159.63:443

197.156.129.250:443

113.160.37.196:443

38.110.100.64:443

113.160.132.237:443

24.28.12.23:443

38.110.100.219:443

45.239.233.109:443

119.202.8.249:443

200.236.218.62:443

220.82.64.198:443

190.93.208.53:443

196.216.59.174:443

222.124.16.74:443

202.165.47.106:443

96.9.77.56:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a242c61e128f44072070948f8fa855b.exe
    "C:\Users\Admin\AppData\Local\Temp\8a242c61e128f44072070948f8fa855b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2392
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      2⤵
        PID:2200

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2392-9-0x00000000001A0000-0x00000000001A1000-memory.dmp

            Filesize

            4KB

          • memory/2392-10-0x0000000000060000-0x0000000000089000-memory.dmp

            Filesize

            164KB

          • memory/2392-13-0x0000000000060000-0x0000000000089000-memory.dmp

            Filesize

            164KB

          • memory/2516-0-0x00000000004E0000-0x000000000051E000-memory.dmp

            Filesize

            248KB

          • memory/2516-2-0x00000000004A0000-0x00000000004DC000-memory.dmp

            Filesize

            240KB

          • memory/2516-5-0x0000000000620000-0x000000000065A000-memory.dmp

            Filesize

            232KB

          • memory/2516-6-0x0000000000620000-0x000000000065A000-memory.dmp

            Filesize

            232KB

          • memory/2516-7-0x0000000000660000-0x0000000000661000-memory.dmp

            Filesize

            4KB

          • memory/2516-8-0x0000000010000000-0x0000000010003000-memory.dmp

            Filesize

            12KB

          • memory/2516-11-0x0000000000620000-0x000000000065A000-memory.dmp

            Filesize

            232KB