Analysis

  • max time kernel
    135s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 17:44

General

  • Target

    8a242c61e128f44072070948f8fa855b.exe

  • Size

    568KB

  • MD5

    8a242c61e128f44072070948f8fa855b

  • SHA1

    e80fcf85f2f6db9ae798bb0ddcf4b1c26a0984ac

  • SHA256

    109e098ab6371e9d35e646a7b9750fd240de4d1561480e4ec6116f5e41632dfa

  • SHA512

    2d2b2fe712d815b6208f4b012e59f0db736f74535708721e1acecfce3fd336f8a80cab9745789bc79ac7007159adea22dbcf2a9dcf5806880d6da51ac70393cb

  • SSDEEP

    12288:1g1pjWbIFbFc0WkR/i9D/oj5vbaF/3uGzchJAQficGw:1aQIFbFpJIToj9baFvbghJAfhw

Malware Config

Extracted

Family

trickbot

Version

2000032

Botnet

tot130

C2

103.122.228.44:443

196.216.220.211:443

181.114.215.239:443

41.57.156.203:443

43.252.159.63:443

197.156.129.250:443

113.160.37.196:443

38.110.100.64:443

113.160.132.237:443

24.28.12.23:443

38.110.100.219:443

45.239.233.109:443

119.202.8.249:443

200.236.218.62:443

220.82.64.198:443

190.93.208.53:443

196.216.59.174:443

222.124.16.74:443

202.165.47.106:443

96.9.77.56:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a242c61e128f44072070948f8fa855b.exe
    "C:\Users\Admin\AppData\Local\Temp\8a242c61e128f44072070948f8fa855b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4188
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      2⤵
        PID:4684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 812
        2⤵
        • Program crash
        PID:520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 3020 -ip 3020
      1⤵
        PID:4692

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/3020-0-0x00000000024A0000-0x00000000024DE000-memory.dmp

              Filesize

              248KB

            • memory/3020-5-0x00000000024E0000-0x000000000251A000-memory.dmp

              Filesize

              232KB

            • memory/3020-4-0x0000000002460000-0x000000000249C000-memory.dmp

              Filesize

              240KB

            • memory/3020-6-0x00000000024E0000-0x000000000251A000-memory.dmp

              Filesize

              232KB

            • memory/3020-7-0x0000000002530000-0x0000000002531000-memory.dmp

              Filesize

              4KB

            • memory/3020-8-0x0000000010000000-0x0000000010003000-memory.dmp

              Filesize

              12KB

            • memory/3020-11-0x0000000002440000-0x0000000002453000-memory.dmp

              Filesize

              76KB

            • memory/3020-12-0x00000000024E0000-0x000000000251A000-memory.dmp

              Filesize

              232KB

            • memory/4188-9-0x000001DB117F0000-0x000001DB117F1000-memory.dmp

              Filesize

              4KB

            • memory/4188-10-0x000001DB11650000-0x000001DB11679000-memory.dmp

              Filesize

              164KB

            • memory/4188-14-0x000001DB11650000-0x000001DB11679000-memory.dmp

              Filesize

              164KB