trickbot | e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164

General

Target

e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe
Size

360KB
MD5

9dcdd675ec76dc88c5feb1e2382aeca8
SHA1

62a67c6ce8d1803b4f365cf31aed5e2a9ce32eac
SHA256

e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164
SHA512

90ef45905f05f45194f875fd0d7a4b38d9abe9168efb81595f9f5a8a1fc10d52160904a3b40c28a2c8c31c94cdb9fe0621c3378e6b9361ea88534eea0736ac13

Score

10^/10

trickbot jim666 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000497

Botnet

jim666

C2

5.182.210.226:443

5.182.210.246:443

82.146.62.52:443

198.8.91.10:443

195.123.221.53:443

51.89.115.116:443

164.68.120.56:443

85.204.116.237:443

5.2.75.167:443

93.189.42.146:443

185.252.144.174:443

81.177.165.145:443

217.107.34.151:443

146.185.219.165:443

194.87.238.87:443

146.185.253.18:443

194.5.250.155:443

195.123.216.223:443

185.99.2.160:443

5.182.210.230:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1844-3-0x0000000000260000-0x0000000000290000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe

pid process

2012 c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 2044 svchost.exe

pid	process
2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe

description	pid	process
Token: SeTcbPrivilege	2044	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exec1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe

pid	process
1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe
1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe
2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exetaskeng.exec1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe

description	pid	process	target process
PID 1844 wrote to memory of 1868	1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe	svchost.exe
PID 1844 wrote to memory of 1868	1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe	svchost.exe
PID 1844 wrote to memory of 1868	1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe	svchost.exe
PID 1844 wrote to memory of 1868	1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe	svchost.exe
PID 1844 wrote to memory of 1868	1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe	svchost.exe
PID 1844 wrote to memory of 1868	1844	e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe	svchost.exe
PID 1980 wrote to memory of 2012	1980	taskeng.exe	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
PID 1980 wrote to memory of 2012	1980	taskeng.exe	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
PID 1980 wrote to memory of 2012	1980	taskeng.exe	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
PID 1980 wrote to memory of 2012	1980	taskeng.exe	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
PID 2012 wrote to memory of 2044	2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe	svchost.exe
PID 2012 wrote to memory of 2044	2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe	svchost.exe
PID 2012 wrote to memory of 2044	2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe	svchost.exe
PID 2012 wrote to memory of 2044	2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe	svchost.exe
PID 2012 wrote to memory of 2044	2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe	svchost.exe
PID 2012 wrote to memory of 2044	2012	c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe
"C:\Users\Admin\AppData\Local\Temp\e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1868

C:\Windows\system32\taskeng.exe
taskeng.exe {A2542D6F-B88C-4AEF-AD1A-83B81EE03BC6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Users\Admin\AppData\Roaming\windirect\c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
C:\Users\Admin\AppData\Roaming\windirect\c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\windirect\c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
MD5
9dcdd675ec76dc88c5feb1e2382aeca8

SHA1
62a67c6ce8d1803b4f365cf31aed5e2a9ce32eac

SHA256
e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164

SHA512
90ef45905f05f45194f875fd0d7a4b38d9abe9168efb81595f9f5a8a1fc10d52160904a3b40c28a2c8c31c94cdb9fe0621c3378e6b9361ea88534eea0736ac13

Download Submit
C:\Users\Admin\AppData\Roaming\windirect\c1cddd088a87c11d192022c81892c07ca93b14a9d29c223d2dbb3c1c02b10142.exe
MD5
9dcdd675ec76dc88c5feb1e2382aeca8

SHA1
62a67c6ce8d1803b4f365cf31aed5e2a9ce32eac

SHA256
e1efdf088a87e11d194042c81892e07ca93b16a9f49c423f2dbb5e1e04b10164

SHA512
90ef45905f05f45194f875fd0d7a4b38d9abe9168efb81595f9f5a8a1fc10d52160904a3b40c28a2c8c31c94cdb9fe0621c3378e6b9361ea88534eea0736ac13

Download Submit
memory/1844-3-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads