trickbot | cc42a51ff65b9787f17a6d442b1688057449ea20f3630d58a9a3af68eed71105

Analysis

max time kernel
58s
max time network
9s
platform
windows7_x64
resource
win7
submitted
10/07/2020, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

imgpaper.png.exe
Size

436KB
MD5

6c7f05c5f3af20a3b8f5cb115450538a
SHA1

f94e9c8ac6021ba385cea6bd6b948091adcbed8d
SHA256

cc42a51ff65b9787f17a6d442b1688057449ea20f3630d58a9a3af68eed71105
SHA512

bb91b4a702429765715cf4bad384146c1b439ef04bb79f87f4f72a176b491452feead15b7ff52dc19f6c5c990a9d9a9c8995284a8ecb09e31ea462b478ff673a

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

lib765

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	imgpaper.png.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1584	1456	imgpaper.png.exe	24
PID 1456 wrote to memory of 1584	1456	imgpaper.png.exe	24
PID 1456 wrote to memory of 1584	1456	imgpaper.png.exe	24
PID 1456 wrote to memory of 1584	1456	imgpaper.png.exe	24
PID 1456 wrote to memory of 1584	1456	imgpaper.png.exe	24
PID 1456 wrote to memory of 1584	1456	imgpaper.png.exe	24

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	wermgr.exe
Token: SeDebugPrivilege	1584	wermgr.exe
Token: SeDebugPrivilege	1584	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\imgpaper.png.exe
"C:\Users\Admin\AppData\Local\Temp\imgpaper.png.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-2-0x00000000023E0000-0x000000000240E000-memory.dmp

Filesize
184KB

Download
memory/1456-4-0x0000000000330000-0x0000000000334000-memory.dmp

Filesize
16KB

Download
memory/1456-5-0x0000000002750000-0x0000000002754000-memory.dmp

Filesize
16KB

Download