trickbot | 55109a2a108c6539ef4528f9b5fe35ccfae40f86c9595f9b47e923e532d7331f

Analysis

max time kernel
109s
max time network
73s
platform
windows7_x64
resource
win7
submitted
11-07-2020 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

992ecaa198bd84f1493c66aad56e5233.exe
Size

212KB
MD5

992ecaa198bd84f1493c66aad56e5233
SHA1

bfb6e6acd379099fa80f31fb158a816ca93d5f49
SHA256

55109a2a108c6539ef4528f9b5fe35ccfae40f86c9595f9b47e923e532d7331f
SHA512

0561ea07f49bcb9c3a18938bb52a1bd3c430206fa95c7b9427b896c8020207fe7937be224adc636b7f37aabadc17b406def6061867fef0dc69c72285b1d49750

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono55

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

992ecaa198bd84f1493c66aad56e5233.exe

description	pid	process	target process
PID 1032 wrote to memory of 316	1032	992ecaa198bd84f1493c66aad56e5233.exe	wermgr.exe
PID 1032 wrote to memory of 316	1032	992ecaa198bd84f1493c66aad56e5233.exe	wermgr.exe
PID 1032 wrote to memory of 316	1032	992ecaa198bd84f1493c66aad56e5233.exe	wermgr.exe
PID 1032 wrote to memory of 316	1032	992ecaa198bd84f1493c66aad56e5233.exe	wermgr.exe
PID 1032 wrote to memory of 316	1032	992ecaa198bd84f1493c66aad56e5233.exe	wermgr.exe
PID 1032 wrote to memory of 316	1032	992ecaa198bd84f1493c66aad56e5233.exe	wermgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 316 wermgr.exe
Token: SeDebugPrivilege 316 wermgr.exe
Token: SeDebugPrivilege 316 wermgr.exe
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

description	pid	process
Token: SeDebugPrivilege	316	wermgr.exe
Token: SeDebugPrivilege	316	wermgr.exe
Token: SeDebugPrivilege	316	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\992ecaa198bd84f1493c66aad56e5233.exe
"C:\Users\Admin\AppData\Local\Temp\992ecaa198bd84f1493c66aad56e5233.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-1-0x0000000000000000-mapping.dmp

Download
memory/1032-0-0x0000000000750000-0x0000000000783000-memory.dmp

Filesize
204KB

Download