trickbot | a85bafaca5ae016fa9f16077b8de67edcc175176b2caec8ab30a648922b6fe8d

Analysis

max time kernel
111s
max time network
117s
platform
windows7_x64
resource
win7
submitted
22/07/2020, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe
Size 468KB
Sample200722-1kv6e4a87e
SHA256 a85bafaca5ae016fa9f16077b8de67edcc175176b2caec8ab30a648922b6fe8d
MD5 f9bc29a7b84a9554453b262c4dcfe38b
SHA1 c381f1f1c7951d60c0d41901eaae7f925a032a1b
SHA512 8aeb98fc7dcc14165e14e4ccf61e2132b82f4a4e0fe8fbb8e10058bfed537bb5734bb721f7456140bae7e3fc73583113bea425a2241c5fa010aad0e08672becf
MD5 SHA1 SHA512

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe
900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1436	900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe	24
PID 900 wrote to memory of 1436	900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe	24
PID 900 wrote to memory of 1436	900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe	24
PID 900 wrote to memory of 1436	900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe	24
PID 900 wrote to memory of 1436	900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe	24
PID 900 wrote to memory of 1436	900	SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe	24

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	wermgr.exe
Token: SeDebugPrivilege	1436	wermgr.exe
Token: SeDebugPrivilege	1436	wermgr.exe

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EOQZ.2097.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-3-0x0000000000480000-0x00000000004B3000-memory.dmp

Download