trickbot | 6dabb996f01a7a7bd89550eb458c5bceb36f95bfea587191821f0fa3f94d29c2

Analysis

max time kernel
125s
max time network
150s
platform
windows10_x64
resource
win10
submitted
22/07/2020, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe
Size 468KB
Sample200722-kwccm2xsrj
SHA256 6dabb996f01a7a7bd89550eb458c5bceb36f95bfea587191821f0fa3f94d29c2
MD5 06fc1903d5153514bb619212b03fff19
SHA1 f9e5fffd0d31a3a480787c03eb4f4a75f342062d
SHA512 9864a7af63543a97be8efaeadc96f9382a4f088390c2925d113f30b3f54543253c75ae84bc3dcb282cdc83576bd35e5a52689dec91ab5f679573b751ba61c5b8
MD5 SHA1 SHA512

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2976	SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe
2976	SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3220	2976	SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe	67
PID 2976 wrote to memory of 3220	2976	SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe	67
PID 2976 wrote to memory of 3220	2976	SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe	67
PID 2976 wrote to memory of 3220	2976	SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	wermgr.exe
Token: SeDebugPrivilege	3220	wermgr.exe
Token: SeDebugPrivilege	3220	wermgr.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ident.me
28	ident.me

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EOQZ.9266.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-3-0x0000000002230000-0x0000000002263000-memory.dmp

Download