trickbot | 9c0b5ca568c92be14d40e85bbfca697240bf4c8d84b105f429236091bf191259

Analysis

max time kernel
102s
max time network
144s
platform
windows10_x64
resource
win10
submitted
22/07/2020, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe
Size 468KB
Sample200722-rp9egelmys
SHA256 9c0b5ca568c92be14d40e85bbfca697240bf4c8d84b105f429236091bf191259
MD5 813913a3ca4680abe6b69d79090407f8
SHA1 c862047c25bb1c41040804bc529a67aa7da9c3bf
SHA512 f89d6e8ac312486e4045366e8c306200130f576877a44ebcde99ecd02727d1f799ae6d6bfb4eea2c6c1a15a813de0a207adbd2417880b94f4dfd43dcff0a912d
MD5 SHA1 SHA512

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1536	SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe
1536	SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3904	1536	SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe	67
PID 1536 wrote to memory of 3904	1536	SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe	67
PID 1536 wrote to memory of 3904	1536	SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe	67
PID 1536 wrote to memory of 3904	1536	SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	wermgr.exe
Token: SeDebugPrivilege	3904	wermgr.exe
Token: SeDebugPrivilege	3904	wermgr.exe

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EOQZ.19039.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-3-0x0000000002250000-0x0000000002283000-memory.dmp

Download