trickbot | efbac612599c4da912d5bfec21795188453ece0210b8c0c124ca9348b4cb4c53

Analysis

max time kernel
136s
max time network
77s
platform
windows7_x64
resource
win7v200722
submitted
01-08-2020 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe
Size

468KB
MD5

4908419910ca230780d1dd92c1195e45
SHA1

16fa4a120dd323d9173b9e3876970037ef7876bc
SHA256

efbac612599c4da912d5bfec21795188453ece0210b8c0c124ca9348b4cb4c53
SHA512

e98d3d16f17224556a6eb01dcbeea8179ce7c2a1cb041a9b7f389f06cf1ec9d38142848c20454b6d7d459c8efd1c7cedfc46f9309304ac7afb5a9bd75343b429

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1904 wermgr.exe
Token: SeDebugPrivilege 1904 wermgr.exe
Token: SeDebugPrivilege 1904 wermgr.exe
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe

pid process

748 SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe
748 SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe

description	pid	process
Token: SeDebugPrivilege	1904	wermgr.exe
Token: SeDebugPrivilege	1904	wermgr.exe
Token: SeDebugPrivilege	1904	wermgr.exe

pid	process
748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe
748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe

description	pid	process	target process
PID 748 wrote to memory of 1904	748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe	wermgr.exe
PID 748 wrote to memory of 1904	748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe	wermgr.exe
PID 748 wrote to memory of 1904	748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe	wermgr.exe
PID 748 wrote to memory of 1904	748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe	wermgr.exe
PID 748 wrote to memory of 1904	748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe	wermgr.exe
PID 748 wrote to memory of 1904	748	SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.28724.4882.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-3-0x0000000000610000-0x0000000000643000-memory.dmp

Filesize
204KB

Download
memory/1904-4-0x0000000000000000-mapping.dmp

Download