trickbot | 043e9c0e34b2bc276a58e6a9891b654eb776693daccb845c1cb2256c3ae51a1a

Analysis

max time kernel
112s
max time network
154s
platform
windows10_x64
resource
win10
submitted
01-08-2020 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe
Size

468KB
MD5

d492e8185dfcea25ac1e6e44bc9be177
SHA1

4134a42e74f138f90b4e2e32244504e106cbb94d
SHA256

043e9c0e34b2bc276a58e6a9891b654eb776693daccb845c1cb2256c3ae51a1a
SHA512

1207d114ea5a4e95ebd0c1baf51438b8cb88f272ec0eab658865736849f382de2d2d1f18885defefa341fb0c5e99bda0784aca2f04285963bb8468fac79e6aba

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe

pid process

2728 SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe
2728 SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe

pid	process
2728	SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe
2728	SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe

description	pid	process	target process
PID 2728 wrote to memory of 3888	2728	SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe	wermgr.exe
PID 2728 wrote to memory of 3888	2728	SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe	wermgr.exe
PID 2728 wrote to memory of 3888	2728	SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe	wermgr.exe
PID 2728 wrote to memory of 3888	2728	SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe	wermgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3888 wermgr.exe
Token: SeDebugPrivilege 3888 wermgr.exe
Token: SeDebugPrivilege 3888 wermgr.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.ipify.org
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

description	pid	process
Token: SeDebugPrivilege	3888	wermgr.exe
Token: SeDebugPrivilege	3888	wermgr.exe
Token: SeDebugPrivilege	3888	wermgr.exe

flow	ioc
17	api.ipify.org

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.10532.13715.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-3-0x0000000002280000-0x00000000022B3000-memory.dmp

Filesize
204KB

Download
memory/3888-4-0x0000000000000000-mapping.dmp

Download