trickbot | b2e33d5bd280ea70f0ee4f8b9651f556f39d4f25061cae8e4189a5f09c7ace6c

Analysis

max time kernel
139s
max time network
147s
platform
windows10_x64
resource
win10
submitted
01-08-2020 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe
Size

468KB
MD5

b5396c9184694dbf1ee6e27ab075258c
SHA1

eaef391a2957ccb35a4a7adb656e803ff6b26df0
SHA256

b2e33d5bd280ea70f0ee4f8b9651f556f39d4f25061cae8e4189a5f09c7ace6c
SHA512

da8e3ce69f7702f079e80342828b80e4dd0e7de1ac09717d85fe5851c1f6ee72630d88dd1dbd6c3102ac8e64a37ff426d090475b8da62af3fa0e5b8fe84efdca

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe

description	pid	process	target process
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	wermgr.exe
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	wermgr.exe
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	wermgr.exe
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	wermgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3852 wermgr.exe
Token: SeDebugPrivilege 3852 wermgr.exe
Token: SeDebugPrivilege 3852 wermgr.exe
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe

pid process

3748 SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe
3748 SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe

description	pid	process
Token: SeDebugPrivilege	3852	wermgr.exe
Token: SeDebugPrivilege	3852	wermgr.exe
Token: SeDebugPrivilege	3852	wermgr.exe

pid	process
3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe
3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:3748

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3748-3-0x0000000002AF0000-0x0000000002B23000-memory.dmp

Filesize
204KB

Download
memory/3852-4-0x0000000000000000-mapping.dmp

Download