trickbot | b2e33d5bd280ea70f0ee4f8b9651f556f39d4f25061cae8e4189a5f09c7ace6c

Analysis

max time kernel
139s
max time network
147s
platform
windows10_x64
resource
win10
submitted
01/08/2020, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe
Size 468KB
Sample200801-y6xb5adhla
SHA256 b2e33d5bd280ea70f0ee4f8b9651f556f39d4f25061cae8e4189a5f09c7ace6c
MD5 b5396c9184694dbf1ee6e27ab075258c
SHA1 eaef391a2957ccb35a4a7adb656e803ff6b26df0
SHA512 da8e3ce69f7702f079e80342828b80e4dd0e7de1ac09717d85fe5851c1f6ee72630d88dd1dbd6c3102ac8e64a37ff426d090475b8da62af3fa0e5b8fe84efdca
MD5 SHA1 SHA512

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	67
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	67
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	67
PID 3748 wrote to memory of 3852	3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	wermgr.exe
Token: SeDebugPrivilege	3852	wermgr.exe
Token: SeDebugPrivilege	3852	wermgr.exe

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe
3748	SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.1973.4003.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:3748
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3748-3-0x0000000002AF0000-0x0000000002B23000-memory.dmp

Download