trickbot | 35f3a3ce8bc8fb131fe4d9b57dd3dd5d8dbc28b6204b984e36378cd1d8ef0aee

Analysis

max time kernel
126s
max time network
124s
platform
windows10_x64
resource
win10
submitted
01-08-2020 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe
Size

468KB
MD5

547ff36d8ca830b84ce8d549a0f20836
SHA1

2502166154751ab6e9b57928526394e196564082
SHA256

35f3a3ce8bc8fb131fe4d9b57dd3dd5d8dbc28b6204b984e36378cd1d8ef0aee
SHA512

1159f61c456066b84a5a44af23d5caefb4f4940fbcaf25611a8d8de44fa6883d2df79b275caa80ee1d6c202bce6a291164864e0bb6fbe829086b1d0bc599a69e

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe

pid process

3588 SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe
3588 SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe

pid	process
3588	SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe
3588	SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe

description	pid	process	target process
PID 3588 wrote to memory of 3932	3588	SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe	wermgr.exe
PID 3588 wrote to memory of 3932	3588	SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe	wermgr.exe
PID 3588 wrote to memory of 3932	3588	SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe	wermgr.exe
PID 3588 wrote to memory of 3932	3588	SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe	wermgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3932 wermgr.exe
Token: SeDebugPrivilege 3932 wermgr.exe
Token: SeDebugPrivilege 3932 wermgr.exe
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

description	pid	process
Token: SeDebugPrivilege	3932	wermgr.exe
Token: SeDebugPrivilege	3932	wermgr.exe
Token: SeDebugPrivilege	3932	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.18720.24379.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3588-3-0x0000000002BF0000-0x0000000002C23000-memory.dmp

Filesize
204KB

Download
memory/3932-4-0x0000000000000000-mapping.dmp

Download