trickbot | a5b20da527e28cd168c21fbdcc0c77dfdec9aa30cbd566a451ce73e68a86f667

General

Target

sample.exe
Size

375KB
MD5

309c240336952e3a6afe08f91581aa76
SHA1

7cc257d1dc641c5fc312c7694a1a7be7ce31cb46
SHA256

621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391
SHA512

a7e68157c9d9e6a317fa5a898cf1b96bd884132e4634fecd495af74d5e40b72f54a85446730a0a0ac8379039146f1840229e420c5b7dd64b1eca8be0b09fb104

Score

10^/10

evasion trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000098

Botnet

mac1

C2

79.106.41.9:449

94.250.252.146:443

62.109.18.206:443

62.109.26.193:443

78.24.223.50:443

94.250.252.162:443

92.53.78.209:443

92.53.66.115:443

62.109.16.70:443

62.109.23.229:443

62.109.17.100:443

82.146.47.221:443

195.133.144.43:443

194.87.92.217:443

95.213.194.234:443

195.133.147.44:443

194.87.238.149:443

78.155.206.154:443

185.80.130.195:443

94.250.252.168:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 3 IoCs

Processes:

sanpmf.exesanpmf.exesanpmf.exe

pid process

1436 sanpmf.exe
1828 sanpmf.exe
1744 sanpmf.exe
Loads dropped DLL 1 IoCs

Processes:

sample.exe

pid process

1420 sample.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip.anysrc.net
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTakeOwnershipPrivilege 288 svchost.exe

pid	process
1436	sanpmf.exe
1828	sanpmf.exe
1744	sanpmf.exe

pid	process
1420	sample.exe

flow	ioc
3	ip.anysrc.net

description	pid	process
Token: SeTakeOwnershipPrivilege	288	svchost.exe

Suspicious use of WriteProcessMemory 1431 IoCs

Processes:

sample.exesanpmf.exe

description	pid	process	target process
PID 1420 wrote to memory of 1436	1420	sample.exe	sanpmf.exe
PID 1420 wrote to memory of 1436	1420	sample.exe	sanpmf.exe
PID 1420 wrote to memory of 1436	1420	sample.exe	sanpmf.exe
PID 1420 wrote to memory of 1436	1420	sample.exe	sanpmf.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe
PID 1436 wrote to memory of 288	1436	sanpmf.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420

C:\Users\Admin\AppData\Roaming\services\sanpmf.exe
C:\Users\Admin\AppData\Roaming\services\sanpmf.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\system32\svchost.exe
svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:288

C:\Windows\system32\taskeng.exe
taskeng.exe {065F6C61-4F13-4D3F-9C14-9BF439BD90B2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1384

C:\Users\Admin\AppData\Roaming\services\sanpmf.exe
C:\Users\Admin\AppData\Roaming\services\sanpmf.exe
2⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\svchost.exe
svchost.exe
3⤵
PID:1640

C:\Users\Admin\AppData\Roaming\services\sanpmf.exe
C:\Users\Admin\AppData\Roaming\services\sanpmf.exe
2⤵
- Executes dropped EXE
PID:1744

C:\Windows\system32\svchost.exe
svchost.exe
3⤵
PID:1556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\services\client_id

Download Submit
C:\Users\Admin\AppData\Roaming\services\sanpmf.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\sanpmf.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\sanpmf.exe

Download Submit
\Users\Admin\AppData\Roaming\services\sanpmf.exe

Download Submit
memory/288-5-0x0000000000000000-mapping.dmp

Download
memory/288-6-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1420-0-0x0000000000601000-0x0000000000602000-memory.dmp

Filesize
4KB

Download
memory/1436-2-0x0000000000000000-mapping.dmp

Download
memory/1556-15-0x0000000000000000-mapping.dmp

Download
memory/1640-10-0x0000000000000000-mapping.dmp

Download
memory/1744-12-0x0000000000000000-mapping.dmp

Download
memory/1744-14-0x0000000000751000-0x0000000000752000-memory.dmp

Filesize
4KB

Download
memory/1828-9-0x0000000000711000-0x0000000000712000-memory.dmp

Filesize
4KB

Download
memory/1828-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing