trickbot | 0ec642f7ebd459139437766cafe03e9c08f9ab0e0b5068690189dc4ed3fcdd09

Analysis

max time kernel
141s
max time network
116s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
75EYJSFYHMS.exe
Size 748KB
Sample201109-73lce67ldj
SHA256 0ec642f7ebd459139437766cafe03e9c08f9ab0e0b5068690189dc4ed3fcdd09
MD5 cf099b881312ffdc4cee48924d9376a4
SHA1 a06e6161d7adb57f77674beba2f67fd8fbcaa6fd
SHA512 3f74253dc4cbfb6114c549964fc4700478b24b68814461f829abcac7f36e71663f8728daa7ecdff25c264758c0297f0184e0b393a425b8356f0368524adc88b7
MD5 SHA1 SHA512

Score

10^/10

trickbot ono41 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000510

Botnet

ono41

5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	200	wermgr.exe
Token: SeDebugPrivilege	200	wermgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3928	75EYJSFYHMS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 200	3928	75EYJSFYHMS.exe	78
PID 3928 wrote to memory of 200	3928	75EYJSFYHMS.exe	78
PID 3928 wrote to memory of 200	3928	75EYJSFYHMS.exe	78
PID 3928 wrote to memory of 200	3928	75EYJSFYHMS.exe	78

C:\Users\Admin\AppData\Local\Temp\75EYJSFYHMS.exe
"C:\Users\Admin\AppData\Local\Temp\75EYJSFYHMS.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3928-2-0x00000000020D0000-0x00000000020FB000-memory.dmp

Download