trickbot | 3e83d332282565cd093b2aefdcc22d74c3df62675665c249f13d85e7a91b081b

Analysis

max time kernel
132s
max time network
70s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
207EYJSFYHMS.exe
Size 748KB
Sample201109-thkmypcwmn
SHA256 3e83d332282565cd093b2aefdcc22d74c3df62675665c249f13d85e7a91b081b
MD5 2b2852d3de190de46398f349475be8ba
SHA1 a4dc672b2d45dd316cfdf2585d277efcb242f1fe
SHA512 0ca2ae2693fbdcd2a7860f4dcaf694f1125833d38cea93962db4aab2752168bfea9184ee09847d194cf666e62ff2981257ca7e113204634e79415f75f49c70ce
MD5 SHA1 SHA512

Score

10^/10

trickbot ono41 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000510

Botnet

ono41

5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	wermgr.exe
Token: SeDebugPrivilege	1448	wermgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
884	207EYJSFYHMS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1448	884	207EYJSFYHMS.exe	79
PID 884 wrote to memory of 1448	884	207EYJSFYHMS.exe	79
PID 884 wrote to memory of 1448	884	207EYJSFYHMS.exe	79
PID 884 wrote to memory of 1448	884	207EYJSFYHMS.exe	79

C:\Users\Admin\AppData\Local\Temp\207EYJSFYHMS.exe
"C:\Users\Admin\AppData\Local\Temp\207EYJSFYHMS.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-2-0x0000000002220000-0x000000000224B000-memory.dmp

Download