trickbot | 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929

Target

52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
Size

660KB
MD5

3ba7d3dbc17ce640e0bb3dd5f989169b
SHA1

84ee0b6e02339f1deb33d75693551db444923ba8
SHA256

52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
SHA512

3a683b35dc6b6c17de5a21171625c3fb5259d60c73867aa81b89cedeef61f1b95cce099cc5bb4fdeb2ddf7f2f0236c6d877970768a7f91330ecfbbc38931a231

Score

10^/10

Malware Config

Family

trickbot

Version

100001

Botnet

tar2

66.85.183.5:443

185.163.47.157:443

94.140.115.99:443

195.123.240.40:443

195.123.241.226:443

Attributes

ecc_pubkey.base64

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
19	wtfismyip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description	pid	Process
Token: SeDebugPrivilege	2660	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe

pid	Process
980	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
980	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe

description	pid	Process	procid_target
PID 980 wrote to memory of 2660	980	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79
PID 980 wrote to memory of 2660	980	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79
PID 980 wrote to memory of 2660	980	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79
PID 980 wrote to memory of 2660	980	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79

C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
"C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2660

memory/980-0-0x0000000003AD0000-0x0000000003B0E000-memory.dmp

Filesize
248KB

Download
memory/980-1-0x0000000003B10000-0x0000000003B4A000-memory.dmp

Filesize
232KB

Download
memory/2660-2-0x0000000000000000-mapping.dmp

Download