trickbot | 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929

Resubmissions

10/11/2020, 01:13

201110-43542766za10

09/11/2020, 21:24

201109-1h2689rg6n10

09/11/2020, 21:17

201109-txtk4hb58210

Analysis

max time kernel
331s
max time network
405s
platform
windows10_x64
resource
win10v20201028
submitted
10/11/2020, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
Size 660KB
Sample201110-43542766za
SHA256 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
MD5 3ba7d3dbc17ce640e0bb3dd5f989169b
SHA1 84ee0b6e02339f1deb33d75693551db444923ba8
SHA512 3a683b35dc6b6c17de5a21171625c3fb5259d60c73867aa81b89cedeef61f1b95cce099cc5bb4fdeb2ddf7f2f0236c6d877970768a7f91330ecfbbc38931a231
MD5 SHA1 SHA512

Score

10^/10

trickbot tar2 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100001

Botnet

tar2

66.85.183.5:443
185.163.47.157:443
94.140.115.99:443
195.123.240.40:443
195.123.241.226:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	wtfismyip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4704	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
4704	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4020	4704	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79
PID 4704 wrote to memory of 4020	4704	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79
PID 4704 wrote to memory of 4020	4704	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79
PID 4704 wrote to memory of 4020	4704	52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe	79

C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
"C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-0-0x00000000022F0000-0x000000000232E000-memory.dmp

Download

memory/4704-1-0x0000000002410000-0x000000000244A000-memory.dmp