trickbot | bfa088b1ea61efa003343b09a536eaffa12bc90fb612f8ebcb8182785bb6eb16

Analysis

Target

Froggies.exe
Size

404KB
MD5

c99e8ea05346c198782e4c66f01d7c10
SHA1

2ec006693189d6d9f9e1d1d0a244ea7086c83641
SHA256

bfa088b1ea61efa003343b09a536eaffa12bc90fb612f8ebcb8182785bb6eb16
SHA512

7c4137c51c5ae5bf45c43d5c0685075d96e674115534735df1407e2326d9f07ff5992f28d5c09b10497b90ff9fc6fe5ec624495ee077455067f23934c6f998d3

Score

10^/10

Family

trickbot

Version

100002

Botnet

fra1

195.123.240.138:443

162.212.158.129:443

144.172.64.26:443

62.108.37.145:443

91.200.103.193:443

194.5.249.195:443

195.123.240.18:443

Attributes

ecc_pubkey.base64

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 912 wermgr.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Froggies.exe

pid process

1808 Froggies.exe

description	pid	process
Token: SeDebugPrivilege	912	wermgr.exe

pid	process
1808	Froggies.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Froggies.exe

description	pid	process	target process
PID 1808 wrote to memory of 1092	1808	Froggies.exe	splwow64.exe
PID 1808 wrote to memory of 1092	1808	Froggies.exe	splwow64.exe
PID 1808 wrote to memory of 1092	1808	Froggies.exe	splwow64.exe
PID 1808 wrote to memory of 1092	1808	Froggies.exe	splwow64.exe
PID 1808 wrote to memory of 912	1808	Froggies.exe	wermgr.exe
PID 1808 wrote to memory of 912	1808	Froggies.exe	wermgr.exe
PID 1808 wrote to memory of 912	1808	Froggies.exe	wermgr.exe
PID 1808 wrote to memory of 912	1808	Froggies.exe	wermgr.exe
PID 1808 wrote to memory of 912	1808	Froggies.exe	wermgr.exe
PID 1808 wrote to memory of 912	1808	Froggies.exe	wermgr.exe

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:912

memory/912-4-0x0000000000000000-mapping.dmp

Download
memory/1092-2-0x0000000000000000-mapping.dmp

Download
memory/1808-3-0x0000000002360000-0x000000000239A000-memory.dmp

Filesize
232KB

Download
memory/1808-5-0x00000000024C0000-0x00000000024C4000-memory.dmp

Filesize
16KB

Download
memory/1808-6-0x00000000025E0000-0x00000000025E4000-memory.dmp

Filesize
16KB

Download