Overview

overview

10

Static

static

34aba4b668...33.exe

windows7_x64

10

34aba4b668...33.exe

windows10_x64

10

Analysis

  • max time kernel
    115s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-11-2020 23:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433.exe

  • Size

    534KB

  • MD5

    9d817d2b622720bf60d24cbe2e15c5f1

  • SHA1

    6755bd9796f0d9e188b72600f8b5a88138829982

  • SHA256

    34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433

  • SHA512

    c2617c1c1a2006c809c117eb88341e700b5cb604baf6a831344aab456fa7c7b025e29a684e6e30e006e5c6bb3c5534cdd654bf2b592f3aacc3e7c94f071bde90

Score
10/10
trickbotono23bankertrojan

Malware Config

Extracted

Family

trickbot

Version

1000480

Botnet

ono23

C2

144.91.79.9:443

172.245.97.148:443

85.204.116.139:443

185.62.188.117:443

185.222.202.76:443

144.91.79.12:443

185.68.93.43:443

195.123.238.191:443

146.185.219.29:443

195.133.196.151:443

91.235.129.60:443

23.227.206.170:443

185.222.202.192:443

190.154.203.218:449

178.183.150.169:449

200.116.199.10:449

187.58.56.26:449

177.103.240.149:449

81.190.160.139:449

200.21.51.38:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433.exe
    "C:\Users\Admin\AppData\Local\Temp\34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\ProgramData\аНаоすは래별.exe
      "C:\ProgramData\аНаоすは래별.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:940
    • C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
      C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3136
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:752

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\аНаоすは래별.exe
      MD5

      9d817d2b622720bf60d24cbe2e15c5f1

      SHA1

      6755bd9796f0d9e188b72600f8b5a88138829982

      SHA256

      34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433

      SHA512

      c2617c1c1a2006c809c117eb88341e700b5cb604baf6a831344aab456fa7c7b025e29a684e6e30e006e5c6bb3c5534cdd654bf2b592f3aacc3e7c94f071bde90

      Download Submit
    • C:\ProgramData\аНаоすは래별.exe
      MD5

      9d817d2b622720bf60d24cbe2e15c5f1

      SHA1

      6755bd9796f0d9e188b72600f8b5a88138829982

      SHA256

      34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433

      SHA512

      c2617c1c1a2006c809c117eb88341e700b5cb604baf6a831344aab456fa7c7b025e29a684e6e30e006e5c6bb3c5534cdd654bf2b592f3aacc3e7c94f071bde90

      Download Submit
    • C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
      MD5

      9d817d2b622720bf60d24cbe2e15c5f1

      SHA1

      6755bd9796f0d9e188b72600f8b5a88138829982

      SHA256

      34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433

      SHA512

      c2617c1c1a2006c809c117eb88341e700b5cb604baf6a831344aab456fa7c7b025e29a684e6e30e006e5c6bb3c5534cdd654bf2b592f3aacc3e7c94f071bde90

      Download Submit
    • C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
      MD5

      9d817d2b622720bf60d24cbe2e15c5f1

      SHA1

      6755bd9796f0d9e188b72600f8b5a88138829982

      SHA256

      34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433

      SHA512

      c2617c1c1a2006c809c117eb88341e700b5cb604baf6a831344aab456fa7c7b025e29a684e6e30e006e5c6bb3c5534cdd654bf2b592f3aacc3e7c94f071bde90

      Download Submit
    • memory/752-9-0x0000000000000000-mapping.dmp
      Download
    • memory/940-4-0x0000000000000000-mapping.dmp
      Download
    • memory/2468-0-0x0000000000000000-mapping.dmp
      Download
    • memory/2468-3-0x0000000002270000-0x000000000229E000-memory.dmp
      Filesize

      184KB

      Download