trickbot | 471c8f897dbf91a3c94b8038d565f3887e5847c326da6a40ce840daf28991edf

General

Target

3076ca9af343a0e9fa069c06c5f61672.exe
Size

472KB
MD5

d88f41dca3cdf77703f870d93c039076
SHA1

b812c88adc08e31f516a0b43fe1e2d1d57c83a28
SHA256

471c8f897dbf91a3c94b8038d565f3887e5847c326da6a40ce840daf28991edf
SHA512

f6eddd3ee892a6ddaa0a26f92ee518994078ef14deb1a6ec0c69748b8e3ecc581097ef28cdc86f35b8b70b522708e3336630079024f4518c41522ad64a61bf8a

Score

10^/10

trickbot lib697 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000503

Botnet

lib697

C2

5.182.210.226:443

192.210.226.106:443

51.254.164.244:443

45.148.120.153:443

195.123.239.67:443

194.5.250.150:443

217.12.209.200:443

185.99.2.221:443

51.254.164.245:443

185.62.188.159:443

46.17.107.65:443

185.20.185.76:443

185.203.118.37:443

146.185.253.178:443

185.14.31.252:443

185.99.2.115:443

172.245.156.138:443

51.89.73.158:443

190.214.13.2:449

181.140.173.186:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

3076ca9af343a0e9fa069c06c5f61672.exe

pid process

796 3076ca9af343a0e9fa069c06c5f61672.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 312 svchost.exe
Token: SeDebugPrivilege 312 svchost.exe

pid	process
796	3076ca9af343a0e9fa069c06c5f61672.exe

description	pid	process
Token: SeDebugPrivilege	312	svchost.exe
Token: SeDebugPrivilege	312	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

3076ca9af343a0e9fa069c06c5f61672.exe3076ca9af343a0e9fa069c06c5f61672.exe

pid	process
988	3076ca9af343a0e9fa069c06c5f61672.exe
988	3076ca9af343a0e9fa069c06c5f61672.exe
796	3076ca9af343a0e9fa069c06c5f61672.exe
796	3076ca9af343a0e9fa069c06c5f61672.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

3076ca9af343a0e9fa069c06c5f61672.exe3076ca9af343a0e9fa069c06c5f61672.exe

description	pid	process	target process
PID 988 wrote to memory of 796	988	3076ca9af343a0e9fa069c06c5f61672.exe	3076ca9af343a0e9fa069c06c5f61672.exe
PID 988 wrote to memory of 796	988	3076ca9af343a0e9fa069c06c5f61672.exe	3076ca9af343a0e9fa069c06c5f61672.exe
PID 988 wrote to memory of 796	988	3076ca9af343a0e9fa069c06c5f61672.exe	3076ca9af343a0e9fa069c06c5f61672.exe
PID 796 wrote to memory of 312	796	3076ca9af343a0e9fa069c06c5f61672.exe	svchost.exe
PID 796 wrote to memory of 312	796	3076ca9af343a0e9fa069c06c5f61672.exe	svchost.exe
PID 796 wrote to memory of 312	796	3076ca9af343a0e9fa069c06c5f61672.exe	svchost.exe
PID 796 wrote to memory of 312	796	3076ca9af343a0e9fa069c06c5f61672.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3076ca9af343a0e9fa069c06c5f61672.exe
"C:\Users\Admin\AppData\Local\Temp\3076ca9af343a0e9fa069c06c5f61672.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988

C:\Users\Admin\AppData\Roaming\monolib\3076ca9af343a0e9fa069c06c5f61672.exe
C:\Users\Admin\AppData\Roaming\monolib\3076ca9af343a0e9fa069c06c5f61672.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:312

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\monolib\3076ca9af343a0e9fa069c06c5f61672.exe
MD5
d88f41dca3cdf77703f870d93c039076

SHA1
b812c88adc08e31f516a0b43fe1e2d1d57c83a28

SHA256
471c8f897dbf91a3c94b8038d565f3887e5847c326da6a40ce840daf28991edf

SHA512
f6eddd3ee892a6ddaa0a26f92ee518994078ef14deb1a6ec0c69748b8e3ecc581097ef28cdc86f35b8b70b522708e3336630079024f4518c41522ad64a61bf8a

Download Submit
C:\Users\Admin\AppData\Roaming\monolib\3076ca9af343a0e9fa069c06c5f61672.exe
MD5
d88f41dca3cdf77703f870d93c039076

SHA1
b812c88adc08e31f516a0b43fe1e2d1d57c83a28

SHA256
471c8f897dbf91a3c94b8038d565f3887e5847c326da6a40ce840daf28991edf

SHA512
f6eddd3ee892a6ddaa0a26f92ee518994078ef14deb1a6ec0c69748b8e3ecc581097ef28cdc86f35b8b70b522708e3336630079024f4518c41522ad64a61bf8a

Download Submit
memory/312-11-0x0000000000000000-mapping.dmp

Download
memory/312-13-0x000001F70D210000-0x000001F70D291000-memory.dmp

Filesize
516KB

Download
memory/796-4-0x0000000000000000-mapping.dmp

Download
memory/988-3-0x0000000002A70000-0x0000000002AA1000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing