trickbot | fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d350

Analysis

Target

c361c1bd2335782d5cb24ac81e2d5e6c.exe
Size

660KB
MD5

b44c5540e020963aca89f3b9a96beb35
SHA1

14a6e46be7863db3090d81a18d4e080ac005f437
SHA256

fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d350
SHA512

63ffac732d6b6b469f6072efa0b4ad0ef224072418b18ed879fe914c3cb64b6714ca4948c5d1816218d611865a1f1747121e126a407acbcc038b4615f9b7fd31

Score

10^/10

Family

trickbot

Version

100001

Botnet

tar2

66.85.183.5:443

185.163.47.157:443

94.140.115.99:443

195.123.240.40:443

195.123.241.226:443

Attributes

ecc_pubkey.base64

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 812 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c361c1bd2335782d5cb24ac81e2d5e6c.exe

pid process

1304 c361c1bd2335782d5cb24ac81e2d5e6c.exe
1304 c361c1bd2335782d5cb24ac81e2d5e6c.exe

description	pid	process
Token: SeDebugPrivilege	812	wermgr.exe

pid	process
1304	c361c1bd2335782d5cb24ac81e2d5e6c.exe
1304	c361c1bd2335782d5cb24ac81e2d5e6c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c361c1bd2335782d5cb24ac81e2d5e6c.exe

description	pid	process	target process
PID 1304 wrote to memory of 812	1304	c361c1bd2335782d5cb24ac81e2d5e6c.exe	wermgr.exe
PID 1304 wrote to memory of 812	1304	c361c1bd2335782d5cb24ac81e2d5e6c.exe	wermgr.exe
PID 1304 wrote to memory of 812	1304	c361c1bd2335782d5cb24ac81e2d5e6c.exe	wermgr.exe
PID 1304 wrote to memory of 812	1304	c361c1bd2335782d5cb24ac81e2d5e6c.exe	wermgr.exe

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:812

memory/812-2-0x0000000000000000-mapping.dmp

Download
memory/1304-0-0x00000000023E0000-0x000000000241E000-memory.dmp

Filesize
248KB

Download
memory/1304-1-0x0000000002420000-0x000000000245A000-memory.dmp

Filesize
232KB

Download