trickbot | 1a88779e8e9a622d5ca5afb2a67d6f979f32e02abf8fbde4e5070c90a5b7972b

Analysis

max time kernel
147s
max time network
146s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd2ef70a0c5017f1a41e125f08ae4e8e.exe
Size

556KB
MD5

eeb8d28a9d10f1cc5eb93e1bb41a877c
SHA1

660350439de1884e0d48f1d31e75e4c76ad66f39
SHA256

1a88779e8e9a622d5ca5afb2a67d6f979f32e02abf8fbde4e5070c90a5b7972b
SHA512

4262f7e03396ed4951efd96c96151330c3a92d502f334bfd8bb804e384bef4c6c28350318f059bdab8507839d1470ca124a95429275c05c7e000f9ecaa8a8d9e

Score

10^/10

trickbot lib800 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

lib800

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1308 wermgr.exe
Token: SeDebugPrivilege 1308 wermgr.exe
Token: SeDebugPrivilege 1308 wermgr.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cd2ef70a0c5017f1a41e125f08ae4e8e.exe

pid process

1916 cd2ef70a0c5017f1a41e125f08ae4e8e.exe

description	pid	process
Token: SeDebugPrivilege	1308	wermgr.exe
Token: SeDebugPrivilege	1308	wermgr.exe
Token: SeDebugPrivilege	1308	wermgr.exe

pid	process
1916	cd2ef70a0c5017f1a41e125f08ae4e8e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cd2ef70a0c5017f1a41e125f08ae4e8e.exe

description	pid	process	target process
PID 1916 wrote to memory of 1308	1916	cd2ef70a0c5017f1a41e125f08ae4e8e.exe	wermgr.exe
PID 1916 wrote to memory of 1308	1916	cd2ef70a0c5017f1a41e125f08ae4e8e.exe	wermgr.exe
PID 1916 wrote to memory of 1308	1916	cd2ef70a0c5017f1a41e125f08ae4e8e.exe	wermgr.exe
PID 1916 wrote to memory of 1308	1916	cd2ef70a0c5017f1a41e125f08ae4e8e.exe	wermgr.exe
PID 1916 wrote to memory of 1308	1916	cd2ef70a0c5017f1a41e125f08ae4e8e.exe	wermgr.exe
PID 1916 wrote to memory of 1308	1916	cd2ef70a0c5017f1a41e125f08ae4e8e.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\cd2ef70a0c5017f1a41e125f08ae4e8e.exe
"C:\Users\Admin\AppData\Local\Temp\cd2ef70a0c5017f1a41e125f08ae4e8e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-3-0x0000000000000000-mapping.dmp

Download
memory/1916-2-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/1916-4-0x00000000025F0000-0x00000000025F4000-memory.dmp

Filesize
16KB

Download
memory/1916-5-0x0000000002780000-0x0000000002784000-memory.dmp

Filesize
16KB

Download