trickbot | 2ae54dde3652a1cceef7ec5fcc8f2fdf5a07833fba685f0c0ee9964c5c2429d4

Resubmissions

23-12-2020 15:58

201223-1hlyrl46q6 10

22-12-2020 12:26

201222-3slf4wqn26 10

Analysis

max time kernel
1774s
max time network
1784s
platform
windows7_x64
resource
win7v20201028
submitted
23-12-2020 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fccf27632f7bd48025d4b5a963722f7.exe
Size

491KB
MD5

2fccf27632f7bd48025d4b5a963722f7
SHA1

354daa8722c3ba2ea5b9365120e9a271a35eaef8
SHA256

2ae54dde3652a1cceef7ec5fcc8f2fdf5a07833fba685f0c0ee9964c5c2429d4
SHA512

6fd3c5301f8098cf1afb0d27631c67c54f161d085bc2e2d97799d5ae3c9cae96e1900e5122a2b92d2b68e69a595fac77280fdbccf17ac6acbb58163108b85bd4

Score

10^/10

trickbot forb2 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000514

Botnet

forb2

51.89.163.40:443

89.223.126.186:443

45.67.231.68:443

148.251.185.165:443

194.87.110.144:443

213.32.84.27:443

185.234.72.35:443

45.89.125.148:443

195.123.240.104:443

185.99.2.243:443

5.182.211.223:443

195.123.240.113:443

85.204.116.173:443

5.152.210.188:443

103.36.48.103:449

36.94.33.102:449

36.91.87.227:449

177.190.69.162:449

103.76.169.213:449

179.97.246.23:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Contacts Bazar domain
Uses Emercoin blockchain domains associated with Bazar backdoor/loader.
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2fccf27632f7bd48025d4b5a963722f7.exe

pid process

1120 2fccf27632f7bd48025d4b5a963722f7.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1656 wermgr.exe
Token: SeDebugPrivilege 1656 wermgr.exe
Token: SeDebugPrivilege 1656 wermgr.exe

pid	process
1120	2fccf27632f7bd48025d4b5a963722f7.exe

description	pid	process
Token: SeDebugPrivilege	1656	wermgr.exe
Token: SeDebugPrivilege	1656	wermgr.exe
Token: SeDebugPrivilege	1656	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2fccf27632f7bd48025d4b5a963722f7.exe

description	pid	process	target process
PID 1120 wrote to memory of 1656	1120	2fccf27632f7bd48025d4b5a963722f7.exe	wermgr.exe
PID 1120 wrote to memory of 1656	1120	2fccf27632f7bd48025d4b5a963722f7.exe	wermgr.exe
PID 1120 wrote to memory of 1656	1120	2fccf27632f7bd48025d4b5a963722f7.exe	wermgr.exe
PID 1120 wrote to memory of 1656	1120	2fccf27632f7bd48025d4b5a963722f7.exe	wermgr.exe
PID 1120 wrote to memory of 1656	1120	2fccf27632f7bd48025d4b5a963722f7.exe	wermgr.exe
PID 1120 wrote to memory of 1656	1120	2fccf27632f7bd48025d4b5a963722f7.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\2fccf27632f7bd48025d4b5a963722f7.exe
"C:\Users\Admin\AppData\Local\Temp\2fccf27632f7bd48025d4b5a963722f7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-3-0x0000000000600000-0x0000000000633000-memory.dmp

Filesize
204KB

Download
memory/1120-2-0x00000000005C0000-0x00000000005F8000-memory.dmp

Filesize
224KB

Download
memory/1656-4-0x0000000000000000-mapping.dmp

Download