trickbot | 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276 | Triage™

Resubmissions

30/12/2020, 07:24

201230-2pnedj57aj10

28/12/2020, 18:56

201228-fmwh744fae10

Analysis

max time kernel
139s
max time network
147s
platform
windows7_x64
resource
win7v20201028
submitted
28/12/2020, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shiybnyrsolu.exe
Size 532KB
Sample201228-fmwh744fae
SHA256 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
MD5 59ea5e429638fa0801683014a19f10ac
SHA1 eb4bb017b2d14017f44ea32c01c54871215ea09a
SHA512 55df4ff121e7948917968c54911a49bcf140970162b365da1bf6027db3eea47021b43798e6b3a78906bac9b34e6c97e61dbb2a0f0531cd75bf486e2eb6387b98
MD5 SHA1 SHA512

Score

10^/10

trickbot mor5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100007

Botnet

mor5

C2

103.87.25.220:443
103.98.129.222:449
41.243.29.182:449
103.87.25.220:449
196.45.140.146:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	wermgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	shiybnyrsolu.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 740	1068	shiybnyrsolu.exe	29
PID 1068 wrote to memory of 740	1068	shiybnyrsolu.exe	29
PID 1068 wrote to memory of 740	1068	shiybnyrsolu.exe	29
PID 1068 wrote to memory of 740	1068	shiybnyrsolu.exe	29
PID 1068 wrote to memory of 740	1068	shiybnyrsolu.exe	29
PID 1068 wrote to memory of 740	1068	shiybnyrsolu.exe	29

C:\Users\Admin\AppData\Local\Temp\shiybnyrsolu.exe
"C:\Users\Admin\AppData\Local\Temp\shiybnyrsolu.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads