trickbot | 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276

Resubmissions

30/12/2020, 07:24

201230-2pnedj57aj10

28/12/2020, 18:56

201228-fmwh744fae10

Analysis

max time kernel
131s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
28/12/2020, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shiybnyrsolu.exe
Size 532KB
Sample201228-fmwh744fae
SHA256 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
MD5 59ea5e429638fa0801683014a19f10ac
SHA1 eb4bb017b2d14017f44ea32c01c54871215ea09a
SHA512 55df4ff121e7948917968c54911a49bcf140970162b365da1bf6027db3eea47021b43798e6b3a78906bac9b34e6c97e61dbb2a0f0531cd75bf486e2eb6387b98
MD5 SHA1 SHA512

Score

10^/10

trickbot mor5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100007

Botnet

mor5

103.87.25.220:443
103.98.129.222:449
41.243.29.182:449
103.87.25.220:449
196.45.140.146:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	myexternalip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	wermgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
8	shiybnyrsolu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1936	8	shiybnyrsolu.exe	78
PID 8 wrote to memory of 1936	8	shiybnyrsolu.exe	78
PID 8 wrote to memory of 1936	8	shiybnyrsolu.exe	78
PID 8 wrote to memory of 1936	8	shiybnyrsolu.exe	78

C:\Users\Admin\AppData\Local\Temp\shiybnyrsolu.exe
"C:\Users\Admin\AppData\Local\Temp\shiybnyrsolu.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-4-0x0000000003310000-0x000000000334C000-memory.dmp

Download