trickbot | 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276

Resubmissions

30/12/2020, 07:24

201230-2pnedj57aj10

28/12/2020, 18:56

201228-fmwh744fae10

Analysis

max time kernel
1614s
max time network
1726s
platform
windows7_x64
resource
win7v20201028
submitted
30/12/2020, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shiybnyrsolu.exe
Size 532KB
Sample201230-2pnedj57aj
SHA256 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
MD5 59ea5e429638fa0801683014a19f10ac
SHA1 eb4bb017b2d14017f44ea32c01c54871215ea09a
SHA512 55df4ff121e7948917968c54911a49bcf140970162b365da1bf6027db3eea47021b43798e6b3a78906bac9b34e6c97e61dbb2a0f0531cd75bf486e2eb6387b98
MD5 SHA1 SHA512

Score

10^/10

trickbot mor5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100007

Botnet

mor5

103.87.25.220:443
103.98.129.222:449
41.243.29.182:449
103.87.25.220:449
196.45.140.146:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	icanhazip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	wermgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	shiybnyrsolu.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1068	932	shiybnyrsolu.exe	29
PID 932 wrote to memory of 1068	932	shiybnyrsolu.exe	29
PID 932 wrote to memory of 1068	932	shiybnyrsolu.exe	29
PID 932 wrote to memory of 1068	932	shiybnyrsolu.exe	29
PID 932 wrote to memory of 1068	932	shiybnyrsolu.exe	29
PID 932 wrote to memory of 1068	932	shiybnyrsolu.exe	29

C:\Users\Admin\AppData\Local\Temp\shiybnyrsolu.exe
"C:\Users\Admin\AppData\Local\Temp\shiybnyrsolu.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1068

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads