trickbot | f4f92a6ed4e8a88818db25823c89833364e1b4699588a631696262daa3212aee

Analysis

max time kernel
60s
max time network
118s
platform
windows7_x64
resource
win7v20201028
submitted
30-12-2020 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe
Size

612KB
MD5

9249937f8b65eeaef25cf49a86b8e1c7
SHA1

bab6aa3b076c6f956191c406047df30c73eb46db
SHA256

f4f92a6ed4e8a88818db25823c89833364e1b4699588a631696262daa3212aee
SHA512

e77e2d20e93902fb7f211b3320006f6e41de18f4572167aee7f536d740365aa0435500f9d6d096e4615c213ccef1477ce3d9848f3cf544a293c329d120eab28b

Score

10^/10

trickbot mor6 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100008

Botnet

mor6

103.231.115.106:449

117.222.63.100:449

117.254.58.83:449

149.54.11.54:449

170.82.4.64:449

177.11.12.93:449

182.16.187.251:449

187.108.86.48:449

190.152.88.57:449

203.88.149.33:449

36.89.191.119:449

41.159.31.227:449

85.202.128.243:449

92.204.160.82:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.48:449

102.164.208.44:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ident.me
7 ident.me
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1568 wermgr.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe

pid process

1824 SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe

flow	ioc
6	ident.me
7	ident.me

description	pid	process
Token: SeDebugPrivilege	1568	wermgr.exe

pid	process
1824	SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe

description	pid	process	target process
PID 1824 wrote to memory of 1568	1824	SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe	wermgr.exe
PID 1824 wrote to memory of 1568	1824	SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe	wermgr.exe
PID 1824 wrote to memory of 1568	1824	SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe	wermgr.exe
PID 1824 wrote to memory of 1568	1824	SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe	wermgr.exe
PID 1824 wrote to memory of 1568	1824	SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe	wermgr.exe
PID 1824 wrote to memory of 1568	1824	SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.1205.12418.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-5-0x0000000000000000-mapping.dmp

Download
memory/1824-4-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/1824-6-0x0000000002580000-0x0000000002584000-memory.dmp

Filesize
16KB

Download
memory/1824-7-0x0000000002740000-0x0000000002744000-memory.dmp

Filesize
16KB

Download