trickbot | 7d974d5a314a19adf76cdd29618acbfb6a61d1cbbdf150ca1c62b88cda9e79dc

Resubmissions

30-12-2020 06:51

201230-yxxdjlnbpa 10

30-12-2020 06:47

201230-evn9r2jk8x 10

Analysis

max time kernel
119s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
30-12-2020 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe
Size

612KB
MD5

aea5744df9a0d5c4c7f94047b3e85ed1
SHA1

2b1936840ac90f82a52fb8b09b30af706385fcb7
SHA256

7d974d5a314a19adf76cdd29618acbfb6a61d1cbbdf150ca1c62b88cda9e79dc
SHA512

ed97b9c67972fda272f3f5535dbc908b4350d0b973807f44591bec813179189f98eb6e75cc7428abde8f114c695bffb7d856b875842d525a1ecee54569048670

Score

10^/10

trickbot mor6 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100008

Botnet

mor6

103.231.115.106:449

117.222.63.100:449

117.254.58.83:449

149.54.11.54:449

170.82.4.64:449

177.11.12.93:449

182.16.187.251:449

187.108.86.48:449

190.152.88.57:449

203.88.149.33:449

36.89.191.119:449

41.159.31.227:449

85.202.128.243:449

92.204.160.82:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.48:449

102.164.208.44:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 wtfismyip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1556 wermgr.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe

pid process

1756 SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe

flow	ioc
7	wtfismyip.com

description	pid	process
Token: SeDebugPrivilege	1556	wermgr.exe

pid	process
1756	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe

description	pid	process	target process
PID 1756 wrote to memory of 1556	1756	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	wermgr.exe
PID 1756 wrote to memory of 1556	1756	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	wermgr.exe
PID 1756 wrote to memory of 1556	1756	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	wermgr.exe
PID 1756 wrote to memory of 1556	1756	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	wermgr.exe
PID 1756 wrote to memory of 1556	1756	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	wermgr.exe
PID 1756 wrote to memory of 1556	1756	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-5-0x0000000000000000-mapping.dmp

Download
memory/1756-4-0x0000000000310000-0x000000000034C000-memory.dmp

Filesize
240KB

Download
memory/1756-6-0x0000000000360000-0x0000000000364000-memory.dmp

Filesize
16KB

Download
memory/1756-7-0x0000000002800000-0x0000000002804000-memory.dmp

Filesize
16KB

Download