trickbot | 7d974d5a314a19adf76cdd29618acbfb6a61d1cbbdf150ca1c62b88cda9e79dc

Resubmissions

30/12/2020, 06:51

201230-yxxdjlnbpa10

30/12/2020, 06:47

201230-evn9r2jk8x10

Analysis

max time kernel
116s
max time network
128s
platform
windows10_x64
resource
win10v20201028
submitted
30/12/2020, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe
Size 612KB
Sample201230-evn9r2jk8x
SHA256 7d974d5a314a19adf76cdd29618acbfb6a61d1cbbdf150ca1c62b88cda9e79dc
MD5 aea5744df9a0d5c4c7f94047b3e85ed1
SHA1 2b1936840ac90f82a52fb8b09b30af706385fcb7
SHA512 ed97b9c67972fda272f3f5535dbc908b4350d0b973807f44591bec813179189f98eb6e75cc7428abde8f114c695bffb7d856b875842d525a1ecee54569048670
MD5 SHA1 SHA512

Score

10^/10

trickbot mor6 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100008

Botnet

mor6

103.231.115.106:449
117.222.63.100:449
117.254.58.83:449
149.54.11.54:449
170.82.4.64:449
177.11.12.93:449
182.16.187.251:449
187.108.86.48:449
190.152.88.57:449
203.88.149.33:449
36.89.191.119:449
41.159.31.227:449
85.202.128.243:449
92.204.160.82:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ident.me
32	ident.me

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	wermgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4056	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 1544	4056	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	78
PID 4056 wrote to memory of 1544	4056	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	78
PID 4056 wrote to memory of 1544	4056	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	78
PID 4056 wrote to memory of 1544	4056	SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe	78

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.820175.14827.1747.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4056-4-0x0000000002CE0000-0x0000000002D1C000-memory.dmp

Download