trickbot | 8ed5bfd73f941dc50914104f719d8038cf97b79e754f528c68c23ac0f512b439

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7v20201028
submitted
02-01-2021 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

596KB
MD5

1372de53ba47855e25ca36db13e73db2
SHA1

4b7846b767cfbd9e8bcbace96deaf514106104ad
SHA256

8ed5bfd73f941dc50914104f719d8038cf97b79e754f528c68c23ac0f512b439
SHA512

e713bdd5ec1a86987f07c34a9333619222cad228641175cb3d1a70fc88a34a0fd16fea91431ce46cb95949f8820d5017cdf49eafa74699dc6fabd4b0c655fb66

Score

10^/10

trickbot yas13 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100004

Botnet

yas13

103.250.70.163:443

181.196.24.6:443

103.87.25.220:443

2.179.73.140:443

118.69.133.4:443

202.62.47.109:443

14.102.109.190:443

103.78.81.5:443

116.0.54.227:443

36.94.193.167:443

194.5.179.82:443

213.235.183.78:443

103.52.47.20:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Drops file in Windows directory 1 IoCs

Processes:

1.exe

description ioc process

File opened for modification C:\Windows\notepad.exe 1.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1.exe

pid process

1680 1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1540 wermgr.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1.exe

pid process

1680 1.exe

description	ioc	process
File opened for modification	C:\Windows\notepad.exe	1.exe

pid	process
1680	1.exe

description	pid	process
Token: SeDebugPrivilege	1540	wermgr.exe

pid	process
1680	1.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1.exe

description	pid	process	target process
PID 1680 wrote to memory of 1540	1680	1.exe	wermgr.exe
PID 1680 wrote to memory of 1540	1680	1.exe	wermgr.exe
PID 1680 wrote to memory of 1540	1680	1.exe	wermgr.exe
PID 1680 wrote to memory of 1540	1680	1.exe	wermgr.exe
PID 1680 wrote to memory of 1540	1680	1.exe	wermgr.exe
PID 1680 wrote to memory of 1540	1680	1.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-4-0x0000000000000000-mapping.dmp

Download
memory/1680-2-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download
memory/1680-3-0x00000000007B0000-0x00000000007EB000-memory.dmp

Filesize
236KB

Download