trickbot | 57923313973c7955afed23ce377688c7eb1cc088423f0678206b3fb16bd433ec

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
04-01-2021 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zvnxrohlqhnp.exe
Size

668KB
MD5

dbbdabb917e3edbd134e841829b723c5
SHA1

6360ac5a1a5e7ff017e5a9a8bd35cb140cc1cab1
SHA256

57923313973c7955afed23ce377688c7eb1cc088423f0678206b3fb16bd433ec
SHA512

c907195d8f70f4cf9249aa5c84a5b96dd70e3fcda6a000297303255daf960557a045af95c5490c73dcda7bb64cd02e2d08a7a38162a5e66d0c3b625ac07094b7

Score

10^/10

trickbot mor9 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

mor9

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3772 wermgr.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

zvnxrohlqhnp.exe

pid process

1176 zvnxrohlqhnp.exe
1176 zvnxrohlqhnp.exe
1176 zvnxrohlqhnp.exe
1176 zvnxrohlqhnp.exe

description	pid	process
Token: SeDebugPrivilege	3772	wermgr.exe

pid	process
1176	zvnxrohlqhnp.exe
1176	zvnxrohlqhnp.exe
1176	zvnxrohlqhnp.exe
1176	zvnxrohlqhnp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zvnxrohlqhnp.exe

description	pid	process	target process
PID 1176 wrote to memory of 3772	1176	zvnxrohlqhnp.exe	wermgr.exe
PID 1176 wrote to memory of 3772	1176	zvnxrohlqhnp.exe	wermgr.exe
PID 1176 wrote to memory of 3772	1176	zvnxrohlqhnp.exe	wermgr.exe
PID 1176 wrote to memory of 3772	1176	zvnxrohlqhnp.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\zvnxrohlqhnp.exe
"C:\Users\Admin\AppData\Local\Temp\zvnxrohlqhnp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-2-0x0000000002C30000-0x0000000002C70000-memory.dmp

Filesize
256KB

Download
memory/1176-3-0x0000000002C70000-0x0000000002CAC000-memory.dmp

Filesize
240KB

Download
memory/3772-4-0x0000000000000000-mapping.dmp

Download