trickbot | b2d9109a3980aadf1ed5f29d238b63ed62ba1f8bc59649c8becb6e737a3f7540

General

Target

SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300.exe
Size

424KB
MD5

6087aa8b7ef507c5147453993f1aba51
SHA1

009842a189b00f4088a4bae3078b983d15f237cf
SHA256

b2d9109a3980aadf1ed5f29d238b63ed62ba1f8bc59649c8becb6e737a3f7540
SHA512

a230b18f28c313a7c6e617c516ddcef6ea13061e8b058f709d5f7babcfc468ec3980ec10b46a0f1dd2f07c506bb0ab99dbd0911dfc743ff6d9a202d4747e0b86

Score

10^/10

trickbot lib5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

SecuriteInfo.exe

pid process

3688 SecuriteInfo.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 ident.me
20 ident.me
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3944 wermgr.exe

pid	process
3688	SecuriteInfo.exe

flow	ioc
19	ident.me
20	ident.me

description	pid	process
Token: SeDebugPrivilege	3944	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300.exeSecuriteInfo.exe

description	pid	process	target process
PID 1924 wrote to memory of 3688	1924	SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300.exe	SecuriteInfo.exe
PID 1924 wrote to memory of 3688	1924	SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300.exe	SecuriteInfo.exe
PID 1924 wrote to memory of 3688	1924	SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300.exe	SecuriteInfo.exe
PID 3688 wrote to memory of 3944	3688	SecuriteInfo.exe	wermgr.exe
PID 3688 wrote to memory of 3944	3688	SecuriteInfo.exe	wermgr.exe
PID 3688 wrote to memory of 3944	3688	SecuriteInfo.exe	wermgr.exe
PID 3688 wrote to memory of 3944	3688	SecuriteInfo.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
MD5
6087aa8b7ef507c5147453993f1aba51

SHA1
009842a189b00f4088a4bae3078b983d15f237cf

SHA256
b2d9109a3980aadf1ed5f29d238b63ed62ba1f8bc59649c8becb6e737a3f7540

SHA512
a230b18f28c313a7c6e617c516ddcef6ea13061e8b058f709d5f7babcfc468ec3980ec10b46a0f1dd2f07c506bb0ab99dbd0911dfc743ff6d9a202d4747e0b86

Download Submit
C:\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
MD5
6087aa8b7ef507c5147453993f1aba51

SHA1
009842a189b00f4088a4bae3078b983d15f237cf

SHA256
b2d9109a3980aadf1ed5f29d238b63ed62ba1f8bc59649c8becb6e737a3f7540

SHA512
a230b18f28c313a7c6e617c516ddcef6ea13061e8b058f709d5f7babcfc468ec3980ec10b46a0f1dd2f07c506bb0ab99dbd0911dfc743ff6d9a202d4747e0b86

Download Submit
memory/3688-2-0x0000000000000000-mapping.dmp

Download
memory/3944-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing