trickbot | 2312b722d68f907871f5d3cebea0939e51e78e402bd3514ef03a8f0fff380d27

General

Target

SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe
Size

424KB
MD5

52d87c733b3cf7e6e653d6141b2222bb
SHA1

94629d7dff20b75636588e3964b4e7e4882ac4d6
SHA256

2312b722d68f907871f5d3cebea0939e51e78e402bd3514ef03a8f0fff380d27
SHA512

e6d3329c9b26e61086a04d7b7847cae77d329e70f5f09994b0e2d91ef617a0ba95491c203eeded793c9eda8871db88de63623058fd7958f827b0b49c009cf435

Score

10^/10

trickbot lib5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

SecuriteInfo.exe

pid process

1424 SecuriteInfo.exe
Loads dropped DLL 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe

pid process

1204 SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 checkip.amazonaws.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 844 wermgr.exe

pid	process
1424	SecuriteInfo.exe

pid	process
1204	SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe

flow	ioc
6	checkip.amazonaws.com

description	pid	process
Token: SeDebugPrivilege	844	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

SecuriteInfo.com.Trojan.Packed.140.16756.13527.exeSecuriteInfo.exe

description	pid	process	target process
PID 1204 wrote to memory of 1424	1204	SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe	SecuriteInfo.exe
PID 1204 wrote to memory of 1424	1204	SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe	SecuriteInfo.exe
PID 1204 wrote to memory of 1424	1204	SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe	SecuriteInfo.exe
PID 1204 wrote to memory of 1424	1204	SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe	SecuriteInfo.exe
PID 1424 wrote to memory of 844	1424	SecuriteInfo.exe	wermgr.exe
PID 1424 wrote to memory of 844	1424	SecuriteInfo.exe	wermgr.exe
PID 1424 wrote to memory of 844	1424	SecuriteInfo.exe	wermgr.exe
PID 1424 wrote to memory of 844	1424	SecuriteInfo.exe	wermgr.exe
PID 1424 wrote to memory of 844	1424	SecuriteInfo.exe	wermgr.exe
PID 1424 wrote to memory of 844	1424	SecuriteInfo.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed.140.16756.13527.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
MD5
52d87c733b3cf7e6e653d6141b2222bb

SHA1
94629d7dff20b75636588e3964b4e7e4882ac4d6

SHA256
2312b722d68f907871f5d3cebea0939e51e78e402bd3514ef03a8f0fff380d27

SHA512
e6d3329c9b26e61086a04d7b7847cae77d329e70f5f09994b0e2d91ef617a0ba95491c203eeded793c9eda8871db88de63623058fd7958f827b0b49c009cf435

Download Submit
\Users\Admin\AppData\Roaming\DesktopColor\SecuriteInfo.exe
MD5
52d87c733b3cf7e6e653d6141b2222bb

SHA1
94629d7dff20b75636588e3964b4e7e4882ac4d6

SHA256
2312b722d68f907871f5d3cebea0939e51e78e402bd3514ef03a8f0fff380d27

SHA512
e6d3329c9b26e61086a04d7b7847cae77d329e70f5f09994b0e2d91ef617a0ba95491c203eeded793c9eda8871db88de63623058fd7958f827b0b49c009cf435

Download Submit
memory/844-5-0x0000000000000000-mapping.dmp

Download
memory/1424-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing