trickbot | 16ffd56ef9d4ad421e6e393d3ae311a2e9c8c768589a8eef3a82eb687c9cb052

General

Target

ec00bdbe605b0e4909795bf55230c24f.exe
Size

424KB
MD5

ec00bdbe605b0e4909795bf55230c24f
SHA1

f302942049189a72893bd88d6054f599aaccc164
SHA256

16ffd56ef9d4ad421e6e393d3ae311a2e9c8c768589a8eef3a82eb687c9cb052
SHA512

f022e0938d5ce91718ae28da9490c7781fd6f2a3374b30ef7fd772ad21309e2dee9df94ae7da35d1aad67a0e7865c0f790aaa5c5edb921e99938a01e9375e9a4

Score

10^/10

trickbot lib5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

ec00bdbe605b0e4909795bf55230c24f.exe

pid process

4276 ec00bdbe605b0e4909795bf55230c24f.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 icanhazip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 4280 wermgr.exe

pid	process
4276	ec00bdbe605b0e4909795bf55230c24f.exe

flow	ioc
18	icanhazip.com

description	pid	process
Token: SeDebugPrivilege	4280	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ec00bdbe605b0e4909795bf55230c24f.exeec00bdbe605b0e4909795bf55230c24f.exe

description	pid	process	target process
PID 4804 wrote to memory of 4276	4804	ec00bdbe605b0e4909795bf55230c24f.exe	ec00bdbe605b0e4909795bf55230c24f.exe
PID 4804 wrote to memory of 4276	4804	ec00bdbe605b0e4909795bf55230c24f.exe	ec00bdbe605b0e4909795bf55230c24f.exe
PID 4804 wrote to memory of 4276	4804	ec00bdbe605b0e4909795bf55230c24f.exe	ec00bdbe605b0e4909795bf55230c24f.exe
PID 4276 wrote to memory of 4280	4276	ec00bdbe605b0e4909795bf55230c24f.exe	wermgr.exe
PID 4276 wrote to memory of 4280	4276	ec00bdbe605b0e4909795bf55230c24f.exe	wermgr.exe
PID 4276 wrote to memory of 4280	4276	ec00bdbe605b0e4909795bf55230c24f.exe	wermgr.exe
PID 4276 wrote to memory of 4280	4276	ec00bdbe605b0e4909795bf55230c24f.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\ec00bdbe605b0e4909795bf55230c24f.exe
"C:\Users\Admin\AppData\Local\Temp\ec00bdbe605b0e4909795bf55230c24f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Roaming\DesktopColor\ec00bdbe605b0e4909795bf55230c24f.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\ec00bdbe605b0e4909795bf55230c24f.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\ec00bdbe605b0e4909795bf55230c24f.exe
MD5
ec00bdbe605b0e4909795bf55230c24f

SHA1
f302942049189a72893bd88d6054f599aaccc164

SHA256
16ffd56ef9d4ad421e6e393d3ae311a2e9c8c768589a8eef3a82eb687c9cb052

SHA512
f022e0938d5ce91718ae28da9490c7781fd6f2a3374b30ef7fd772ad21309e2dee9df94ae7da35d1aad67a0e7865c0f790aaa5c5edb921e99938a01e9375e9a4

Download Submit
C:\Users\Admin\AppData\Roaming\DesktopColor\ec00bdbe605b0e4909795bf55230c24f.exe
MD5
ec00bdbe605b0e4909795bf55230c24f

SHA1
f302942049189a72893bd88d6054f599aaccc164

SHA256
16ffd56ef9d4ad421e6e393d3ae311a2e9c8c768589a8eef3a82eb687c9cb052

SHA512
f022e0938d5ce91718ae28da9490c7781fd6f2a3374b30ef7fd772ad21309e2dee9df94ae7da35d1aad67a0e7865c0f790aaa5c5edb921e99938a01e9375e9a4

Download Submit
memory/4276-2-0x0000000000000000-mapping.dmp

Download
memory/4280-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing