trickbot | 662d84c8a14855610a6161c60bf16f30f4dfdbbcfb2b77eb44df0dada1032743

General

Target

7a259490a64411180dd9c14a6c42ff44.exe
Size

424KB
MD5

7a259490a64411180dd9c14a6c42ff44
SHA1

42cbd5cbe49e28fbb48f39cfd277be8c1c12fc17
SHA256

662d84c8a14855610a6161c60bf16f30f4dfdbbcfb2b77eb44df0dada1032743
SHA512

f9d1bd1689b696027d6b763e901845222365cc8660a0602bddc023aae3edadc1c0fca2af53f8b52ddad0407b6dcc37fc76ad37cc59caf1c5e1dd88c20d1720cd

Score

10^/10

trickbot lib5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

7a259490a64411180dd9c14a6c42ff44.exe

pid process

1904 7a259490a64411180dd9c14a6c42ff44.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 api.ipify.org
17 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2896 wermgr.exe

pid	process
1904	7a259490a64411180dd9c14a6c42ff44.exe

flow	ioc
16	api.ipify.org
17	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	2896	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

7a259490a64411180dd9c14a6c42ff44.exe7a259490a64411180dd9c14a6c42ff44.exe

description	pid	process	target process
PID 640 wrote to memory of 1904	640	7a259490a64411180dd9c14a6c42ff44.exe	7a259490a64411180dd9c14a6c42ff44.exe
PID 640 wrote to memory of 1904	640	7a259490a64411180dd9c14a6c42ff44.exe	7a259490a64411180dd9c14a6c42ff44.exe
PID 640 wrote to memory of 1904	640	7a259490a64411180dd9c14a6c42ff44.exe	7a259490a64411180dd9c14a6c42ff44.exe
PID 1904 wrote to memory of 2896	1904	7a259490a64411180dd9c14a6c42ff44.exe	wermgr.exe
PID 1904 wrote to memory of 2896	1904	7a259490a64411180dd9c14a6c42ff44.exe	wermgr.exe
PID 1904 wrote to memory of 2896	1904	7a259490a64411180dd9c14a6c42ff44.exe	wermgr.exe
PID 1904 wrote to memory of 2896	1904	7a259490a64411180dd9c14a6c42ff44.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\7a259490a64411180dd9c14a6c42ff44.exe
"C:\Users\Admin\AppData\Local\Temp\7a259490a64411180dd9c14a6c42ff44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Roaming\DesktopColor\7a259490a64411180dd9c14a6c42ff44.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\7a259490a64411180dd9c14a6c42ff44.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\7a259490a64411180dd9c14a6c42ff44.exe
MD5
7a259490a64411180dd9c14a6c42ff44

SHA1
42cbd5cbe49e28fbb48f39cfd277be8c1c12fc17

SHA256
662d84c8a14855610a6161c60bf16f30f4dfdbbcfb2b77eb44df0dada1032743

SHA512
f9d1bd1689b696027d6b763e901845222365cc8660a0602bddc023aae3edadc1c0fca2af53f8b52ddad0407b6dcc37fc76ad37cc59caf1c5e1dd88c20d1720cd

Download Submit
C:\Users\Admin\AppData\Roaming\DesktopColor\7a259490a64411180dd9c14a6c42ff44.exe
MD5
7a259490a64411180dd9c14a6c42ff44

SHA1
42cbd5cbe49e28fbb48f39cfd277be8c1c12fc17

SHA256
662d84c8a14855610a6161c60bf16f30f4dfdbbcfb2b77eb44df0dada1032743

SHA512
f9d1bd1689b696027d6b763e901845222365cc8660a0602bddc023aae3edadc1c0fca2af53f8b52ddad0407b6dcc37fc76ad37cc59caf1c5e1dd88c20d1720cd

Download Submit
memory/1904-2-0x0000000000000000-mapping.dmp

Download
memory/2896-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing