trickbot | b6af20ac6ddedad4f914bcb11c08e5399a4aadade16365bae3a5cb1611371e89

Target

b5ef0dd86a3fb068a1eef951a9e9bcd1.exe
Size

630KB
MD5

b5ef0dd86a3fb068a1eef951a9e9bcd1
SHA1

098e8b092629f8b1ab59d20b4ebbe39725b2064b
SHA256

b6af20ac6ddedad4f914bcb11c08e5399a4aadade16365bae3a5cb1611371e89
SHA512

45b1477ba4900eaae9731a5f182ff566ba1b9c023db5a0a251779956ea6c2167a4175c182d977b210ec056233237c31981a32593e089ac97418d656678e8fb73

Score

10^/10

trickbot rob38 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob38

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip.anysrc.net
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SndVol.exewermgr.exe

description pid process

Token: 33 1528 SndVol.exe
Token: SeIncBasePriorityPrivilege 1528 SndVol.exe
Token: SeDebugPrivilege 1340 wermgr.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

SndVol.exe

pid process

1528 SndVol.exe
1528 SndVol.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

SndVol.exe

pid process

1528 SndVol.exe
1528 SndVol.exe
1528 SndVol.exe
1528 SndVol.exe

flow	ioc
10	ip.anysrc.net

description	pid	process
Token: 33	1528	SndVol.exe
Token: SeIncBasePriorityPrivilege	1528	SndVol.exe
Token: SeDebugPrivilege	1340	wermgr.exe

pid	process
1528	SndVol.exe
1528	SndVol.exe

pid	process
1528	SndVol.exe
1528	SndVol.exe
1528	SndVol.exe
1528	SndVol.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b5ef0dd86a3fb068a1eef951a9e9bcd1.exe

description	pid	process	target process
PID 1632 wrote to memory of 368	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 368	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 368	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 368	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 1340	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 1340	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 1340	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 1340	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 1340	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe
PID 1632 wrote to memory of 1340	1632	b5ef0dd86a3fb068a1eef951a9e9bcd1.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\b5ef0dd86a3fb068a1eef951a9e9bcd1.exe
"C:\Users\Admin\AppData\Local\Temp\b5ef0dd86a3fb068a1eef951a9e9bcd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
PID:368

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\system32\SndVol.exe
SndVol.exe -f 46269598 7905
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-9-0x0000000000000000-mapping.dmp

Download
memory/1340-10-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/1340-11-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1528-5-0x000007FEFC1C1000-0x000007FEFC1C3000-memory.dmp

Filesize
8KB

Download
memory/1528-6-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1632-2-0x0000000076341000-0x0000000076343000-memory.dmp

Filesize
8KB

Download
memory/1632-3-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1632-4-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1632-8-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/1632-7-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download