trickbot | fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee

General

Target

fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
Size

692KB
MD5

34da6a5c0f710bb913060171ae73d6b3
SHA1

0a2899b01777fa9f771ae1d58c4953a0659a29d7
SHA256

fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee
SHA512

9a3ae6f2e02e6636f87d5219e12510e57061b42308ad6de6a084f6de0c539eb1b360f2ace1a9d430afac87fe93dab2f2af8cb74d26b6ee674e3f08fa04aa8689

Score

10^/10

trickbot lib6 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib6

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

pid process

1692 fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

pid	process
1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

Loads dropped DLL 2 IoCs

Processes:

fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

pid	process
1108	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
1108	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 api.ipify.org
15 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 896 wermgr.exe

flow	ioc
16	api.ipify.org
15	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	896	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exefc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

pid	process
1108	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exefc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

description	pid	process	target process
PID 1108 wrote to memory of 1692	1108	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
PID 1108 wrote to memory of 1692	1108	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
PID 1108 wrote to memory of 1692	1108	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
PID 1108 wrote to memory of 1692	1108	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
PID 1692 wrote to memory of 896	1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	wermgr.exe
PID 1692 wrote to memory of 896	1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	wermgr.exe
PID 1692 wrote to memory of 896	1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	wermgr.exe
PID 1692 wrote to memory of 896	1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	wermgr.exe
PID 1692 wrote to memory of 896	1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	wermgr.exe
PID 1692 wrote to memory of 896	1692	fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
"C:\Users\Admin\AppData\Local\Temp\fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108

C:\Users\Admin\AppData\Roaming\DesktopColor\fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
MD5
34da6a5c0f710bb913060171ae73d6b3

SHA1
0a2899b01777fa9f771ae1d58c4953a0659a29d7

SHA256
fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee

SHA512
9a3ae6f2e02e6636f87d5219e12510e57061b42308ad6de6a084f6de0c539eb1b360f2ace1a9d430afac87fe93dab2f2af8cb74d26b6ee674e3f08fa04aa8689

Download Submit
\Users\Admin\AppData\Roaming\DesktopColor\fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
MD5
34da6a5c0f710bb913060171ae73d6b3

SHA1
0a2899b01777fa9f771ae1d58c4953a0659a29d7

SHA256
fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee

SHA512
9a3ae6f2e02e6636f87d5219e12510e57061b42308ad6de6a084f6de0c539eb1b360f2ace1a9d430afac87fe93dab2f2af8cb74d26b6ee674e3f08fa04aa8689

Download Submit
\Users\Admin\AppData\Roaming\DesktopColor\fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe
MD5
34da6a5c0f710bb913060171ae73d6b3

SHA1
0a2899b01777fa9f771ae1d58c4953a0659a29d7

SHA256
fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee

SHA512
9a3ae6f2e02e6636f87d5219e12510e57061b42308ad6de6a084f6de0c539eb1b360f2ace1a9d430afac87fe93dab2f2af8cb74d26b6ee674e3f08fa04aa8689

Download Submit
memory/896-16-0x0000000000000000-mapping.dmp

Download
memory/896-17-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/896-18-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1108-14-0x00000000002F0000-0x00000000002F4000-memory.dmp

Filesize
16KB

Download
memory/1108-15-0x0000000002750000-0x0000000002754000-memory.dmp

Filesize
16KB

Download
memory/1108-4-0x0000000058520000-0x0000000058522000-memory.dmp

Filesize
8KB

Download
memory/1692-7-0x0000000000000000-mapping.dmp

Download
memory/1692-12-0x00000000586A0000-0x00000000586A1000-memory.dmp

Filesize
4KB

Download
memory/1692-13-0x0000000058681000-0x0000000058683000-memory.dmp

Filesize
8KB

Download
memory/1692-20-0x00000000026B0000-0x00000000026B4000-memory.dmp

Filesize
16KB

Download
memory/1692-19-0x00000000024B0000-0x00000000024B4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads