trickbot | f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff

General

Target

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
Size

532KB
MD5

2f9fc8e87e0484a96e7af9757228a789
SHA1

11f4eea8b8cfaa57bebcf1e42f7a29a592b5a836
SHA256

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff
SHA512

34fc29c79d6cebc107a9f72440a6ff0a57c028c7a118826b60472acf943a9c43e5979761b279af48086583bd98801f638a9c32a44dbe167d04d575a578b56a9c

Score

10^/10

trickbot tot26 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000020

Botnet

tot26

C2

45.201.209.29:443

45.233.116.8:449

45.233.170.75:443

45.250.65.9:443

45.250.65.9:449

45.4.29.26:443

45.70.14.98:443

94.188.172.236:443

177.91.179.128:443

178.132.223.36:443

178.134.55.190:443

178.173.142.97:443

180.210.190.250:443

181.113.117.150:443

181.211.191.242:443

186.101.239.15:443

186.144.151.131:443

186.209.104.74:443

186.227.216.70:449

188.190.240.226:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

pid process

1252 f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

pid	process
1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

Loads dropped DLL 2 IoCs

Processes:

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

pid	process
596	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
596	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 ident.me
12 ident.me
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 316 wermgr.exe

flow	ioc
11	ident.me
12	ident.me

description	pid	process
Token: SeDebugPrivilege	316	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exef81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

pid	process
596	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exef81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

description	pid	process	target process
PID 596 wrote to memory of 1252	596	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
PID 596 wrote to memory of 1252	596	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
PID 596 wrote to memory of 1252	596	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
PID 596 wrote to memory of 1252	596	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
PID 1252 wrote to memory of 316	1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 1252 wrote to memory of 316	1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 1252 wrote to memory of 316	1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 1252 wrote to memory of 316	1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 1252 wrote to memory of 316	1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 1252 wrote to memory of 316	1252	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
"C:\Users\Admin\AppData\Local\Temp\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596

C:\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
MD5
2f9fc8e87e0484a96e7af9757228a789

SHA1
11f4eea8b8cfaa57bebcf1e42f7a29a592b5a836

SHA256
f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff

SHA512
34fc29c79d6cebc107a9f72440a6ff0a57c028c7a118826b60472acf943a9c43e5979761b279af48086583bd98801f638a9c32a44dbe167d04d575a578b56a9c

Download Submit
\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
MD5
2f9fc8e87e0484a96e7af9757228a789

SHA1
11f4eea8b8cfaa57bebcf1e42f7a29a592b5a836

SHA256
f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff

SHA512
34fc29c79d6cebc107a9f72440a6ff0a57c028c7a118826b60472acf943a9c43e5979761b279af48086583bd98801f638a9c32a44dbe167d04d575a578b56a9c

Download Submit
\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
MD5
2f9fc8e87e0484a96e7af9757228a789

SHA1
11f4eea8b8cfaa57bebcf1e42f7a29a592b5a836

SHA256
f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff

SHA512
34fc29c79d6cebc107a9f72440a6ff0a57c028c7a118826b60472acf943a9c43e5979761b279af48086583bd98801f638a9c32a44dbe167d04d575a578b56a9c

Download Submit
memory/316-19-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/316-18-0x0000000000000000-mapping.dmp

Download
memory/316-20-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/596-5-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/596-12-0x0000000002590000-0x0000000002594000-memory.dmp

Filesize
16KB

Download
memory/596-13-0x0000000002650000-0x0000000002654000-memory.dmp

Filesize
16KB

Download
memory/596-4-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1252-8-0x0000000000000000-mapping.dmp

Download
memory/1252-15-0x00000000003C0000-0x00000000003C2000-memory.dmp

Filesize
8KB

Download
memory/1252-16-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/1252-17-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/1252-22-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/1252-21-0x0000000002970000-0x0000000002974000-memory.dmp

Filesize
16KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads