trickbot | f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff

Target

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
Size

532KB
MD5

2f9fc8e87e0484a96e7af9757228a789
SHA1

11f4eea8b8cfaa57bebcf1e42f7a29a592b5a836
SHA256

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff
SHA512

34fc29c79d6cebc107a9f72440a6ff0a57c028c7a118826b60472acf943a9c43e5979761b279af48086583bd98801f638a9c32a44dbe167d04d575a578b56a9c

Score

10^/10

trickbot tot26 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000020

Botnet

tot26

45.201.209.29:443

45.233.116.8:449

45.233.170.75:443

45.250.65.9:443

45.250.65.9:449

45.4.29.26:443

45.70.14.98:443

94.188.172.236:443

177.91.179.128:443

178.132.223.36:443

178.134.55.190:443

178.173.142.97:443

180.210.190.250:443

181.113.117.150:443

181.211.191.242:443

186.101.239.15:443

186.144.151.131:443

186.209.104.74:443

186.227.216.70:449

188.190.240.226:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

pid process

2652 f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 wtfismyip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2996 wermgr.exe

pid	process
2652	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

flow	ioc
23	wtfismyip.com

description	pid	process
Token: SeDebugPrivilege	2996	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exef81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

pid	process
640	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
2652	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exef81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe

description	pid	process	target process
PID 640 wrote to memory of 2652	640	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
PID 640 wrote to memory of 2652	640	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
PID 640 wrote to memory of 2652	640	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
PID 2652 wrote to memory of 2996	2652	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 2652 wrote to memory of 2996	2652	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 2652 wrote to memory of 2996	2652	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe
PID 2652 wrote to memory of 2996	2652	f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
"C:\Users\Admin\AppData\Local\Temp\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
MD5
2f9fc8e87e0484a96e7af9757228a789

SHA1
11f4eea8b8cfaa57bebcf1e42f7a29a592b5a836

SHA256
f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff

SHA512
34fc29c79d6cebc107a9f72440a6ff0a57c028c7a118826b60472acf943a9c43e5979761b279af48086583bd98801f638a9c32a44dbe167d04d575a578b56a9c

Download Submit
C:\Users\Admin\AppData\Roaming\DesktopColor\f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff.exe
MD5
2f9fc8e87e0484a96e7af9757228a789

SHA1
11f4eea8b8cfaa57bebcf1e42f7a29a592b5a836

SHA256
f81617e10bb9c4a722ea82e2ee39b5f53c6a1e31fa686fd6f0da7000efb303ff

SHA512
34fc29c79d6cebc107a9f72440a6ff0a57c028c7a118826b60472acf943a9c43e5979761b279af48086583bd98801f638a9c32a44dbe167d04d575a578b56a9c

Download Submit
memory/640-4-0x00000000022A0000-0x00000000022A2000-memory.dmp

Filesize
8KB

Download
memory/2652-5-0x0000000000000000-mapping.dmp

Download
memory/2652-11-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/2652-10-0x0000000002160000-0x0000000002162000-memory.dmp

Filesize
8KB

Download
memory/2652-12-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/2996-13-0x0000000000000000-mapping.dmp

Download
memory/2996-14-0x00000244CBC60000-0x00000244CBC87000-memory.dmp

Filesize
156KB

Download
memory/2996-15-0x00000244CBCA0000-0x00000244CBCA1000-memory.dmp

Filesize
4KB

Download