trickbot | 49545cccf16c4586e4f80d64ad4109a117894a1c930effdffef3d808593af53c

General

Target
303d02331911b47e6840c68a7c2da8bc.exe
Size 400KB
Sample210203-rtjmrdrd6a
SHA256 49545cccf16c4586e4f80d64ad4109a117894a1c930effdffef3d808593af53c
MD5 303d02331911b47e6840c68a7c2da8bc
SHA1 a46091201da60190b931e1f4e7b6b5f5dfb177a9
SHA512 7112b506c62467d78afb75327fce1182e17877011535f532359ef5f33ee92628501c47b5da8a431d9608b7d61f61a96e1b876c951e26892c992140ba8bcd7701
MD5 SHA1 SHA512

Score

10^/10

trickbot tot33 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000024

Botnet

tot33

C2

85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
1288	303d02331911b47e6840c68a7c2da8bc.exe

Loads dropped DLL 7 IoCs

pid	Process
1852	303d02331911b47e6840c68a7c2da8bc.exe
1852	303d02331911b47e6840c68a7c2da8bc.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	icanhazip.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe	303d02331911b47e6840c68a7c2da8bc.exe
File opened for modification	C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe	303d02331911b47e6840c68a7c2da8bc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1412	1852	WerFault.exe	24
1848	1288	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1412	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	WerFault.exe
Token: SeDebugPrivilege	1336	wermgr.exe
Token: SeDebugPrivilege	1848	WerFault.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1852	303d02331911b47e6840c68a7c2da8bc.exe
1288	303d02331911b47e6840c68a7c2da8bc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1288	1852	303d02331911b47e6840c68a7c2da8bc.exe	29
PID 1852 wrote to memory of 1288	1852	303d02331911b47e6840c68a7c2da8bc.exe	29
PID 1852 wrote to memory of 1288	1852	303d02331911b47e6840c68a7c2da8bc.exe	29
PID 1852 wrote to memory of 1288	1852	303d02331911b47e6840c68a7c2da8bc.exe	29
PID 1288 wrote to memory of 1784	1288	303d02331911b47e6840c68a7c2da8bc.exe	30
PID 1288 wrote to memory of 1784	1288	303d02331911b47e6840c68a7c2da8bc.exe	30
PID 1288 wrote to memory of 1784	1288	303d02331911b47e6840c68a7c2da8bc.exe	30
PID 1288 wrote to memory of 1784	1288	303d02331911b47e6840c68a7c2da8bc.exe	30
PID 1288 wrote to memory of 1336	1288	303d02331911b47e6840c68a7c2da8bc.exe	31
PID 1288 wrote to memory of 1336	1288	303d02331911b47e6840c68a7c2da8bc.exe	31
PID 1288 wrote to memory of 1336	1288	303d02331911b47e6840c68a7c2da8bc.exe	31
PID 1288 wrote to memory of 1336	1288	303d02331911b47e6840c68a7c2da8bc.exe	31
PID 1852 wrote to memory of 1412	1852	303d02331911b47e6840c68a7c2da8bc.exe	32
PID 1852 wrote to memory of 1412	1852	303d02331911b47e6840c68a7c2da8bc.exe	32
PID 1852 wrote to memory of 1412	1852	303d02331911b47e6840c68a7c2da8bc.exe	32
PID 1852 wrote to memory of 1412	1852	303d02331911b47e6840c68a7c2da8bc.exe	32
PID 1288 wrote to memory of 1336	1288	303d02331911b47e6840c68a7c2da8bc.exe	31
PID 1288 wrote to memory of 1336	1288	303d02331911b47e6840c68a7c2da8bc.exe	31
PID 1288 wrote to memory of 1848	1288	303d02331911b47e6840c68a7c2da8bc.exe	33
PID 1288 wrote to memory of 1848	1288	303d02331911b47e6840c68a7c2da8bc.exe	33
PID 1288 wrote to memory of 1848	1288	303d02331911b47e6840c68a7c2da8bc.exe	33
PID 1288 wrote to memory of 1848	1288	303d02331911b47e6840c68a7c2da8bc.exe	33

C:\Users\Admin\AppData\Local\Temp\303d02331911b47e6840c68a7c2da8bc.exe
"C:\Users\Admin\AppData\Local\Temp\303d02331911b47e6840c68a7c2da8bc.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe
  "C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:1784
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 160
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 160
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-13-0x0000000000320000-0x0000000000322000-memory.dmp

Download

memory/1288-17-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/1288-16-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/1336-20-0x00000000000E0000-0x0000000000107000-memory.dmp

Download

memory/1336-21-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/1412-15-0x0000000001E30000-0x0000000001E41000-memory.dmp

Download

memory/1412-18-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1848-23-0x0000000001F00000-0x0000000001F11000-memory.dmp

Download

memory/1848-30-0x0000000001D70000-0x0000000001D71000-memory.dmp

Download

memory/1852-4-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1852-5-0x0000000000230000-0x0000000000232000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads