trickbot | 49545cccf16c4586e4f80d64ad4109a117894a1c930effdffef3d808593af53c

General

Target
303d02331911b47e6840c68a7c2da8bc.exe
Size 400KB
Sample210203-rtjmrdrd6a
SHA256 49545cccf16c4586e4f80d64ad4109a117894a1c930effdffef3d808593af53c
MD5 303d02331911b47e6840c68a7c2da8bc
SHA1 a46091201da60190b931e1f4e7b6b5f5dfb177a9
SHA512 7112b506c62467d78afb75327fce1182e17877011535f532359ef5f33ee92628501c47b5da8a431d9608b7d61f61a96e1b876c951e26892c992140ba8bcd7701
MD5 SHA1 SHA512

Score

10^/10

trickbot tot33 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000024

Botnet

tot33

C2

85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
3640	303d02331911b47e6840c68a7c2da8bc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe	303d02331911b47e6840c68a7c2da8bc.exe
File opened for modification	C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe	303d02331911b47e6840c68a7c2da8bc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1736	4704	WerFault.exe	67
648	3640	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1736	WerFault.exe
Token: SeBackupPrivilege	1736	WerFault.exe
Token: SeDebugPrivilege	1736	WerFault.exe
Token: SeDebugPrivilege	1644	wermgr.exe
Token: SeDebugPrivilege	648	WerFault.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4704	303d02331911b47e6840c68a7c2da8bc.exe
3640	303d02331911b47e6840c68a7c2da8bc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3640	4704	303d02331911b47e6840c68a7c2da8bc.exe	75
PID 4704 wrote to memory of 3640	4704	303d02331911b47e6840c68a7c2da8bc.exe	75
PID 4704 wrote to memory of 3640	4704	303d02331911b47e6840c68a7c2da8bc.exe	75
PID 3640 wrote to memory of 1992	3640	303d02331911b47e6840c68a7c2da8bc.exe	76
PID 3640 wrote to memory of 1992	3640	303d02331911b47e6840c68a7c2da8bc.exe	76
PID 3640 wrote to memory of 1644	3640	303d02331911b47e6840c68a7c2da8bc.exe	80
PID 3640 wrote to memory of 1644	3640	303d02331911b47e6840c68a7c2da8bc.exe	80
PID 3640 wrote to memory of 1644	3640	303d02331911b47e6840c68a7c2da8bc.exe	80
PID 3640 wrote to memory of 1644	3640	303d02331911b47e6840c68a7c2da8bc.exe	80

C:\Users\Admin\AppData\Local\Temp\303d02331911b47e6840c68a7c2da8bc.exe
"C:\Users\Admin\AppData\Local\Temp\303d02331911b47e6840c68a7c2da8bc.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe
  "C:\Program Files (x86)\DC\303d02331911b47e6840c68a7c2da8bc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:1992
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 412
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 396
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-17-0x00000000047C0000-0x00000000047C1000-memory.dmp

Download

memory/648-20-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/648-18-0x00000000047C0000-0x00000000047C1000-memory.dmp

Download

memory/1644-16-0x000002386D0D0000-0x000002386D0D1000-memory.dmp

Download

memory/1644-15-0x000002386D090000-0x000002386D0B7000-memory.dmp

Download

memory/1736-11-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download

memory/3640-12-0x0000000002110000-0x0000000002111000-memory.dmp

Download

memory/3640-13-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/3640-10-0x00000000006E0000-0x00000000006E2000-memory.dmp

Download

memory/4704-4-0x00000000021C0000-0x00000000021C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads