trickbot | 2c9592deb9c856d1a3f00a3436b85497ebd49e3192076e125b37c6ee755ce796

General

Target
3644b3a45129a1b176958c2a3d0cc336.exe
Size 632KB
Sample210207-32rhxe7fna
SHA256 2c9592deb9c856d1a3f00a3436b85497ebd49e3192076e125b37c6ee755ce796
MD5 3644b3a45129a1b176958c2a3d0cc336
SHA1 6e08fdd527e5b0e256f0abc7a6bab46a95f2df86
SHA512 287f87da6eb8056e390ca762ac5cd3a2dfebe4dd7f44c6cef171aa48a5e0b8284343b7575869b5430aa2836f6fd28fb76bee666603d2b87c3674b21af5a65dcc
MD5 SHA1 SHA512

Score

10^/10

trickbot tot36 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000024

Botnet

tot36

C2

85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
1568	3644b3a45129a1b176958c2a3d0cc336.exe

Loads dropped DLL 2 IoCs

pid	Process
792	3644b3a45129a1b176958c2a3d0cc336.exe
792	3644b3a45129a1b176958c2a3d0cc336.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe	3644b3a45129a1b176958c2a3d0cc336.exe
File opened for modification	C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe	3644b3a45129a1b176958c2a3d0cc336.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
792	3644b3a45129a1b176958c2a3d0cc336.exe
1568	3644b3a45129a1b176958c2a3d0cc336.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1568	792	3644b3a45129a1b176958c2a3d0cc336.exe	29
PID 792 wrote to memory of 1568	792	3644b3a45129a1b176958c2a3d0cc336.exe	29
PID 792 wrote to memory of 1568	792	3644b3a45129a1b176958c2a3d0cc336.exe	29
PID 792 wrote to memory of 1568	792	3644b3a45129a1b176958c2a3d0cc336.exe	29
PID 1568 wrote to memory of 1548	1568	3644b3a45129a1b176958c2a3d0cc336.exe	30
PID 1568 wrote to memory of 1548	1568	3644b3a45129a1b176958c2a3d0cc336.exe	30
PID 1568 wrote to memory of 1548	1568	3644b3a45129a1b176958c2a3d0cc336.exe	30
PID 1568 wrote to memory of 1548	1568	3644b3a45129a1b176958c2a3d0cc336.exe	30
PID 1568 wrote to memory of 900	1568	3644b3a45129a1b176958c2a3d0cc336.exe	31
PID 1568 wrote to memory of 900	1568	3644b3a45129a1b176958c2a3d0cc336.exe	31
PID 1568 wrote to memory of 900	1568	3644b3a45129a1b176958c2a3d0cc336.exe	31
PID 1568 wrote to memory of 900	1568	3644b3a45129a1b176958c2a3d0cc336.exe	31
PID 1568 wrote to memory of 900	1568	3644b3a45129a1b176958c2a3d0cc336.exe	31
PID 1568 wrote to memory of 900	1568	3644b3a45129a1b176958c2a3d0cc336.exe	31

C:\Users\Admin\AppData\Local\Temp\3644b3a45129a1b176958c2a3d0cc336.exe
"C:\Users\Admin\AppData\Local\Temp\3644b3a45129a1b176958c2a3d0cc336.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792
- C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe
  "C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:1548
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-5-0x0000000000240000-0x0000000000242000-memory.dmp

Download

memory/792-4-0x00000000765E1000-0x00000000765E3000-memory.dmp

Download

memory/792-14-0x00000000004B0000-0x00000000004B4000-memory.dmp

Download

memory/792-15-0x00000000028F0000-0x00000000028F4000-memory.dmp

Download

memory/900-20-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/900-19-0x0000000000060000-0x0000000000087000-memory.dmp

Download

memory/1568-17-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/1568-16-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/1568-21-0x0000000001CF0000-0x0000000001CF4000-memory.dmp

Download

memory/1568-22-0x00000000026A0000-0x00000000026A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads