trickbot | 2c9592deb9c856d1a3f00a3436b85497ebd49e3192076e125b37c6ee755ce796

General

Target
3644b3a45129a1b176958c2a3d0cc336.exe
Size 632KB
Sample210207-32rhxe7fna
SHA256 2c9592deb9c856d1a3f00a3436b85497ebd49e3192076e125b37c6ee755ce796
MD5 3644b3a45129a1b176958c2a3d0cc336
SHA1 6e08fdd527e5b0e256f0abc7a6bab46a95f2df86
SHA512 287f87da6eb8056e390ca762ac5cd3a2dfebe4dd7f44c6cef171aa48a5e0b8284343b7575869b5430aa2836f6fd28fb76bee666603d2b87c3674b21af5a65dcc
MD5 SHA1 SHA512

Score

10^/10

trickbot tot36 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000024

Botnet

tot36

C2

85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
3144	3644b3a45129a1b176958c2a3d0cc336.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe	3644b3a45129a1b176958c2a3d0cc336.exe
File opened for modification	C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe	3644b3a45129a1b176958c2a3d0cc336.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4704	3644b3a45129a1b176958c2a3d0cc336.exe
3144	3644b3a45129a1b176958c2a3d0cc336.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3144	4704	3644b3a45129a1b176958c2a3d0cc336.exe	78
PID 4704 wrote to memory of 3144	4704	3644b3a45129a1b176958c2a3d0cc336.exe	78
PID 4704 wrote to memory of 3144	4704	3644b3a45129a1b176958c2a3d0cc336.exe	78
PID 3144 wrote to memory of 4188	3144	3644b3a45129a1b176958c2a3d0cc336.exe	79
PID 3144 wrote to memory of 4188	3144	3644b3a45129a1b176958c2a3d0cc336.exe	79
PID 3144 wrote to memory of 3848	3144	3644b3a45129a1b176958c2a3d0cc336.exe	80
PID 3144 wrote to memory of 3848	3144	3644b3a45129a1b176958c2a3d0cc336.exe	80
PID 3144 wrote to memory of 3848	3144	3644b3a45129a1b176958c2a3d0cc336.exe	80
PID 3144 wrote to memory of 3848	3144	3644b3a45129a1b176958c2a3d0cc336.exe	80

C:\Users\Admin\AppData\Local\Temp\3644b3a45129a1b176958c2a3d0cc336.exe
"C:\Users\Admin\AppData\Local\Temp\3644b3a45129a1b176958c2a3d0cc336.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe
  "C:\Program Files (x86)\DC\3644b3a45129a1b176958c2a3d0cc336.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:4188
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-10-0x0000000000630000-0x0000000000632000-memory.dmp

Download

memory/3144-12-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/3144-11-0x00000000020E0000-0x00000000020E1000-memory.dmp

Download

memory/3848-15-0x000001E05E680000-0x000001E05E681000-memory.dmp

Download

memory/3848-14-0x000001E05E570000-0x000001E05E597000-memory.dmp

Download

memory/4704-4-0x00000000021E0000-0x00000000021E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads