trickbot | 2f1a6b566dc0d2b8e5fcdcf67adc0be912f73fe14c27b262b610dfcd03cd4686

Analysis

max time kernel
147s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads1/7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe
Size

441KB
MD5

ba722f76070e001e44c82998b66e9009
SHA1

98136a5f534249449b02528fc0c51be147dca4c8
SHA256

7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a
SHA512

1e805401f9166d53012a342bdbd9eba1253d9374af52440616f615d4e3aa2a9996f40398ca9c60e504e17f19029533445c3feca0900ff45339a37630932c6934

Score

10^/10

trickbot kas89 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000089

Botnet

kas89

187.188.162.150:449

83.0.245.234:449

149.154.68.252:443

62.109.11.80:443

78.24.218.150:443

92.63.97.68:443

82.146.61.187:443

80.87.199.210:443

82.146.59.149:443

188.120.247.223:443

94.250.250.112:443

149.154.71.95:443

37.230.112.76:443

94.250.250.114:443

95.213.237.223:443

185.228.232.242:443

141.255.167.126:443

5.200.47.90:443

185.158.114.126:443

185.125.46.113:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 2 IoCs

Processes:

7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

pid	process
3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
3524	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 icanhazip.com
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe

flow	ioc
14	icanhazip.com

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

description	pid	process	target process
PID 1196 wrote to memory of 3796	1196	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
PID 1196 wrote to memory of 3796	1196	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
PID 1196 wrote to memory of 3796	1196	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 3796 wrote to memory of 2772	3796	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Downloads1\7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads1\7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796

C:\Windows\SYSTEM32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:2772

C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
2⤵
- Modifies data under HKEY_USERS
PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
MD5
ba722f76070e001e44c82998b66e9009

SHA1
98136a5f534249449b02528fc0c51be147dca4c8

SHA256
7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a

SHA512
1e805401f9166d53012a342bdbd9eba1253d9374af52440616f615d4e3aa2a9996f40398ca9c60e504e17f19029533445c3feca0900ff45339a37630932c6934

Download Submit
C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
MD5
ba722f76070e001e44c82998b66e9009

SHA1
98136a5f534249449b02528fc0c51be147dca4c8

SHA256
7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a

SHA512
1e805401f9166d53012a342bdbd9eba1253d9374af52440616f615d4e3aa2a9996f40398ca9c60e504e17f19029533445c3feca0900ff45339a37630932c6934

Download Submit
C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
MD5
ba722f76070e001e44c82998b66e9009

SHA1
98136a5f534249449b02528fc0c51be147dca4c8

SHA256
7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a

SHA512
1e805401f9166d53012a342bdbd9eba1253d9374af52440616f615d4e3aa2a9996f40398ca9c60e504e17f19029533445c3feca0900ff45339a37630932c6934

Download Submit
memory/1196-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1196-3-0x0000000000520000-0x0000000000523000-memory.dmp

Filesize
12KB

Download
memory/2772-9-0x0000000000000000-mapping.dmp

Download
memory/2772-10-0x0000000140000000-0x0000000140021000-memory.dmp

Filesize
132KB

Download
memory/2772-13-0x0000023C20F10000-0x0000023C20F11000-memory.dmp

Filesize
4KB

Download
memory/3520-17-0x0000000000000000-mapping.dmp

Download
memory/3524-20-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/3796-8-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3796-12-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/3796-4-0x0000000000000000-mapping.dmp

Download