Overview

overview

10

Static

static

SecuriteIn...16.exe

windows7_x64

10

SecuriteIn...16.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    07/04/2021, 22:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.W32.AIDetect.malware2.15740.10016.exe
  • Size 532KB
  • Sample210407-vx4fx8s8bj
  • SHA256 088d508c5f4509185682108b422dcce6d1ca6ce82258f1340ab4e330da067b22
  • MD5 SHA1 SHA512
Score
10/10
trickbotyas58bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 100015

Botnet

  • yas58

C2

  • 67.48.36.18:449

  • 46.254.128.174:449

  • 41.216.166.142:449

  • 181.143.251.154:449

  • 77.232.163.203:449

  • 87.97.178.92:449

  • 185.94.172.15:449

  • 185.230.5.43:443

  • 91.243.125.5:443

  • 185.242.168.118:443

  • 201.23.76.18:443

  • 180.178.109.222:443

  • 202.131.227.229:443

  • 163.53.83.117:443

  • 45.235.5.162:443

  • 185.189.55.207:449

  • 103.36.48.159:449

  • 168.253.208.234:449

  • 41.60.233.170:449

  • 170.79.181.188:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.15740.10016.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.15740.10016.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      2⤵
        PID:3996
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3468

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/3152-2-0x0000000000490000-0x00000000004CC000-memory.dmp
          Download

          memory/3152-3-0x00000000004D0000-0x00000000004D1000-memory.dmp
          Download

          memory/3152-4-0x0000000010001000-0x0000000010003000-memory.dmp
          Download

          memory/3468-7-0x000001C2C4EC0000-0x000001C2C4EC1000-memory.dmp
          Download

          memory/3468-6-0x000001C2C4CB0000-0x000001C2C4CD9000-memory.dmp
          Download