trickbot | e9c98bff81ba5138f040cef7acbcb56f0f80abcf41ecf4893d4700e308f6427a

Analysis

max time kernel
143s
max time network
145s
platform
windows10_x64
resource
win10v20210408
submitted
04/05/2021, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f0e0f15_by_Libranalysis.exe
Size 520KB
Sample210504-75lbvmqj2n
SHA256 e9c98bff81ba5138f040cef7acbcb56f0f80abcf41ecf4893d4700e308f6427a
MD5 5f0e0f1511af373e889e1b5d479aa3e7
SHA1 abd62078830a775b96d2818678284636c4541370
SHA512 64d8b9b9148e0bac0d7acb6f997b00c09deea50d5c1f0b42c958fa3a7c6d554bc26caeedcf8da4c98e35e3928755b6973c14f488d81f55858cd1ad95bf979158
MD5 SHA1 SHA512

Score

10^/10

trickbot ono23 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000480

Botnet

ono23

144.91.79.9:443
172.245.97.148:443
85.204.116.139:443
185.62.188.117:443
185.222.202.76:443
144.91.79.12:443
185.68.93.43:443
195.123.238.191:443
146.185.219.29:443
195.133.196.151:443
91.235.129.60:443
23.227.206.170:443
185.222.202.192:443
190.154.203.218:449
178.183.150.169:449
200.116.199.10:449
187.58.56.26:449
177.103.240.149:449
81.190.160.139:449
200.21.51.38:449
181.49.61.237:449
46.174.235.36:449
36.89.85.103:449
170.233.120.53:449
89.228.243.148:449
31.214.138.207:449
186.42.98.254:449
195.93.223.100:449
181.112.52.26:449
190.13.160.19:449
186.71.150.23:449
190.152.4.98:449
170.82.156.53:449
131.161.253.190:449
200.127.121.99:449
45.235.213.126:449
31.128.13.45:449
181.10.207.234:449
201.187.105.123:449
201.210.120.239:449
190.152.125.22:449
103.69.216.86:449
128.201.174.107:449
101.108.92.111:449
190.111.255.219:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3424-117-0x0000000002270000-0x000000000229E000-memory.dmp	trickbot_loader32
behavioral2/memory/3424-118-0x0000000002240000-0x000000000226C000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
3424	аНаоすは래별.exe
1320	аНаоすは래별.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	1540	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
636	5f0e0f15_by_Libranalysis.exe
636	5f0e0f15_by_Libranalysis.exe
3424	аНаоすは래별.exe
3424	аНаоすは래별.exe
1320	аНаоすは래별.exe
1320	аНаоすは래별.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3424	636	5f0e0f15_by_Libranalysis.exe	75
PID 636 wrote to memory of 3424	636	5f0e0f15_by_Libranalysis.exe	75
PID 636 wrote to memory of 3424	636	5f0e0f15_by_Libranalysis.exe	75
PID 3424 wrote to memory of 1780	3424	аНаоすは래별.exe	79
PID 3424 wrote to memory of 1780	3424	аНаоすは래별.exe	79
PID 3424 wrote to memory of 1780	3424	аНаоすは래별.exe	79
PID 3424 wrote to memory of 1780	3424	аНаоすは래별.exe	79
PID 1320 wrote to memory of 1540	1320	аНаоすは래별.exe	81
PID 1320 wrote to memory of 1540	1320	аНаоすは래별.exe	81
PID 1320 wrote to memory of 1540	1320	аНаоすは래별.exe	81
PID 1320 wrote to memory of 1540	1320	аНаоすは래별.exe	81

C:\Users\Admin\AppData\Local\Temp\5f0e0f15_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\5f0e0f15_by_Libranalysis.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636
- C:\ProgramData\аНаоすは래별.exe
  "C:\ProgramData\аНаоすは래별.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1780

C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-132-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/1320-128-0x0000000000470000-0x00000000005BA000-memory.dmp

Download

memory/1540-134-0x0000016A2BA10000-0x0000016A2BA2E000-memory.dmp

Download

memory/1780-124-0x000001398C680000-0x000001398C69E000-memory.dmp

Download

memory/3424-117-0x0000000002270000-0x000000000229E000-memory.dmp

Download

memory/3424-122-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/3424-123-0x0000000010001000-0x0000000010005000-memory.dmp

Download

memory/3424-118-0x0000000002240000-0x000000000226C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads