trickbot | f90aeb669c32ed6f1009101cc3c071a840f25c7828035601e92f4e17cd95b606

General

Target

96c0510d34060e7b74c20b910baf2b62.exe
Size

740KB
MD5

96c0510d34060e7b74c20b910baf2b62
SHA1

1fb3859948022451d9f8a7c83d154205692b6485
SHA256

f90aeb669c32ed6f1009101cc3c071a840f25c7828035601e92f4e17cd95b606
SHA512

7650bc8a1e9c88cc0d8ac61b7cea8f10b0031022b246414fcc7eb63e551efff81094bb53a88e1abfbdd7b5f8d655676d9b292a7d3fab2ab1cea76e3c17c7afb4

Score

10^/10

trickbot tot96 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000029

Botnet

tot96

C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2264 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

96c0510d34060e7b74c20b910baf2b62.exe

pid process

1456 96c0510d34060e7b74c20b910baf2b62.exe
1456 96c0510d34060e7b74c20b910baf2b62.exe

flow	ioc
21	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	2264	wermgr.exe

pid	process
1456	96c0510d34060e7b74c20b910baf2b62.exe
1456	96c0510d34060e7b74c20b910baf2b62.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

96c0510d34060e7b74c20b910baf2b62.exe

description	pid	process	target process
PID 1456 wrote to memory of 2184	1456	96c0510d34060e7b74c20b910baf2b62.exe	cmd.exe
PID 1456 wrote to memory of 2184	1456	96c0510d34060e7b74c20b910baf2b62.exe	cmd.exe
PID 1456 wrote to memory of 360	1456	96c0510d34060e7b74c20b910baf2b62.exe	cmd.exe
PID 1456 wrote to memory of 360	1456	96c0510d34060e7b74c20b910baf2b62.exe	cmd.exe
PID 1456 wrote to memory of 2264	1456	96c0510d34060e7b74c20b910baf2b62.exe	wermgr.exe
PID 1456 wrote to memory of 2264	1456	96c0510d34060e7b74c20b910baf2b62.exe	wermgr.exe
PID 1456 wrote to memory of 2264	1456	96c0510d34060e7b74c20b910baf2b62.exe	wermgr.exe
PID 1456 wrote to memory of 2264	1456	96c0510d34060e7b74c20b910baf2b62.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\96c0510d34060e7b74c20b910baf2b62.exe
"C:\Users\Admin\AppData\Local\Temp\96c0510d34060e7b74c20b910baf2b62.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:360
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-114-0x0000000002390000-0x00000000023CF000-memory.dmp

Filesize
252KB

Download
memory/1456-117-0x0000000000580000-0x00000000006CA000-memory.dmp

Filesize
1.3MB

Download
memory/1456-118-0x00000000023F1000-0x000000000242A000-memory.dmp

Filesize
228KB

Download
memory/1456-120-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/2264-121-0x0000000000000000-mapping.dmp

Download
memory/2264-123-0x000001D88A340000-0x000001D88A341000-memory.dmp

Filesize
4KB

Download
memory/2264-122-0x000001D88A230000-0x000001D88A259000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing