trickbot | 083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918

Target

1f5033d76b72ff259bf0d7ab33725141.dll
Size

700KB
MD5

1f5033d76b72ff259bf0d7ab33725141
SHA1

a827a2e9e2072ae57420a22f469e7053de62ea97
SHA256

083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918
SHA512

b771c7230a9757703cf6c13714ab4a34e1135028df520fbba43e7d19d731c6b257d00e4791f44191390392d1e39ef5b3d897a1225ff95fa1e16c2253ade92fca

Score

10^/10

trickbot mon311 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100017

Botnet

mon311

178.72.192.20:443

103.124.145.98:443

45.5.152.39:443

114.7.240.222:443

85.248.1.126:443

94.183.237.101:443

146.196.121.219:443

89.37.1.2:443

94.142.179.77:443

177.221.39.161:443

85.175.171.246:443

103.12.160.164:443

180.178.106.50:443

94.142.179.179:443

46.209.140.220:443

123.231.149.122:443

123.231.149.123:443

182.160.116.190:443

131.0.112.122:443

116.0.6.110:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 wtfismyip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1892 wermgr.exe

flow	ioc
10	wtfismyip.com

description	pid	process
Token: SeDebugPrivilege	1892	wermgr.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1640 wrote to memory of 1560	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 1560	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 1560	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 1560	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 1560	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 1560	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 1560	1640	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	cmd.exe
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	cmd.exe
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	cmd.exe
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	cmd.exe
PID 1560 wrote to memory of 1892	1560	regsvr32.exe	wermgr.exe
PID 1560 wrote to memory of 1892	1560	regsvr32.exe	wermgr.exe
PID 1560 wrote to memory of 1892	1560	regsvr32.exe	wermgr.exe
PID 1560 wrote to memory of 1892	1560	regsvr32.exe	wermgr.exe
PID 1560 wrote to memory of 1892	1560	regsvr32.exe	wermgr.exe
PID 1560 wrote to memory of 1892	1560	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f5033d76b72ff259bf0d7ab33725141.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1f5033d76b72ff259bf0d7ab33725141.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
3⤵
PID:1952

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-68-0x00000000007B0000-0x00000000007E8000-memory.dmp

Filesize
224KB

Download
memory/1560-60-0x0000000000000000-mapping.dmp

Download
memory/1560-61-0x00000000769B1000-0x00000000769B3000-memory.dmp

Filesize
8KB

Download
memory/1560-62-0x00000000001D0000-0x000000000020B000-memory.dmp

Filesize
236KB

Download
memory/1560-65-0x0000000000170000-0x00000000001A9000-memory.dmp

Filesize
228KB

Download
memory/1560-66-0x00000000004E0000-0x0000000000519000-memory.dmp

Filesize
228KB

Download
memory/1560-71-0x0000000001F80000-0x0000000001FC3000-memory.dmp

Filesize
268KB

Download
memory/1560-72-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/1560-73-0x0000000000371000-0x0000000000373000-memory.dmp

Filesize
8KB

Download
memory/1640-59-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp

Filesize
8KB

Download
memory/1892-70-0x0000000000000000-mapping.dmp

Download
memory/1892-74-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/1892-75-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download