Overview

overview

10

Static

static

002360c170...5f.exe

windows7_x64

10

002360c170...5f.exe

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    159s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23/06/2021, 07:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    002360c17019f200acf4bac7f476c15f.exe
  • Size 864KB
  • Sample210623-4ye7b89c32
  • SHA256 cddb1b13c923f3c748425be6d91a06b3a64ca16b4deb1f322b47decd2b37b93e
  • MD5 SHA1 SHA512
Score
10/10
trickbottot113bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 2000030

Botnet

  • tot113

C2

  • 196.43.106.38:443

  • 186.97.172.178:443

  • 37.228.70.134:443

  • 144.48.139.206:443

  • 190.110.179.139:443

  • 172.105.15.152:443

  • 177.67.137.111:443

  • 27.72.107.215:443

  • 186.66.15.10:443

  • 189.206.78.155:443

  • 202.131.227.229:443

  • 185.9.187.10:443

  • 196.41.57.46:443

  • 212.200.25.118:443

  • 197.254.14.238:443

  • 45.229.71.211:443

  • 181.167.217.53:443

  • 181.129.116.58:443

  • 185.189.55.207:443

  • 172.104.241.29:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\002360c17019f200acf4bac7f476c15f.exe
    "C:\Users\Admin\AppData\Local\Temp\002360c17019f200acf4bac7f476c15f.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      2⤵
        PID:784
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe
        2⤵
          PID:1688
        • C:\Windows\system32\wermgr.exe
          C:\Windows\system32\wermgr.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1828

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1828-121-0x0000023A80C10000-0x0000023A80C39000-memory.dmp
            Download

            memory/1828-122-0x0000023A80C50000-0x0000023A80C51000-memory.dmp
            Download

            memory/3896-114-0x0000000003A40000-0x0000000003A7F000-memory.dmp
            Download

            memory/3896-117-0x00000000021F0000-0x000000000222D000-memory.dmp
            Download

            memory/3896-118-0x00000000004E0000-0x000000000058E000-memory.dmp
            Download

            memory/3896-119-0x0000000010001000-0x0000000010003000-memory.dmp
            Download