trickbot | 7eb249792f19ccda8dd4ad4a1b9e586de58112552a410ae98a9d3280fc02610d

Analysis

max time kernel
120s
max time network
139s
platform
windows10_x64
resource
win10v20210410
submitted
23/07/2021, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbbb1677bbbacdadc18142fff76a3902.exe
Size 756KB
Sample210723-579clherj6
SHA256 7eb249792f19ccda8dd4ad4a1b9e586de58112552a410ae98a9d3280fc02610d
MD5 dbbb1677bbbacdadc18142fff76a3902
SHA1 184bfb2136425d91a554c2f19113f370629216b9
SHA512 fa800ec2a7fbfe3932dcc032d2aabf38e1727c875b5cc18a56fbc14c56953908898a961b1f674448f7ec8ca2c1013a55c4de7a47d5faf10f47096c54c7d8c55e
MD5 SHA1 SHA512

Score

10^/10

trickbot rob111 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

rob111

38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	icanhazip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3164	dbbb1677bbbacdadc18142fff76a3902.exe
3164	dbbb1677bbbacdadc18142fff76a3902.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 2108	3164	dbbb1677bbbacdadc18142fff76a3902.exe	79
PID 3164 wrote to memory of 2108	3164	dbbb1677bbbacdadc18142fff76a3902.exe	79
PID 3164 wrote to memory of 3128	3164	dbbb1677bbbacdadc18142fff76a3902.exe	80
PID 3164 wrote to memory of 3128	3164	dbbb1677bbbacdadc18142fff76a3902.exe	80
PID 3164 wrote to memory of 3128	3164	dbbb1677bbbacdadc18142fff76a3902.exe	80
PID 3164 wrote to memory of 3128	3164	dbbb1677bbbacdadc18142fff76a3902.exe	80

C:\Users\Admin\AppData\Local\Temp\dbbb1677bbbacdadc18142fff76a3902.exe
"C:\Users\Admin\AppData\Local\Temp\dbbb1677bbbacdadc18142fff76a3902.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2108
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3128-122-0x00000221721E0000-0x0000022172209000-memory.dmp

Download

memory/3128-123-0x0000022172220000-0x0000022172221000-memory.dmp

Download

memory/3164-114-0x00000000024D0000-0x0000000002511000-memory.dmp

Download

memory/3164-117-0x0000000002280000-0x00000000022BF000-memory.dmp

Download

memory/3164-118-0x00000000022C0000-0x00000000022FD000-memory.dmp

Download

memory/3164-119-0x0000000002540000-0x0000000002541000-memory.dmp

Download

memory/3164-120-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads