trickbot | 28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e

Resubmissions

25-07-2021 16:11

210725-slk5lqhnmj 10

25-07-2021 09:40

210725-87qwjh3mrs 10

Analysis

max time kernel
1697s
max time network
1792s
platform
windows10_x64
resource
win10v20210408
submitted
25-07-2021 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe
Size

756KB
MD5

42b2c552fad417b6e98e8a44e0f6b993
SHA1

db83dc775dcf2ab58acbbcdb0cef741f4ca963f9
SHA256

28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e
SHA512

38430652faa1b76448e6dace965caa97817102ce852da1fceec63fa5ab717f8f544b185b80f2c71821fdc834468664fea547ee55f1cc4cbe9063d4225f60b2dd

Score

10^/10

trickbot rob111 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

rob111

38.110.103.124:443

185.56.76.28:443

204.138.26.60:443

60.51.47.65:443

74.85.157.139:443

68.69.26.182:443

38.110.103.136:443

38.110.103.18:443

138.34.28.219:443

185.56.76.94:443

217.115.240.248:443

24.162.214.166:443

80.15.2.105:443

154.58.23.192:443

38.110.100.104:443

45.36.99.184:443

185.56.76.108:443

185.56.76.72:443

138.34.28.35:443

97.83.40.67:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

31 ipinfo.io
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2720 wermgr.exe

flow	ioc
31	ipinfo.io

description	pid	process
Token: SeDebugPrivilege	2720	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe

pid	process
640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe
640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe

description	pid	process	target process
PID 640 wrote to memory of 2028	640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe	cmd.exe
PID 640 wrote to memory of 2028	640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe	cmd.exe
PID 640 wrote to memory of 2720	640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe	wermgr.exe
PID 640 wrote to memory of 2720	640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe	wermgr.exe
PID 640 wrote to memory of 2720	640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe	wermgr.exe
PID 640 wrote to memory of 2720	640	28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe
"C:\Users\Admin\AppData\Local\Temp\28a03c490f1c8cdb0e8baaf0843e0202a7f9158bdd1a4b69eedeed925189282e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:2028

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-114-0x0000000002610000-0x0000000002651000-memory.dmp

Filesize
260KB

Download
memory/640-117-0x0000000002400000-0x000000000243F000-memory.dmp

Filesize
252KB

Download
memory/640-118-0x0000000002660000-0x000000000269D000-memory.dmp

Filesize
244KB

Download
memory/640-119-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/640-120-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/2720-121-0x0000000000000000-mapping.dmp

Download
memory/2720-123-0x0000020538030000-0x0000020538031000-memory.dmp

Filesize
4KB

Download
memory/2720-122-0x0000020537FF0000-0x0000020538019000-memory.dmp

Filesize
164KB

Download