trickbot | 3d4a492b7184c992cb5bfda74b1ff3756346ecc22f21bfec3055dc15dbe4f6cc

Resubmissions

19/08/2021, 14:33

210819-epdlf6km7x10

18/08/2021, 07:19

210818-hxtgktfz3s10

Analysis

max time kernel
1774s
max time network
1817s
platform
windows7_x64
resource
win7v20210410
submitted
19/08/2021, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43b3c7f2167a8d84e2babf0be1dd8ad1.exe
Size 516KB
Sample210819-epdlf6km7x
SHA256 3d4a492b7184c992cb5bfda74b1ff3756346ecc22f21bfec3055dc15dbe4f6cc
MD5 43b3c7f2167a8d84e2babf0be1dd8ad1
SHA1 e6ee644f6401dc1f490fbeafaee90dc513ebd6e1
SHA512 afcb113148183662c34925b5fd1f89cd9f32c4e056512f1d31e4c2b0d292e597c5ce1ed74cbfd36f85fea34c5d7df1582a03ec7f025252f8f7513d37dadb24e6
MD5 SHA1 SHA512

Score

10^/10

trickbot top116 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

top116

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Contacts Bazar domain
Uses Emercoin blockchain domains associated with Bazar backdoor/loader.
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe
1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1980	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	26
PID 1816 wrote to memory of 1980	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	26
PID 1816 wrote to memory of 1980	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	26
PID 1816 wrote to memory of 1980	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	26
PID 1816 wrote to memory of 1364	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	30
PID 1816 wrote to memory of 1364	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	30
PID 1816 wrote to memory of 1364	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	30
PID 1816 wrote to memory of 1364	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	30
PID 1816 wrote to memory of 1980	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	26
PID 1816 wrote to memory of 1980	1816	43b3c7f2167a8d84e2babf0be1dd8ad1.exe	26

C:\Users\Admin\AppData\Local\Temp\43b3c7f2167a8d84e2babf0be1dd8ad1.exe
"C:\Users\Admin\AppData\Local\Temp\43b3c7f2167a8d84e2babf0be1dd8ad1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Download

memory/1816-61-0x0000000000490000-0x00000000004CF000-memory.dmp

Download

memory/1816-65-0x00000000004D0000-0x000000000050A000-memory.dmp

Download

memory/1816-64-0x00000000003C0000-0x00000000003FC000-memory.dmp

Download

memory/1816-66-0x0000000000340000-0x0000000000351000-memory.dmp

Download

memory/1816-67-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/1980-70-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1980-69-0x0000000000060000-0x0000000000089000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads