trickbot | fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898

Target
In-zoomConference.exe
Size 451KB
Sample210920-t4eawaeeh2
SHA256 fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898
MD5 34f19a097d7799afab80ff9d723cc552
SHA1 285229d0b36440af66ebeef9f14bfa2f1be476b8
SHA512 388d1fb5fe4070ffda4380fa61784c916266a655a759971776b82f49a50f6f81ad719526871cc5c67a9480a8f44e2ba975534d8e4c725928f7d810c52179ae15
MD5 SHA1 SHA512

Score

10^/10

trickbot rob132 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob132

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3184	2668	In-zoomConference.exe	70
PID 2668 wrote to memory of 3184	2668	In-zoomConference.exe	70
PID 2668 wrote to memory of 3160	2668	In-zoomConference.exe	71
PID 2668 wrote to memory of 3160	2668	In-zoomConference.exe	71
PID 2668 wrote to memory of 3160	2668	In-zoomConference.exe	71
PID 2668 wrote to memory of 3160	2668	In-zoomConference.exe	71

C:\Users\Admin\AppData\Local\Temp\In-zoomConference.exe
"C:\Users\Admin\AppData\Local\Temp\In-zoomConference.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3184
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-115-0x0000000000160000-0x000000000019D000-memory.dmp

Download

memory/2668-116-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/2668-117-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/3160-120-0x0000028076BC0000-0x0000028076BC1000-memory.dmp

Download

memory/3160-119-0x0000028076AB0000-0x0000028076AD9000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads