trickbot | f5a6c24ef3c67f207f67b7d32c1e0af187461760796e2c5bd8a17bb9ffeda8b3

General

Target

b0374a561a84b6685f9ce634afc0b0c3.exe
Size

360KB
MD5

b0374a561a84b6685f9ce634afc0b0c3
SHA1

b9fa7a881ac8d5105daed61f415331e3719ff0b8
SHA256

f5a6c24ef3c67f207f67b7d32c1e0af187461760796e2c5bd8a17bb9ffeda8b3
SHA512

38ecca8436e77720389c9a94a1f23e1fa9ab323c62c8e91a243c16b7f2639307a3e04ad52f656b81466e7ba959ce0753094b80532fcac935b891ed0335886931

Score

10^/10

trickbot lib152 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

lib152

C2

179.42.137.102:443

191.36.152.198:443

179.42.137.104:443

179.42.137.106:443

179.42.137.108:443

202.183.12.124:443

194.190.18.122:443

103.56.207.230:443

171.103.187.218:449

171.103.189.118:449

18.139.111.104:443

179.42.137.105:443

186.4.193.75:443

171.101.229.2:449

179.42.137.107:443

103.56.43.209:449

179.42.137.110:443

45.181.207.156:443

197.44.54.162:449

179.42.137.109:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 checkip.amazonaws.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2000 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b0374a561a84b6685f9ce634afc0b0c3.exe

pid process

1972 b0374a561a84b6685f9ce634afc0b0c3.exe
1972 b0374a561a84b6685f9ce634afc0b0c3.exe

flow	ioc
11	checkip.amazonaws.com

description	pid	process
Token: SeDebugPrivilege	2000	wermgr.exe

pid	process
1972	b0374a561a84b6685f9ce634afc0b0c3.exe
1972	b0374a561a84b6685f9ce634afc0b0c3.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b0374a561a84b6685f9ce634afc0b0c3.exe

description	pid	process	target process
PID 1972 wrote to memory of 2000	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 1972 wrote to memory of 2000	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 1972 wrote to memory of 2000	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 1972 wrote to memory of 2000	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 1972 wrote to memory of 1992	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	cmd.exe
PID 1972 wrote to memory of 1992	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	cmd.exe
PID 1972 wrote to memory of 1992	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	cmd.exe
PID 1972 wrote to memory of 1992	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	cmd.exe
PID 1972 wrote to memory of 2000	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 1972 wrote to memory of 2000	1972	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\b0374a561a84b6685f9ce634afc0b0c3.exe
"C:\Users\Admin\AppData\Local\Temp\b0374a561a84b6685f9ce634afc0b0c3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-60-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/1972-63-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1972-64-0x0000000000360000-0x000000000039D000-memory.dmp

Filesize
244KB

Download
memory/1972-65-0x0000000001F40000-0x0000000001F7B000-memory.dmp

Filesize
236KB

Download
memory/1972-67-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/1972-66-0x00000000003D0000-0x00000000003E1000-memory.dmp

Filesize
68KB

Download
memory/2000-68-0x0000000000000000-mapping.dmp

Download
memory/2000-69-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download
memory/2000-70-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing