trickbot | f5a6c24ef3c67f207f67b7d32c1e0af187461760796e2c5bd8a17bb9ffeda8b3

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
24-09-2021 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0374a561a84b6685f9ce634afc0b0c3.exe
Size

360KB
MD5

b0374a561a84b6685f9ce634afc0b0c3
SHA1

b9fa7a881ac8d5105daed61f415331e3719ff0b8
SHA256

f5a6c24ef3c67f207f67b7d32c1e0af187461760796e2c5bd8a17bb9ffeda8b3
SHA512

38ecca8436e77720389c9a94a1f23e1fa9ab323c62c8e91a243c16b7f2639307a3e04ad52f656b81466e7ba959ce0753094b80532fcac935b891ed0335886931

Score

10^/10

trickbot lib152 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

lib152

179.42.137.102:443

191.36.152.198:443

179.42.137.104:443

179.42.137.106:443

179.42.137.108:443

202.183.12.124:443

194.190.18.122:443

103.56.207.230:443

171.103.187.218:449

171.103.189.118:449

18.139.111.104:443

179.42.137.105:443

186.4.193.75:443

171.101.229.2:449

179.42.137.107:443

103.56.43.209:449

179.42.137.110:443

45.181.207.156:443

197.44.54.162:449

179.42.137.109:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

29 myexternalip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2620 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b0374a561a84b6685f9ce634afc0b0c3.exe

pid process

2160 b0374a561a84b6685f9ce634afc0b0c3.exe
2160 b0374a561a84b6685f9ce634afc0b0c3.exe

flow	ioc
29	myexternalip.com

description	pid	process
Token: SeDebugPrivilege	2620	wermgr.exe

pid	process
2160	b0374a561a84b6685f9ce634afc0b0c3.exe
2160	b0374a561a84b6685f9ce634afc0b0c3.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b0374a561a84b6685f9ce634afc0b0c3.exe

description	pid	process	target process
PID 2160 wrote to memory of 2620	2160	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 2160 wrote to memory of 2620	2160	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 2160 wrote to memory of 2672	2160	b0374a561a84b6685f9ce634afc0b0c3.exe	cmd.exe
PID 2160 wrote to memory of 2672	2160	b0374a561a84b6685f9ce634afc0b0c3.exe	cmd.exe
PID 2160 wrote to memory of 2620	2160	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe
PID 2160 wrote to memory of 2620	2160	b0374a561a84b6685f9ce634afc0b0c3.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\b0374a561a84b6685f9ce634afc0b0c3.exe
"C:\Users\Admin\AppData\Local\Temp\b0374a561a84b6685f9ce634afc0b0c3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-115-0x0000000002BF0000-0x0000000002C30000-memory.dmp

Filesize
256KB

Download
memory/2160-118-0x0000000002BB0000-0x0000000002BED000-memory.dmp

Filesize
244KB

Download
memory/2160-119-0x0000000002C30000-0x0000000002C6B000-memory.dmp

Filesize
236KB

Download
memory/2160-120-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2160-121-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/2620-122-0x0000000000000000-mapping.dmp

Download
memory/2620-123-0x0000022ED5D00000-0x0000022ED5D29000-memory.dmp

Filesize
164KB

Download
memory/2620-124-0x0000022ED5E10000-0x0000022ED5E11000-memory.dmp

Filesize
4KB

Download