trickbot | e8f75b721aac3341f4dd3a258ec5b4f4beeab809815a20534942acf49e6ebba4

General

Target

0cef107c35c2e6888cf815c5d9f54935.exe
Size

580KB
MD5

0cef107c35c2e6888cf815c5d9f54935
SHA1

19c79a424243d9e386dd0c5e710bb82fba55f0cb
SHA256

e8f75b721aac3341f4dd3a258ec5b4f4beeab809815a20534942acf49e6ebba4
SHA512

95b5693c25250caa695c66c16e8ce9251d8bbc8f9c46d30243326e5f4df8f121c10619a736afbb716daadb40d4b5ecc2adbfa8f7b32d4b41c15c66e19c7f8e27

Score

10^/10

trickbot lib153 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

lib153

C2

179.42.137.102:443

191.36.152.198:443

179.42.137.104:443

179.42.137.106:443

179.42.137.108:443

202.183.12.124:443

194.190.18.122:443

103.56.207.230:443

171.103.187.218:449

171.103.189.118:449

18.139.111.104:443

179.42.137.105:443

186.4.193.75:443

171.101.229.2:449

179.42.137.107:443

103.56.43.209:449

179.42.137.110:443

45.181.207.156:443

197.44.54.162:449

179.42.137.109:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 checkip.amazonaws.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1040 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0cef107c35c2e6888cf815c5d9f54935.exe

pid process

1308 0cef107c35c2e6888cf815c5d9f54935.exe
1308 0cef107c35c2e6888cf815c5d9f54935.exe

flow	ioc
10	checkip.amazonaws.com

description	pid	process
Token: SeDebugPrivilege	1040	wermgr.exe

pid	process
1308	0cef107c35c2e6888cf815c5d9f54935.exe
1308	0cef107c35c2e6888cf815c5d9f54935.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0cef107c35c2e6888cf815c5d9f54935.exe

description	pid	process	target process
PID 1308 wrote to memory of 1040	1308	0cef107c35c2e6888cf815c5d9f54935.exe	wermgr.exe
PID 1308 wrote to memory of 1040	1308	0cef107c35c2e6888cf815c5d9f54935.exe	wermgr.exe
PID 1308 wrote to memory of 1040	1308	0cef107c35c2e6888cf815c5d9f54935.exe	wermgr.exe
PID 1308 wrote to memory of 1040	1308	0cef107c35c2e6888cf815c5d9f54935.exe	wermgr.exe
PID 1308 wrote to memory of 1028	1308	0cef107c35c2e6888cf815c5d9f54935.exe	cmd.exe
PID 1308 wrote to memory of 1028	1308	0cef107c35c2e6888cf815c5d9f54935.exe	cmd.exe
PID 1308 wrote to memory of 1028	1308	0cef107c35c2e6888cf815c5d9f54935.exe	cmd.exe
PID 1308 wrote to memory of 1028	1308	0cef107c35c2e6888cf815c5d9f54935.exe	cmd.exe
PID 1308 wrote to memory of 1040	1308	0cef107c35c2e6888cf815c5d9f54935.exe	wermgr.exe
PID 1308 wrote to memory of 1040	1308	0cef107c35c2e6888cf815c5d9f54935.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\0cef107c35c2e6888cf815c5d9f54935.exe
"C:\Users\Admin\AppData\Local\Temp\0cef107c35c2e6888cf815c5d9f54935.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:1028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-68-0x0000000000000000-mapping.dmp

Download
memory/1040-69-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download
memory/1040-70-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1308-60-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1308-61-0x0000000001DE0000-0x0000000001E1F000-memory.dmp

Filesize
252KB

Download
memory/1308-65-0x0000000001E30000-0x0000000001E6B000-memory.dmp

Filesize
236KB

Download
memory/1308-64-0x0000000000270000-0x00000000002AC000-memory.dmp

Filesize
240KB

Download
memory/1308-67-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/1308-66-0x0000000000240000-0x0000000000251000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing