trickbot | 5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2

General

Target
e27db583aa7d1de75c5664c9bd1ad224.exe
Size 577KB
Sample210930-v2j9saacc4
SHA256 5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2
MD5 e27db583aa7d1de75c5664c9bd1ad224
SHA1 f379c9e471383fe92444155884737714d843d01b
SHA512 bf20bf834307c7a797f04de02a72fe68f394c2919c55959979316b59fb45e4f4fefd6e7854ad6305a08138ca2b565ebd5617ee28da91acb69c7bab08f995fa8c
MD5 SHA1 SHA512

Score

10^/10

trickbot lib156 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

lib156

C2

179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E27DB5~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	e27db583aa7d1de75c5664c9bd1ad224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ = "Widget.Document"	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ShellNew	e27db583aa7d1de75c5664c9bd1ad224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\ = "Widget Document"	e27db583aa7d1de75c5664c9bd1ad224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E27DB5~1.EXE,1"	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open\command	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\DefaultIcon	e27db583aa7d1de75c5664c9bd1ad224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E27DB5~1.EXE /p \"%1\""	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg	e27db583aa7d1de75c5664c9bd1ad224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ShellNew\NullFile	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open	e27db583aa7d1de75c5664c9bd1ad224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E27DB5~1.EXE \"%1\""	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print\command	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell	e27db583aa7d1de75c5664c9bd1ad224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto\command	e27db583aa7d1de75c5664c9bd1ad224.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2524	e27db583aa7d1de75c5664c9bd1ad224.exe
2524	e27db583aa7d1de75c5664c9bd1ad224.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2700	2524	e27db583aa7d1de75c5664c9bd1ad224.exe	70
PID 2524 wrote to memory of 2700	2524	e27db583aa7d1de75c5664c9bd1ad224.exe	70
PID 2524 wrote to memory of 2864	2524	e27db583aa7d1de75c5664c9bd1ad224.exe	71
PID 2524 wrote to memory of 2864	2524	e27db583aa7d1de75c5664c9bd1ad224.exe	71
PID 2524 wrote to memory of 2700	2524	e27db583aa7d1de75c5664c9bd1ad224.exe	70
PID 2524 wrote to memory of 2700	2524	e27db583aa7d1de75c5664c9bd1ad224.exe	70

C:\Users\Admin\AppData\Local\Temp\e27db583aa7d1de75c5664c9bd1ad224.exe
"C:\Users\Admin\AppData\Local\Temp\e27db583aa7d1de75c5664c9bd1ad224.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-115-0x0000000002310000-0x000000000234F000-memory.dmp

Download

memory/2524-118-0x0000000002240000-0x000000000227C000-memory.dmp

Download

memory/2524-119-0x0000000003D50000-0x0000000003D8B000-memory.dmp

Download

memory/2524-120-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/2524-121-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/2700-123-0x000001B281B90000-0x000001B281BB9000-memory.dmp

Download

memory/2700-124-0x000001B281DA0000-0x000001B281DA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads