trickbot | 473dfbecc3818114569a9a9f80b0a51ad74b3d88fa778158ab145e839ecb042c

General

Target
16e8c8407e06e7c91ef0b065b9be9da9.exe
Size 577KB
Sample211001-he8mmsbad9
SHA256 473dfbecc3818114569a9a9f80b0a51ad74b3d88fa778158ab145e839ecb042c
MD5 16e8c8407e06e7c91ef0b065b9be9da9
SHA1 d5834659e94a29870ac7968a6be949e306cb5741
SHA512 4b6a74850de11af0b3a5c335cdf52be161d6b7c0973bca8c8784899aacdbfb5c2a28f1c42b3b43a125340905c9caf81c73503624b4c1289bf7837454eeecf2c5
MD5 SHA1 SHA512

Score

10^/10

trickbot lib156 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

lib156

C2

179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ = "Widget.Document"	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell	16e8c8407e06e7c91ef0b065b9be9da9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16E8C8~1.EXE \"%1\""	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print	16e8c8407e06e7c91ef0b065b9be9da9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16E8C8~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\DefaultIcon	16e8c8407e06e7c91ef0b065b9be9da9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16E8C8~1.EXE,1"	16e8c8407e06e7c91ef0b065b9be9da9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16E8C8~1.EXE /p \"%1\""	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print\command	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto\command	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg	16e8c8407e06e7c91ef0b065b9be9da9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ShellNew\NullFile	16e8c8407e06e7c91ef0b065b9be9da9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\ = "Widget Document"	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open\command	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document	16e8c8407e06e7c91ef0b065b9be9da9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ShellNew	16e8c8407e06e7c91ef0b065b9be9da9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3708	16e8c8407e06e7c91ef0b065b9be9da9.exe
3708	16e8c8407e06e7c91ef0b065b9be9da9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2196	3708	16e8c8407e06e7c91ef0b065b9be9da9.exe	70
PID 3708 wrote to memory of 2196	3708	16e8c8407e06e7c91ef0b065b9be9da9.exe	70
PID 3708 wrote to memory of 1884	3708	16e8c8407e06e7c91ef0b065b9be9da9.exe	71
PID 3708 wrote to memory of 1884	3708	16e8c8407e06e7c91ef0b065b9be9da9.exe	71
PID 3708 wrote to memory of 2196	3708	16e8c8407e06e7c91ef0b065b9be9da9.exe	70
PID 3708 wrote to memory of 2196	3708	16e8c8407e06e7c91ef0b065b9be9da9.exe	70

C:\Users\Admin\AppData\Local\Temp\16e8c8407e06e7c91ef0b065b9be9da9.exe
"C:\Users\Admin\AppData\Local\Temp\16e8c8407e06e7c91ef0b065b9be9da9.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-123-0x00000233F0420000-0x00000233F0449000-memory.dmp

Download

memory/2196-124-0x00000233F0460000-0x00000233F0461000-memory.dmp

Download

memory/3708-115-0x00000000021B0000-0x00000000021EF000-memory.dmp

Download

memory/3708-118-0x0000000002170000-0x00000000021AC000-memory.dmp

Download

memory/3708-119-0x00000000022F0000-0x000000000232B000-memory.dmp

Download

memory/3708-120-0x0000000002200000-0x0000000002201000-memory.dmp

Download

memory/3708-121-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads