trickbot | 728aff0d54df55bd4ed10a1c02c165e86310503cf82bd4c2d6b4b2a0a383dabd

Analysis

max time kernel
131s
max time network
136s
platform
windows7_x64
resource
win7-en-20210920
submitted
05/10/2021, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2c1ba4964dd5ed582a2a2d61b997ae4.exe
Size 736KB
Sample211005-v8ac6aabf5
SHA256 728aff0d54df55bd4ed10a1c02c165e86310503cf82bd4c2d6b4b2a0a383dabd
MD5 c2c1ba4964dd5ed582a2a2d61b997ae4
SHA1 46cc4c1c465ece91f3e4845ae6848feabb3ff693
SHA512 48e7a76d60fedfd5e43e0435308e63bbd6998b6c8b5363d1dbe099c507db5f61a2a6ea15f22d23fd606b7fc126f86c73e0a9f361af96b95fec49143c48d45131
MD5 SHA1 SHA512

Score

10^/10

trickbot tot159 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

tot159

179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe
2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1984	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	27
PID 2008 wrote to memory of 1984	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	27
PID 2008 wrote to memory of 1984	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	27
PID 2008 wrote to memory of 1984	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	27
PID 2008 wrote to memory of 1124	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	28
PID 2008 wrote to memory of 1124	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	28
PID 2008 wrote to memory of 1124	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	28
PID 2008 wrote to memory of 1124	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	28
PID 2008 wrote to memory of 1984	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	27
PID 2008 wrote to memory of 1984	2008	c2c1ba4964dd5ed582a2a2d61b997ae4.exe	27

C:\Users\Admin\AppData\Local\Temp\c2c1ba4964dd5ed582a2a2d61b997ae4.exe
"C:\Users\Admin\AppData\Local\Temp\c2c1ba4964dd5ed582a2a2d61b997ae4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-62-0x0000000000060000-0x0000000000089000-memory.dmp

Download

memory/1984-63-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/2008-53-0x0000000075FA1000-0x0000000075FA3000-memory.dmp

Download

memory/2008-54-0x00000000004C0000-0x00000000004FF000-memory.dmp

Download

memory/2008-57-0x0000000000370000-0x00000000003AD000-memory.dmp

Download

memory/2008-58-0x0000000001ED0000-0x0000000001F0B000-memory.dmp

Download

memory/2008-59-0x00000000003D0000-0x00000000003E1000-memory.dmp

Download

memory/2008-60-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads