trickbot | 76e78467254c1222cf7d03484a2584a707fdcaa9ffcab2b7323a2958c72667f4

Analysis

max time kernel
82s
max time network
131s
platform
windows7_x64
resource
win7-en-20210920
submitted
07/10/2021, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
138925da4d5bf0ce59d0a63512e5fd12.exe
Size 632KB
Sample211007-kpajpscaf4
SHA256 76e78467254c1222cf7d03484a2584a707fdcaa9ffcab2b7323a2958c72667f4
MD5 138925da4d5bf0ce59d0a63512e5fd12
SHA1 7cc61af016ec8c930ce18d1b9d0a32657f35d165
SHA512 31edc0c3960909219ab14f884f5bf7152b5f2cf284b53e2605d881c3a6a25fb3eaa89f124070738b5fd9a8d661450a3b70cb88149995c45bbb3f69f2a15baa14
MD5 SHA1 SHA512

Score

10^/10

trickbot tot159 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

tot159

179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1272	138925da4d5bf0ce59d0a63512e5fd12.exe
1272	138925da4d5bf0ce59d0a63512e5fd12.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1656	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	27
PID 1272 wrote to memory of 1656	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	27
PID 1272 wrote to memory of 1656	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	27
PID 1272 wrote to memory of 1656	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	27
PID 1272 wrote to memory of 808	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	28
PID 1272 wrote to memory of 808	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	28
PID 1272 wrote to memory of 808	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	28
PID 1272 wrote to memory of 808	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	28
PID 1272 wrote to memory of 1656	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	27
PID 1272 wrote to memory of 1656	1272	138925da4d5bf0ce59d0a63512e5fd12.exe	27

C:\Users\Admin\AppData\Local\Temp\138925da4d5bf0ce59d0a63512e5fd12.exe
"C:\Users\Admin\AppData\Local\Temp\138925da4d5bf0ce59d0a63512e5fd12.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-53-0x0000000075331000-0x0000000075333000-memory.dmp

Download

memory/1272-54-0x0000000000530000-0x000000000056F000-memory.dmp

Download

memory/1272-58-0x0000000000570000-0x00000000005AB000-memory.dmp

Download

memory/1272-57-0x00000000003C0000-0x00000000003FD000-memory.dmp

Download

memory/1272-59-0x00000000005D0000-0x00000000005E1000-memory.dmp

Download

memory/1272-60-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/1656-62-0x0000000000060000-0x0000000000089000-memory.dmp

Download

memory/1656-63-0x0000000000110000-0x0000000000111000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads