trickbot | 8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d

Analysis

max time kernel
146s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
09/10/2021, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
978fb9a64fb30f1fb07770c377d18a40.exe
Size 440KB
Sample211009-hemp6sfaf4
SHA256 8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d
MD5 978fb9a64fb30f1fb07770c377d18a40
SHA1 4608fe044c4d02ea260adb55b386f8cd1a5ea5e7
SHA512 5cb44f1b3a1e3ee560aa6c1ae8f5972bc31794d8a930b1248520b5b9cf5ad947ba56147d825cb4329af7ee5004f551b8ef7dd5e075a8a7b105179451c5e14335
MD5 SHA1 SHA512

Score

10^/10

trickbot lib161 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

lib161

179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4796	978fb9a64fb30f1fb07770c377d18a40.exe
4796	978fb9a64fb30f1fb07770c377d18a40.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4288	4796	978fb9a64fb30f1fb07770c377d18a40.exe	72
PID 4796 wrote to memory of 4288	4796	978fb9a64fb30f1fb07770c377d18a40.exe	72
PID 4796 wrote to memory of 3940	4796	978fb9a64fb30f1fb07770c377d18a40.exe	73
PID 4796 wrote to memory of 3940	4796	978fb9a64fb30f1fb07770c377d18a40.exe	73
PID 4796 wrote to memory of 4288	4796	978fb9a64fb30f1fb07770c377d18a40.exe	72
PID 4796 wrote to memory of 4288	4796	978fb9a64fb30f1fb07770c377d18a40.exe	72

C:\Users\Admin\AppData\Local\Temp\978fb9a64fb30f1fb07770c377d18a40.exe
"C:\Users\Admin\AppData\Local\Temp\978fb9a64fb30f1fb07770c377d18a40.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4288-123-0x000001DAF92A0000-0x000001DAF92A1000-memory.dmp

Download

memory/4288-122-0x000001DAF9190000-0x000001DAF91B9000-memory.dmp

Download

memory/4288-125-0x000001DAF92D0000-0x000001DAF92D2000-memory.dmp

Download

memory/4288-124-0x000001DAF92D0000-0x000001DAF92D2000-memory.dmp

Download

memory/4796-114-0x00000000024F0000-0x000000000252F000-memory.dmp

Download

memory/4796-117-0x0000000002531000-0x000000000256B000-memory.dmp

Download

memory/4796-118-0x00000000022B0000-0x00000000022EC000-memory.dmp

Download

memory/4796-120-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/4796-119-0x0000000002290000-0x0000000002291000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads