trickbot | b278fa8838fbba987d404016dc4e83c5177d64ebe4e9e230eeb7a5e6bbb51dee

Analysis

max time kernel
146s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
12/10/2021, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a1b25fba05bb759edbf6d5209618e13.exe
Size 584KB
Sample211012-ktcjvsbhh8
SHA256 b278fa8838fbba987d404016dc4e83c5177d64ebe4e9e230eeb7a5e6bbb51dee
MD5 9a1b25fba05bb759edbf6d5209618e13
SHA1 4644d7bf5d46cd1a0e24126f63853fcffc4bf369
SHA512 2990a3ce0a9712f0b9380e617f1479698b6cc819e489d4bc2221a3396d7208a93ea888b291023fc2b7cc3caf335f8927d53284ad84c67b8599c1b66a2007b219
MD5 SHA1 SHA512

Score

10^/10

trickbot tot162 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

tot162

179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
628	9a1b25fba05bb759edbf6d5209618e13.exe
628	9a1b25fba05bb759edbf6d5209618e13.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2860	628	9a1b25fba05bb759edbf6d5209618e13.exe	72
PID 628 wrote to memory of 2860	628	9a1b25fba05bb759edbf6d5209618e13.exe	72
PID 628 wrote to memory of 1104	628	9a1b25fba05bb759edbf6d5209618e13.exe	73
PID 628 wrote to memory of 1104	628	9a1b25fba05bb759edbf6d5209618e13.exe	73
PID 628 wrote to memory of 2860	628	9a1b25fba05bb759edbf6d5209618e13.exe	72
PID 628 wrote to memory of 2860	628	9a1b25fba05bb759edbf6d5209618e13.exe	72

C:\Users\Admin\AppData\Local\Temp\9a1b25fba05bb759edbf6d5209618e13.exe
"C:\Users\Admin\AppData\Local\Temp\9a1b25fba05bb759edbf6d5209618e13.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-114-0x0000000002480000-0x00000000024BF000-memory.dmp

Download

memory/628-117-0x00000000024C1000-0x00000000024FB000-memory.dmp

Download

memory/628-118-0x0000000002320000-0x000000000235C000-memory.dmp

Download

memory/628-119-0x0000000000A90000-0x0000000000B50000-memory.dmp

Download

memory/628-120-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/2860-122-0x000002292E770000-0x000002292E799000-memory.dmp

Download

memory/2860-123-0x000002292E980000-0x000002292E981000-memory.dmp

Download

memory/2860-125-0x000002292E9B0000-0x000002292E9B2000-memory.dmp

Download

memory/2860-124-0x000002292E9B0000-0x000002292E9B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads