trickbot | 5e91d76dc15ec1b53ea0db50584da6444a01876d563c25dfa1baa17cf93b00c6

Analysis

max time kernel
144s
max time network
192s
platform
windows7_x64
resource
win7-en-20210920
submitted
14/10/2021, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00a06b3a11d93c721e3e31a74a409707.exe
Size 960KB
Sample211014-w1f2eaabb5
SHA256 5e91d76dc15ec1b53ea0db50584da6444a01876d563c25dfa1baa17cf93b00c6
MD5 00a06b3a11d93c721e3e31a74a409707
SHA1 472c813eb0cb920c737dbb36a9ccaae285ddb27c
SHA512 ce31c215787897b0afc6b5f28e6cfa66b4d155fc4dbc6cd5923ebad31470dc4ad642ab94095cd492c4efecdbf07eefc4292b942f7607a9101fc73ca9d7c95608
MD5 SHA1 SHA512

Score

10^/10

trickbot tot165 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

tot165

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1112	00a06b3a11d93c721e3e31a74a409707.exe
1112	00a06b3a11d93c721e3e31a74a409707.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1104	1112	00a06b3a11d93c721e3e31a74a409707.exe	27
PID 1112 wrote to memory of 1104	1112	00a06b3a11d93c721e3e31a74a409707.exe	27
PID 1112 wrote to memory of 1104	1112	00a06b3a11d93c721e3e31a74a409707.exe	27
PID 1112 wrote to memory of 1104	1112	00a06b3a11d93c721e3e31a74a409707.exe	27
PID 1112 wrote to memory of 268	1112	00a06b3a11d93c721e3e31a74a409707.exe	28
PID 1112 wrote to memory of 268	1112	00a06b3a11d93c721e3e31a74a409707.exe	28
PID 1112 wrote to memory of 268	1112	00a06b3a11d93c721e3e31a74a409707.exe	28
PID 1112 wrote to memory of 268	1112	00a06b3a11d93c721e3e31a74a409707.exe	28
PID 1112 wrote to memory of 1104	1112	00a06b3a11d93c721e3e31a74a409707.exe	27
PID 1112 wrote to memory of 1104	1112	00a06b3a11d93c721e3e31a74a409707.exe	27

C:\Users\Admin\AppData\Local\Temp\00a06b3a11d93c721e3e31a74a409707.exe
"C:\Users\Admin\AppData\Local\Temp\00a06b3a11d93c721e3e31a74a409707.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-63-0x00000000000F0000-0x0000000000119000-memory.dmp

Download

memory/1104-64-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/1112-53-0x00000000751A1000-0x00000000751A3000-memory.dmp

Download

memory/1112-54-0x00000000002D0000-0x000000000030C000-memory.dmp

Download

memory/1112-55-0x0000000000690000-0x00000000006CF000-memory.dmp

Download

memory/1112-58-0x00000000008F1000-0x000000000092A000-memory.dmp

Download

memory/1112-59-0x00000000002D0000-0x000000000030C000-memory.dmp

Download

memory/1112-60-0x0000000000330000-0x0000000000341000-memory.dmp

Download

memory/1112-61-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads