trickbot | df16e5de8f0a2d2dd9ef3cc8cc2b544840ade7aca0e9067220d512b2ff697f00

Analysis

max time kernel
146s
max time network
190s
platform
windows7_x64
resource
win7-en-20210920
submitted
15/10/2021, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7bd7363c595f4ce687355078f265b00c.exe
Size 960KB
Sample211015-pse1taahf2
SHA256 df16e5de8f0a2d2dd9ef3cc8cc2b544840ade7aca0e9067220d512b2ff697f00
MD5 7bd7363c595f4ce687355078f265b00c
SHA1 716128b3759715ce50c81c612615485c8f85dc4b
SHA512 17d517f789990a8d87ee1931b54ef1c13fd7334cadb0012c2c4bbc87753f73c9dc8a3d48fcd331e27ea6736f63a20c04dc5e3b6b237c50c55e70f391a9dc4a47
MD5 SHA1 SHA512

Score

10^/10

trickbot lib165 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

lib165

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1116	7bd7363c595f4ce687355078f265b00c.exe
1116	7bd7363c595f4ce687355078f265b00c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1372	1116	7bd7363c595f4ce687355078f265b00c.exe	27
PID 1116 wrote to memory of 1372	1116	7bd7363c595f4ce687355078f265b00c.exe	27
PID 1116 wrote to memory of 1372	1116	7bd7363c595f4ce687355078f265b00c.exe	27
PID 1116 wrote to memory of 1372	1116	7bd7363c595f4ce687355078f265b00c.exe	27
PID 1116 wrote to memory of 524	1116	7bd7363c595f4ce687355078f265b00c.exe	28
PID 1116 wrote to memory of 524	1116	7bd7363c595f4ce687355078f265b00c.exe	28
PID 1116 wrote to memory of 524	1116	7bd7363c595f4ce687355078f265b00c.exe	28
PID 1116 wrote to memory of 524	1116	7bd7363c595f4ce687355078f265b00c.exe	28
PID 1116 wrote to memory of 1372	1116	7bd7363c595f4ce687355078f265b00c.exe	27
PID 1116 wrote to memory of 1372	1116	7bd7363c595f4ce687355078f265b00c.exe	27

C:\Users\Admin\AppData\Local\Temp\7bd7363c595f4ce687355078f265b00c.exe
"C:\Users\Admin\AppData\Local\Temp\7bd7363c595f4ce687355078f265b00c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-53-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Download

memory/1116-55-0x00000000003B0000-0x00000000003EF000-memory.dmp

Download

memory/1116-54-0x0000000000260000-0x000000000029C000-memory.dmp

Download

memory/1116-58-0x0000000001F21000-0x0000000001F5A000-memory.dmp

Download

memory/1116-59-0x0000000000260000-0x000000000029C000-memory.dmp

Download

memory/1116-60-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/1116-61-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/1372-63-0x0000000000060000-0x0000000000089000-memory.dmp

Download

memory/1372-64-0x0000000000290000-0x0000000000291000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads