trickbot | 4e93dcc21ee091596b5ecfac0c5076e14fff78617223cb1e19a2686c7113fade

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-en-20211014
submitted
16/10/2021, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eec52d33ec7b607e95ff20b0e586acae.exe
Size 868KB
Sample211016-rw458achaj
SHA256 4e93dcc21ee091596b5ecfac0c5076e14fff78617223cb1e19a2686c7113fade
MD5 eec52d33ec7b607e95ff20b0e586acae
SHA1 2e37bd35342b1e90cdfa7fd22d779d09b983d5a3
SHA512 676a0616cffc45606c8374b24f5dd82b36eba3c6ce0379d52c5480a2457daaa49eeb97c287ab5112cd74503df05fa17d988fef428525aa8c68aa1cf1dfa1e681
MD5 SHA1 SHA512

Score

10^/10

trickbot tot166 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

tot166

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	600	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	eec52d33ec7b607e95ff20b0e586acae.exe
1700	eec52d33ec7b607e95ff20b0e586acae.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 600	1700	eec52d33ec7b607e95ff20b0e586acae.exe	27
PID 1700 wrote to memory of 600	1700	eec52d33ec7b607e95ff20b0e586acae.exe	27
PID 1700 wrote to memory of 600	1700	eec52d33ec7b607e95ff20b0e586acae.exe	27
PID 1700 wrote to memory of 600	1700	eec52d33ec7b607e95ff20b0e586acae.exe	27
PID 1700 wrote to memory of 528	1700	eec52d33ec7b607e95ff20b0e586acae.exe	28
PID 1700 wrote to memory of 528	1700	eec52d33ec7b607e95ff20b0e586acae.exe	28
PID 1700 wrote to memory of 528	1700	eec52d33ec7b607e95ff20b0e586acae.exe	28
PID 1700 wrote to memory of 528	1700	eec52d33ec7b607e95ff20b0e586acae.exe	28
PID 1700 wrote to memory of 600	1700	eec52d33ec7b607e95ff20b0e586acae.exe	27
PID 1700 wrote to memory of 600	1700	eec52d33ec7b607e95ff20b0e586acae.exe	27

C:\Users\Admin\AppData\Local\Temp\eec52d33ec7b607e95ff20b0e586acae.exe
"C:\Users\Admin\AppData\Local\Temp\eec52d33ec7b607e95ff20b0e586acae.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-64-0x00000000000F0000-0x0000000000119000-memory.dmp

Download

memory/600-65-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/1700-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Download

memory/1700-55-0x00000000002D0000-0x000000000030C000-memory.dmp

Download

memory/1700-56-0x00000000003A0000-0x00000000003DF000-memory.dmp

Download

memory/1700-59-0x0000000000561000-0x000000000059A000-memory.dmp

Download

memory/1700-60-0x00000000002D0000-0x000000000030C000-memory.dmp

Download

memory/1700-61-0x00000000002A0000-0x00000000002B1000-memory.dmp

Download

memory/1700-62-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads