trickbot | 061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565

Resubmissions

28-10-2021 08:57

211028-kwvs8afhbn 10

27-10-2021 12:30

211027-pphbrshahm 10

Analysis

max time kernel
1043s
max time network
1090s
platform
windows7_x64
resource
win7-en-20210920
submitted
28-10-2021 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7e6ab5b45d664feb300b309566f3107.exe
Size

443KB
MD5

c7e6ab5b45d664feb300b309566f3107
SHA1

3bb6269473aafafd9b5b8931fdbcd6bf2aa10b55
SHA256

061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565
SHA512

77f31e5116f7f9805720ce7f24895550c38f66243b15dbd0084372780967b32ca67251b59a5e9ba84a2d4b65bc0f9038ed3aa403b28ecc5764612e07767cede8

Score

10^/10

trickbot lip141 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

lip141

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1116 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	1116	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

c7e6ab5b45d664feb300b309566f3107.exe

description	pid	process	target process
PID 1112 wrote to memory of 1116	1112	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 1112 wrote to memory of 1116	1112	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 1112 wrote to memory of 1116	1112	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 1112 wrote to memory of 1116	1112	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 1112 wrote to memory of 1512	1112	c7e6ab5b45d664feb300b309566f3107.exe	cmd.exe
PID 1112 wrote to memory of 1512	1112	c7e6ab5b45d664feb300b309566f3107.exe	cmd.exe
PID 1112 wrote to memory of 1512	1112	c7e6ab5b45d664feb300b309566f3107.exe	cmd.exe
PID 1112 wrote to memory of 1512	1112	c7e6ab5b45d664feb300b309566f3107.exe	cmd.exe
PID 1112 wrote to memory of 1116	1112	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 1112 wrote to memory of 1116	1112	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\c7e6ab5b45d664feb300b309566f3107.exe
"C:\Users\Admin\AppData\Local\Temp\c7e6ab5b45d664feb300b309566f3107.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-53-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1112-54-0x0000000000E90000-0x0000000000F02000-memory.dmp

Filesize
456KB

Download
memory/1112-55-0x00000000000E0000-0x00000000000F1000-memory.dmp

Filesize
68KB

Download
memory/1112-56-0x00000000000D1000-0x00000000000D3000-memory.dmp

Filesize
8KB

Download
memory/1116-57-0x0000000000000000-mapping.dmp

Download
memory/1116-58-0x0000000000060000-0x0000000000089000-memory.dmp

Filesize
164KB

Download
memory/1116-59-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download