trickbot | 061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565

Resubmissions

28-10-2021 08:57

211028-kwvs8afhbn 10

27-10-2021 12:30

211027-pphbrshahm 10

Analysis

max time kernel
1022s
max time network
1088s
platform
windows10_x64
resource
win10-en-20211014
submitted
28-10-2021 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7e6ab5b45d664feb300b309566f3107.exe
Size

443KB
MD5

c7e6ab5b45d664feb300b309566f3107
SHA1

3bb6269473aafafd9b5b8931fdbcd6bf2aa10b55
SHA256

061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565
SHA512

77f31e5116f7f9805720ce7f24895550c38f66243b15dbd0084372780967b32ca67251b59a5e9ba84a2d4b65bc0f9038ed3aa403b28ecc5764612e07767cede8

Score

10^/10

trickbot lip141 banker suricata trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

lip141

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

26 ident.me
27 ident.me
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1192 wermgr.exe

flow	ioc
26	ident.me
27	ident.me

description	pid	process
Token: SeDebugPrivilege	1192	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c7e6ab5b45d664feb300b309566f3107.exe

description	pid	process	target process
PID 2664 wrote to memory of 1192	2664	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 2664 wrote to memory of 1192	2664	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 2664 wrote to memory of 3152	2664	c7e6ab5b45d664feb300b309566f3107.exe	cmd.exe
PID 2664 wrote to memory of 3152	2664	c7e6ab5b45d664feb300b309566f3107.exe	cmd.exe
PID 2664 wrote to memory of 1192	2664	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe
PID 2664 wrote to memory of 1192	2664	c7e6ab5b45d664feb300b309566f3107.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\c7e6ab5b45d664feb300b309566f3107.exe
"C:\Users\Admin\AppData\Local\Temp\c7e6ab5b45d664feb300b309566f3107.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-118-0x0000000000000000-mapping.dmp

Download
memory/1192-119-0x0000021F0EEC0000-0x0000021F0EEE9000-memory.dmp

Filesize
164KB

Download
memory/1192-120-0x0000021F0EFD0000-0x0000021F0EFD1000-memory.dmp

Filesize
4KB

Download
memory/1192-122-0x0000021F0F000000-0x0000021F0F002000-memory.dmp

Filesize
8KB

Download
memory/1192-121-0x0000021F0F000000-0x0000021F0F002000-memory.dmp

Filesize
8KB

Download
memory/2664-115-0x000000002F450000-0x000000002F4C2000-memory.dmp

Filesize
456KB

Download
memory/2664-116-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/2664-117-0x0000000001061000-0x0000000001063000-memory.dmp

Filesize
8KB

Download