trickbot | 94d90e7f0577f2e80461a2eef2bfe4710a6e1afddb6bb2b0585610c1dda0beec

Analysis

max time kernel
141s
max time network
156s
platform
windows10_x64
resource
win10-en-20210920
submitted
01/11/2021, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffe21dc02e9a638307501285b024aefe.exe
Size 832KB
Sample211101-wx7d7afdap
SHA256 94d90e7f0577f2e80461a2eef2bfe4710a6e1afddb6bb2b0585610c1dda0beec
MD5 ffe21dc02e9a638307501285b024aefe
SHA1 0a48c26cece79bb92ac1153a37ef194a4ec44574
SHA512 76a5da1a627a09b3a91de7a431900cb014c54c98e52c04fd399620cd541fc741eb7402be047884d9868bc2f9ae2543bac59f4b4ebe87b64ace14fe2839fb9631
MD5 SHA1 SHA512

Score

10^/10

trickbot lip143 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

lip143

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3352	ffe21dc02e9a638307501285b024aefe.exe
Token: SeDebugPrivilege	604	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3352	ffe21dc02e9a638307501285b024aefe.exe
3352	ffe21dc02e9a638307501285b024aefe.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 604	3352	ffe21dc02e9a638307501285b024aefe.exe	69
PID 3352 wrote to memory of 604	3352	ffe21dc02e9a638307501285b024aefe.exe	69
PID 3352 wrote to memory of 1288	3352	ffe21dc02e9a638307501285b024aefe.exe	70
PID 3352 wrote to memory of 1288	3352	ffe21dc02e9a638307501285b024aefe.exe	70
PID 3352 wrote to memory of 604	3352	ffe21dc02e9a638307501285b024aefe.exe	69
PID 3352 wrote to memory of 604	3352	ffe21dc02e9a638307501285b024aefe.exe	69

C:\Users\Admin\AppData\Local\Temp\ffe21dc02e9a638307501285b024aefe.exe
"C:\Users\Admin\AppData\Local\Temp\ffe21dc02e9a638307501285b024aefe.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-124-0x000001F537430000-0x000001F537431000-memory.dmp

Download

memory/604-123-0x000001F5373F0000-0x000001F537419000-memory.dmp

Download

memory/604-126-0x000001F537460000-0x000001F537462000-memory.dmp

Download

memory/604-125-0x000001F537460000-0x000001F537462000-memory.dmp

Download

memory/3352-115-0x0000000002DD0000-0x0000000002E0F000-memory.dmp

Download

memory/3352-118-0x0000000002E11000-0x0000000002E4B000-memory.dmp

Download

memory/3352-119-0x0000000002620000-0x000000000265C000-memory.dmp

Download

memory/3352-120-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/3352-121-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads