trickbot | 06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9

Analysis

max time kernel
140s
max time network
154s
platform
windows10_x64
resource
win10-en-20211104
submitted
07/11/2021, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee566f0e04b497770c5baa4de14c416f.exe
Size 641KB
Sample211107-kkbafahgh7
SHA256 06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9
MD5 ee566f0e04b497770c5baa4de14c416f
SHA1 98f77caf24f14dca0fa163596a730269037f2065
SHA512 fc17d8ac46d0a29758332210ed4400eb336cf157896d38cf8f391ea6e1061dc73972d519a59f09f1095778fc7e6f18aa3e0fae6d24e3323ed62a7b9327c8ef9b
MD5 SHA1 SHA512

Score

10^/10

trickbot tot176 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000036

Botnet

tot176

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun
Name:injectDll
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1988	3064	ee566f0e04b497770c5baa4de14c416f.exe	69
PID 3064 wrote to memory of 1988	3064	ee566f0e04b497770c5baa4de14c416f.exe	69
PID 3064 wrote to memory of 3536	3064	ee566f0e04b497770c5baa4de14c416f.exe	70
PID 3064 wrote to memory of 3536	3064	ee566f0e04b497770c5baa4de14c416f.exe	70
PID 3064 wrote to memory of 1988	3064	ee566f0e04b497770c5baa4de14c416f.exe	69
PID 3064 wrote to memory of 1988	3064	ee566f0e04b497770c5baa4de14c416f.exe	69

C:\Users\Admin\AppData\Local\Temp\ee566f0e04b497770c5baa4de14c416f.exe
"C:\Users\Admin\AppData\Local\Temp\ee566f0e04b497770c5baa4de14c416f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-123-0x0000014EDD0B0000-0x0000014EDD0B1000-memory.dmp

Download

memory/1988-122-0x0000014EDCFA0000-0x0000014EDCFCA000-memory.dmp

Download

memory/1988-125-0x0000014EDD0E0000-0x0000014EDD0E2000-memory.dmp

Download

memory/1988-124-0x0000014EDD0E0000-0x0000014EDD0E2000-memory.dmp

Download

memory/3064-118-0x0000000002A80000-0x0000000002AEA000-memory.dmp

Download

memory/3064-119-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/3064-120-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads