trickbot | 53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d

General

Target
53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe
Size 712KB
Sample211121-k7jv4adffr
SHA256 53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d
MD5 9ff0c327c3811bce19259e0c87a711bc
SHA1 45f42fd1c68352bd37ec0b1d2c3a887dd7473dc7
SHA512 c57858ba2d86bf185e04b79b0efe1c4c1e86bcd5606a0fb23bacb38c80fd1a9cf093fa37149d54e66557167d71ee51848b88e23457394e2ae3ab9f908501dc28
MD5 SHA1 SHA512

Score

10^/10

trickbot lib177 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000036

Botnet

lib177

C2

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun
Name:injectDll
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ident.me
24	ident.me

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe
2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3684	2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe	69
PID 2680 wrote to memory of 3684	2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe	69
PID 2680 wrote to memory of 3320	2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe	70
PID 2680 wrote to memory of 3320	2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe	70
PID 2680 wrote to memory of 3684	2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe	69
PID 2680 wrote to memory of 3684	2680	53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe	69

C:\Users\Admin\AppData\Local\Temp\53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe
"C:\Users\Admin\AppData\Local\Temp\53a2b18f28a8f164564b3ddf20900858acfa9da50d4dea27c4fcc9dcb7d7d83d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-115-0x0000000002540000-0x0000000002580000-memory.dmp

Download

memory/2680-118-0x0000000002581000-0x00000000025BB000-memory.dmp

Download

memory/2680-119-0x0000000002400000-0x000000000243D000-memory.dmp

Download

memory/2680-121-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/2680-120-0x00000000022D0000-0x00000000022D1000-memory.dmp

Download

memory/3684-123-0x000001EB244E0000-0x000001EB2450A000-memory.dmp

Download

memory/3684-124-0x000001EB245F0000-0x000001EB245F1000-memory.dmp

Download

memory/3684-126-0x000001EB24620000-0x000001EB24622000-memory.dmp

Download

memory/3684-125-0x000001EB24620000-0x000001EB24622000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads