trickbot | f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68

General

Target
f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe
Size 432KB
Sample211206-vctrxseehm
SHA256 f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68
MD5 58828abb3770c36a0757b2507943cd54
SHA1 b52b1cfaba2d41fdefd1ff8f4c98801cb8b93620
SHA512 db4f138ddf7ed1b64923fde4058d46dc90219ff99baa17950adfb0165f95657b49e6898d269203a456e4e83b3dc99e4c191cb74be6ebf95e58ac9bfe64e0c33d
MD5 SHA1 SHA512

Score

10^/10

trickbot tot5 banker suricata trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

tot5

C2

149.54.11.54:449
36.89.191.119:449
41.159.31.227:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.44:449
194.5.249.143:443
142.202.191.175:443
195.123.241.31:443
45.89.125.214:443
45.83.151.103:443
91.200.103.41:443
66.70.246.0:443
64.74.160.218:443
198.46.198.115:443
5.34.180.173:443
23.227.196.5:443
195.123.241.115:443
107.152.42.163:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata

Executes dropped EXE 1 IoCs

pid	Process
1480	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe

Loads dropped DLL 1 IoCs

pid	Process
1600	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipecho.net

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1480	1600	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	29
PID 1600 wrote to memory of 1480	1600	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	29
PID 1600 wrote to memory of 1480	1600	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	29
PID 1600 wrote to memory of 1480	1600	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	29
PID 1480 wrote to memory of 1464	1480	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	30
PID 1480 wrote to memory of 1464	1480	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	30
PID 1480 wrote to memory of 1464	1480	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	30
PID 1480 wrote to memory of 1464	1480	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	30
PID 1480 wrote to memory of 1464	1480	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	30
PID 1480 wrote to memory of 1464	1480	f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe	30

C:\Users\Admin\AppData\Local\Temp\f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe
"C:\Users\Admin\AppData\Local\Temp\f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Roaming\DesktopColor\f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe
  C:\Users\Admin\AppData\Roaming\DesktopColor\f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-66-0x0000000000060000-0x0000000000087000-memory.dmp

Download

memory/1464-67-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1480-63-0x0000000000280000-0x0000000000291000-memory.dmp

Download

memory/1480-62-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/1480-64-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/1600-55-0x00000000754A1000-0x00000000754A3000-memory.dmp

Download

memory/1600-56-0x0000000000310000-0x0000000000315000-memory.dmp

Download

memory/1600-57-0x0000000000400000-0x000000000046C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads