trickbot | 1a6bef8525a2b7eded1ea8c92e65cea20a08dc2fff175e37886c7f46846bcb68

Analysis

max time kernel
134s
max time network
151s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-12-2021 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da42b3f16999890ffa59a2aa10a334e5.exe
Size

412KB
MD5

da42b3f16999890ffa59a2aa10a334e5
SHA1

421b355c7b3311961359bea6e886a316e410bbf8
SHA256

1a6bef8525a2b7eded1ea8c92e65cea20a08dc2fff175e37886c7f46846bcb68
SHA512

bbc7e32825b292dcd40d8385dff809df0ddf4d27b23f456b918068fb07d5940d741e7b294fb3350bab80dcf6142107c8a2be46a9ada1b7e45b1fca6051921d70

Score

10^/10

trickbot lip166 banker suricata trojan

Malware Config

Extracted

Family

trickbot

Version

100021

Botnet

lip166

181.129.85.98:443

189.112.119.205:443

189.51.118.78:443

186.121.214.106:443

49.176.188.184:443

61.69.102.170:443

213.32.252.221:443

89.46.216.2:443

103.36.79.3:443

103.108.97.51:443

95.140.217.242:443

41.175.22.226:443

190.109.169.161:443

186.159.12.18:443

190.109.171.17:443

181.196.148.202:443

186.47.75.58:443

186.42.212.30:443

190.214.21.14:443

187.108.32.133:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 4548 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	4548	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

da42b3f16999890ffa59a2aa10a334e5.exe

description	pid	process	target process
PID 4208 wrote to memory of 4548	4208	da42b3f16999890ffa59a2aa10a334e5.exe	wermgr.exe
PID 4208 wrote to memory of 4548	4208	da42b3f16999890ffa59a2aa10a334e5.exe	wermgr.exe
PID 4208 wrote to memory of 1616	4208	da42b3f16999890ffa59a2aa10a334e5.exe	cmd.exe
PID 4208 wrote to memory of 1616	4208	da42b3f16999890ffa59a2aa10a334e5.exe	cmd.exe
PID 4208 wrote to memory of 4548	4208	da42b3f16999890ffa59a2aa10a334e5.exe	wermgr.exe
PID 4208 wrote to memory of 4548	4208	da42b3f16999890ffa59a2aa10a334e5.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\da42b3f16999890ffa59a2aa10a334e5.exe
"C:\Users\Admin\AppData\Local\Temp\da42b3f16999890ffa59a2aa10a334e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4208-115-0x0000000000950000-0x00000000009B2000-memory.dmp

Filesize
392KB

Download
memory/4208-117-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/4208-116-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/4548-118-0x0000000000000000-mapping.dmp

Download
memory/4548-119-0x000002D648100000-0x000002D648129000-memory.dmp

Filesize
164KB

Download
memory/4548-120-0x000002D648210000-0x000002D648211000-memory.dmp

Filesize
4KB

Download
memory/4548-122-0x000002D648240000-0x000002D648242000-memory.dmp

Filesize
8KB

Download
memory/4548-121-0x000002D648240000-0x000002D648242000-memory.dmp

Filesize
8KB

Download