trickbot | fcde8f225a14fe70009f32c4acfba0407b5fd6b0da5c2f65778434359962e5c1

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
31-12-2021 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

218c5b56132ee73c7a5ad2e5c96c64d4.exe
Size

413KB
MD5

218c5b56132ee73c7a5ad2e5c96c64d4
SHA1

c1a72d736eb870684a190bad60d1da7d1292c37b
SHA256

fcde8f225a14fe70009f32c4acfba0407b5fd6b0da5c2f65778434359962e5c1
SHA512

bff0099194985d129fdb6edb305a565efdbdfcc65cba18ef5dd7db904afeba240ed6720a6f111eb1a68c5f99eb2855adf73a0fd183a9e4ef114ef4c474578419

Score

10^/10

trickbot top166 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100021

Botnet

top166

181.129.85.98:443

189.112.119.205:443

189.51.118.78:443

186.121.214.106:443

49.176.188.184:443

61.69.102.170:443

213.32.252.221:443

89.46.216.2:443

103.36.79.3:443

103.108.97.51:443

95.140.217.242:443

41.175.22.226:443

190.109.169.161:443

186.159.12.18:443

190.109.171.17:443

181.196.148.202:443

186.47.75.58:443

186.42.212.30:443

190.214.21.14:443

187.108.32.133:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 checkip.amazonaws.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1552 wermgr.exe

flow	ioc
5	checkip.amazonaws.com

description	pid	process
Token: SeDebugPrivilege	1552	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

218c5b56132ee73c7a5ad2e5c96c64d4.exe

description	pid	process	target process
PID 956 wrote to memory of 1552	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	wermgr.exe
PID 956 wrote to memory of 1552	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	wermgr.exe
PID 956 wrote to memory of 1552	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	wermgr.exe
PID 956 wrote to memory of 1552	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	wermgr.exe
PID 956 wrote to memory of 1360	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	cmd.exe
PID 956 wrote to memory of 1360	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	cmd.exe
PID 956 wrote to memory of 1360	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	cmd.exe
PID 956 wrote to memory of 1360	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	cmd.exe
PID 956 wrote to memory of 1552	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	wermgr.exe
PID 956 wrote to memory of 1552	956	218c5b56132ee73c7a5ad2e5c96c64d4.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\218c5b56132ee73c7a5ad2e5c96c64d4.exe
"C:\Users\Admin\AppData\Local\Temp\218c5b56132ee73c7a5ad2e5c96c64d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
2⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000000280000-0x00000000002E2000-memory.dmp

Filesize
392KB

Download
memory/956-57-0x0000000000120000-0x0000000000131000-memory.dmp

Filesize
68KB

Download
memory/956-58-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/1552-59-0x0000000000000000-mapping.dmp

Download
memory/1552-60-0x0000000000060000-0x0000000000089000-memory.dmp

Filesize
164KB

Download
memory/1552-61-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download