trickbot | 20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a

General

Target
20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
Size 1.0MB
Sample220128-1q1ehsedhj
SHA256 20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a
MD5 5a06b3a2dd6f6de9c920884f62eecd29
SHA1 295a0d5be269c83ecc4e72f1519dc4278f08dbec
SHA512 c31c71ec8dc2182a6f5626247f28434afef4a9010626c77b3b2afa22904689b7dfbcdaa69a49da8b6f8b55d78196a793eab7b93d4e8c6cbe5419aab7c257dc05
MD5 SHA1 SHA512

Score

10^/10

trickbot trg4488 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000477

Botnet

trg4488

C2

37.44.212.148:443
185.65.202.127:443
193.37.212.246:443
193.124.191.243:443
31.148.99.63:443
94.103.91.61:443
203.23.128.179:443
179.43.147.72:443
93.123.73.192:443
51.89.115.120:443
144.91.76.214:443
46.21.153.81:443
194.5.250.98:443
190.154.203.218:449
178.183.150.169:449
200.116.199.10:449
181.113.20.186:449
187.58.56.26:449
85.11.116.194:449
177.103.240.149:449
81.190.160.139:449
200.21.51.38:449
181.49.61.237:449
46.174.235.36:449
91.232.52.187:449
36.89.85.103:449
31.128.13.45:449
186.42.185.10:449
170.233.120.53:449
89.228.243.148:449
31.214.138.207:449
186.42.98.254:449
195.93.223.100:449
181.112.52.26:449
190.13.160.19:449
186.47.122.182:449
186.71.150.23:449
190.152.4.98:449
170.82.156.53:449
131.161.253.190:449
181.113.114.50:449
186.47.121.58:449
185.70.182.162:449
200.127.121.99:449
45.235.213.126:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/1660-62-0x0000000001CE0000-0x0000000001D0E000-memory.dmp	trickbot_loader32
behavioral1/memory/1660-66-0x0000000000570000-0x000000000059C000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
1660	вуоюа.exe
660	стсва.exe
872	вуоюа.exe

Loads dropped DLL 3 IoCs

pid	Process
1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	976	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
1660	вуоюа.exe
1660	вуоюа.exe
872	вуоюа.exe
872	вуоюа.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	27
PID 1352 wrote to memory of 1660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	27
PID 1352 wrote to memory of 1660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	27
PID 1352 wrote to memory of 1660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	27
PID 1352 wrote to memory of 660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	28
PID 1352 wrote to memory of 660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	28
PID 1352 wrote to memory of 660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	28
PID 1352 wrote to memory of 660	1352	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	28
PID 1660 wrote to memory of 772	1660	вуоюа.exe	29
PID 1660 wrote to memory of 772	1660	вуоюа.exe	29
PID 1660 wrote to memory of 772	1660	вуоюа.exe	29
PID 1660 wrote to memory of 772	1660	вуоюа.exe	29
PID 1660 wrote to memory of 772	1660	вуоюа.exe	29
PID 1660 wrote to memory of 772	1660	вуоюа.exe	29
PID 392 wrote to memory of 872	392	taskeng.exe	31
PID 392 wrote to memory of 872	392	taskeng.exe	31
PID 392 wrote to memory of 872	392	taskeng.exe	31
PID 392 wrote to memory of 872	392	taskeng.exe	31
PID 872 wrote to memory of 976	872	вуоюа.exe	32
PID 872 wrote to memory of 976	872	вуоюа.exe	32
PID 872 wrote to memory of 976	872	вуоюа.exe	32
PID 872 wrote to memory of 976	872	вуоюа.exe	32
PID 872 wrote to memory of 976	872	вуоюа.exe	32
PID 872 wrote to memory of 976	872	вуоюа.exe	32

C:\Users\Admin\AppData\Local\Temp\20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
"C:\Users\Admin\AppData\Local\Temp\20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
- C:\ProgramData\вуоюа.exe
  "C:\ProgramData\вуоюа.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:772
- C:\ProgramData\стсва.exe
  "C:\ProgramData\стсва.exe"
  2⤵
  - Executes dropped EXE
  PID:660

C:\Windows\system32\taskeng.exe
taskeng.exe {452F140E-F980-47C2-A674-24E81B84A121} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Roaming\HomeLan\вуоюа.exe
  C:\Users\Admin\AppData\Roaming\HomeLan\вуоюа.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-68-0x0000000001140000-0x0000000001141000-memory.dmp

Download

memory/660-65-0x0000000001220000-0x0000000001228000-memory.dmp

Download

memory/772-69-0x00000000000E0000-0x00000000000FE000-memory.dmp

Download

memory/976-75-0x00000000000E0000-0x00000000000FE000-memory.dmp

Download

memory/1352-53-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1660-66-0x0000000000570000-0x000000000059C000-memory.dmp

Download

memory/1660-62-0x0000000001CE0000-0x0000000001D0E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads