trickbot | 20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a

General

Target
20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
Size 1.0MB
Sample220128-1q1ehsedhj
SHA256 20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a
MD5 5a06b3a2dd6f6de9c920884f62eecd29
SHA1 295a0d5be269c83ecc4e72f1519dc4278f08dbec
SHA512 c31c71ec8dc2182a6f5626247f28434afef4a9010626c77b3b2afa22904689b7dfbcdaa69a49da8b6f8b55d78196a793eab7b93d4e8c6cbe5419aab7c257dc05
MD5 SHA1 SHA512

Score

10^/10

trickbot trg4488 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000477

Botnet

trg4488

C2

37.44.212.148:443
185.65.202.127:443
193.37.212.246:443
193.124.191.243:443
31.148.99.63:443
94.103.91.61:443
203.23.128.179:443
179.43.147.72:443
93.123.73.192:443
51.89.115.120:443
144.91.76.214:443
46.21.153.81:443
194.5.250.98:443
190.154.203.218:449
178.183.150.169:449
200.116.199.10:449
181.113.20.186:449
187.58.56.26:449
85.11.116.194:449
177.103.240.149:449
81.190.160.139:449
200.21.51.38:449
181.49.61.237:449
46.174.235.36:449
91.232.52.187:449
36.89.85.103:449
31.128.13.45:449
186.42.185.10:449
170.233.120.53:449
89.228.243.148:449
31.214.138.207:449
186.42.98.254:449
195.93.223.100:449
181.112.52.26:449
190.13.160.19:449
186.47.122.182:449
186.71.150.23:449
190.152.4.98:449
170.82.156.53:449
131.161.253.190:449
181.113.114.50:449
186.47.121.58:449
185.70.182.162:449
200.127.121.99:449
45.235.213.126:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/2080-119-0x0000000002380000-0x00000000023AE000-memory.dmp	trickbot_loader32
behavioral2/memory/2080-123-0x0000000002230000-0x000000000225C000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2080	вуоюа.exe
3996	стсва.exe
524	вуоюа.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	656	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
2080	вуоюа.exe
2080	вуоюа.exe
524	вуоюа.exe
524	вуоюа.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2080	3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	68
PID 3708 wrote to memory of 2080	3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	68
PID 3708 wrote to memory of 2080	3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	68
PID 3708 wrote to memory of 3996	3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	69
PID 3708 wrote to memory of 3996	3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	69
PID 3708 wrote to memory of 3996	3708	20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe	69
PID 2080 wrote to memory of 4380	2080	вуоюа.exe	71
PID 2080 wrote to memory of 4380	2080	вуоюа.exe	71
PID 2080 wrote to memory of 4380	2080	вуоюа.exe	71
PID 2080 wrote to memory of 4380	2080	вуоюа.exe	71
PID 524 wrote to memory of 656	524	вуоюа.exe	73
PID 524 wrote to memory of 656	524	вуоюа.exe	73
PID 524 wrote to memory of 656	524	вуоюа.exe	73
PID 524 wrote to memory of 656	524	вуоюа.exe	73

C:\Users\Admin\AppData\Local\Temp\20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe
"C:\Users\Admin\AppData\Local\Temp\20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708
- C:\ProgramData\вуоюа.exe
  "C:\ProgramData\вуоюа.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4380
- C:\ProgramData\стсва.exe
  "C:\ProgramData\стсва.exe"
  2⤵
  - Executes dropped EXE
  PID:3996

C:\Users\Admin\AppData\Roaming\HomeLan\вуоюа.exe
C:\Users\Admin\AppData\Roaming\HomeLan\вуоюа.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-136-0x0000017CFE880000-0x0000017CFE89E000-memory.dmp

Download

memory/2080-119-0x0000000002380000-0x00000000023AE000-memory.dmp

Download

memory/2080-123-0x0000000002230000-0x000000000225C000-memory.dmp

Download

memory/3996-122-0x0000000005320000-0x000000000581E000-memory.dmp

Download

memory/3996-126-0x0000000004F90000-0x0000000004F9A000-memory.dmp

Download

memory/3996-125-0x0000000004E20000-0x000000000531E000-memory.dmp

Download

memory/3996-124-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Download

memory/3996-121-0x00000000005E0000-0x00000000005E8000-memory.dmp

Download

memory/4380-129-0x0000018588F40000-0x0000018588F5E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads