trickbot | e59e7db0c75cef4bb6e057d725bae7ed5e13fd011b54fe39c3fe7cdb123b684f

Analysis

max time kernel
298s
max time network
313s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-06-2022 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe
Size

860KB
MD5

02adc56200b095ac950730eb3458ce9d
SHA1

ddecba68da8e16bfc2638b48a2080104b180b12e
SHA256

6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65
SHA512

5f25c4953683279894086126a7eae6babd25b1f9ffbe367eecf46f6f9dc08f05fd4a94027d9cadeeca21d5d499e5bb96f3e4b7d660c1eeb1f8876addc1d2f885

Score

10^/10

trickbot lib101 banker suricata trojan

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

lib101

38.110.103.124:443

185.56.76.28:443

204.138.26.60:443

60.51.47.65:443

74.85.157.139:443

68.69.26.182:443

38.110.103.136:443

38.110.103.18:443

138.34.28.219:443

185.56.76.94:443

217.115.240.248:443

24.162.214.166:443

80.15.2.105:443

154.58.23.192:443

38.110.100.104:443

45.36.99.184:443

185.56.76.108:443

185.56.76.72:443

138.34.28.35:443

97.83.40.67:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe
1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 908	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	28
PID 1360 wrote to memory of 908	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	28
PID 1360 wrote to memory of 908	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	28
PID 1360 wrote to memory of 908	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	28
PID 1360 wrote to memory of 1632	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	29
PID 1360 wrote to memory of 1632	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	29
PID 1360 wrote to memory of 1632	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	29
PID 1360 wrote to memory of 1632	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	29
PID 1360 wrote to memory of 1864	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	30
PID 1360 wrote to memory of 1864	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	30
PID 1360 wrote to memory of 1864	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	30
PID 1360 wrote to memory of 1864	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	30
PID 1360 wrote to memory of 1864	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	30
PID 1360 wrote to memory of 1864	1360	6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe	30

C:\Users\Admin\AppData\Local\Temp\6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe
"C:\Users\Admin\AppData\Local\Temp\6c95be6a536264db1dcb3c13b03b6f67d04b75a49cb9411fa294352590df2e65.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1632
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-54-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/1360-55-0x00000000003B0000-0x00000000003EF000-memory.dmp

Filesize
252KB

Download
memory/1360-59-0x00000000005E0000-0x000000000061B000-memory.dmp

Filesize
236KB

Download
memory/1360-60-0x00000000002E0000-0x000000000031D000-memory.dmp

Filesize
244KB

Download
memory/1360-61-0x00000000005E0000-0x000000000061B000-memory.dmp

Filesize
236KB

Download
memory/1360-62-0x00000000005E0000-0x000000000061B000-memory.dmp

Filesize
236KB

Download
memory/1864-64-0x0000000000060000-0x0000000000089000-memory.dmp

Filesize
164KB

Download
memory/1864-65-0x0000000000060000-0x0000000000089000-memory.dmp

Filesize
164KB

Download