trickbot | 37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935

General

Target

37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe
Size

328KB
MD5

0eba374e54412c66d6e63efe31c6446a
SHA1

4b44576383a558237f931faf7483fe5ae3450ccf
SHA256

37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935
SHA512

90232674cf45466775a017552fd1074e64820c210b845ae950d758c214c0d3c3aeedbb773367f05ff15c88b4a221aad0e138b07aa13ab6582d1c23b49e40aefb

Score

10^/10

trickbot win165 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000474

Botnet

win165

C2

51.68.247.62:443

37.228.117.146:443

91.132.139.170:443

37.44.212.216:443

31.184.253.37:443

51.254.69.244:443

194.5.250.82:443

5.230.22.40:443

185.222.202.222:443

46.30.41.229:443

203.23.128.168:443

190.154.203.218:449

189.80.134.122:449

200.116.199.10:449

181.113.20.186:449

187.58.56.26:449

146.196.122.167:449

177.103.240.149:449

181.199.102.179:449

200.21.51.38:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 5 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/4920-133-0x0000000002100000-0x000000000212D000-memory.dmp	trickbot_loader32
behavioral2/memory/4920-135-0x0000000002100000-0x000000000212D000-memory.dmp	trickbot_loader32
behavioral2/memory/4920-137-0x0000000002100000-0x000000000212D000-memory.dmp	trickbot_loader32
behavioral2/memory/4852-148-0x0000000000F10000-0x0000000000F3D000-memory.dmp	trickbot_loader32
behavioral2/memory/4852-150-0x0000000000F10000-0x0000000000F3D000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe

pid process

4852 39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 1660 svchost.exe

pid	process
4852	39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe

description	pid	process
Token: SeTcbPrivilege	1660	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe

pid	process
4920	37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe
4920	37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe
4852	39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe
4852	39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe

description	pid	process	target process
PID 4920 wrote to memory of 684	4920	37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe	svchost.exe
PID 4920 wrote to memory of 684	4920	37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe	svchost.exe
PID 4920 wrote to memory of 684	4920	37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe	svchost.exe
PID 4920 wrote to memory of 684	4920	37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe	svchost.exe
PID 4852 wrote to memory of 1660	4852	39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe	svchost.exe
PID 4852 wrote to memory of 1660	4852	39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe	svchost.exe
PID 4852 wrote to memory of 1660	4852	39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe	svchost.exe
PID 4852 wrote to memory of 1660	4852	39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe
"C:\Users\Admin\AppData\Local\Temp\37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:684

C:\Users\Admin\AppData\Roaming\iCloud\39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe
C:\Users\Admin\AppData\Roaming\iCloud\39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\iCloud\39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe
Filesize
328KB

MD5
0eba374e54412c66d6e63efe31c6446a

SHA1
4b44576383a558237f931faf7483fe5ae3450ccf

SHA256
37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935

SHA512
90232674cf45466775a017552fd1074e64820c210b845ae950d758c214c0d3c3aeedbb773367f05ff15c88b4a221aad0e138b07aa13ab6582d1c23b49e40aefb

Download Submit
C:\Users\Admin\AppData\Roaming\iCloud\39188c1a0dd8d880184e90d82b0ad98c89d499092b8d9eea89e998f1ea19f937.exe
Filesize
328KB

MD5
0eba374e54412c66d6e63efe31c6446a

SHA1
4b44576383a558237f931faf7483fe5ae3450ccf

SHA256
37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935

SHA512
90232674cf45466775a017552fd1074e64820c210b845ae950d758c214c0d3c3aeedbb773367f05ff15c88b4a221aad0e138b07aa13ab6582d1c23b49e40aefb

Download Submit
memory/684-136-0x0000000000000000-mapping.dmp

Download
memory/684-138-0x000002D85AD70000-0x000002D85AD8D000-memory.dmp

Filesize
116KB

Download
memory/684-139-0x000002D85AD70000-0x000002D85AD8D000-memory.dmp

Filesize
116KB

Download
memory/684-140-0x000002D85AD70000-0x000002D85AD8D000-memory.dmp

Filesize
116KB

Download
memory/1660-149-0x0000000000000000-mapping.dmp

Download
memory/1660-152-0x0000025E2BAA0000-0x0000025E2BABD000-memory.dmp

Filesize
116KB

Download
memory/1660-151-0x0000025E2BAA0000-0x0000025E2BABD000-memory.dmp

Filesize
116KB

Download
memory/4852-148-0x0000000000F10000-0x0000000000F3D000-memory.dmp

Filesize
180KB

Download
memory/4852-150-0x0000000000F10000-0x0000000000F3D000-memory.dmp

Filesize
180KB

Download
memory/4920-133-0x0000000002100000-0x000000000212D000-memory.dmp

Filesize
180KB

Download
memory/4920-137-0x0000000002100000-0x000000000212D000-memory.dmp

Filesize
180KB

Download
memory/4920-135-0x0000000002100000-0x000000000212D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads