trickbot | b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28

General

Target

b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
Size

424KB
MD5

1a5431b82e0f025a38cd0b680b47997f
SHA1

6b524cd7797ef7d3822dd58f9146ae437d77097c
SHA256

b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28
SHA512

c4c9f251a6057c5cc58558ddd60148d869c1ba33a9b036eec7514c93d38fc1663473bdf004591527a3ed7a59ede46b100d7a47b74d7e81359dc99b5a6f123db3

Score

10^/10

trickbot lib5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe

pid process

1716 b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
Loads dropped DLL 1 IoCs

Processes:

b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe

pid process

824 b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1180 wermgr.exe

pid	process
1716	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe

pid	process
824	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe

description	pid	process
Token: SeDebugPrivilege	1180	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exeb607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe

description	pid	process	target process
PID 824 wrote to memory of 1716	824	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
PID 824 wrote to memory of 1716	824	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
PID 824 wrote to memory of 1716	824	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
PID 824 wrote to memory of 1716	824	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
PID 1716 wrote to memory of 1180	1716	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	wermgr.exe
PID 1716 wrote to memory of 1180	1716	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	wermgr.exe
PID 1716 wrote to memory of 1180	1716	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	wermgr.exe
PID 1716 wrote to memory of 1180	1716	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	wermgr.exe
PID 1716 wrote to memory of 1180	1716	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	wermgr.exe
PID 1716 wrote to memory of 1180	1716	b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
"C:\Users\Admin\AppData\Local\Temp\b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824

C:\Users\Admin\AppData\Roaming\DesktopColor\b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1180

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
Filesize
424KB

MD5
1a5431b82e0f025a38cd0b680b47997f

SHA1
6b524cd7797ef7d3822dd58f9146ae437d77097c

SHA256
b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28

SHA512
c4c9f251a6057c5cc58558ddd60148d869c1ba33a9b036eec7514c93d38fc1663473bdf004591527a3ed7a59ede46b100d7a47b74d7e81359dc99b5a6f123db3

Download Submit
\Users\Admin\AppData\Roaming\DesktopColor\b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28.exe
Filesize
424KB

MD5
1a5431b82e0f025a38cd0b680b47997f

SHA1
6b524cd7797ef7d3822dd58f9146ae437d77097c

SHA256
b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28

SHA512
c4c9f251a6057c5cc58558ddd60148d869c1ba33a9b036eec7514c93d38fc1663473bdf004591527a3ed7a59ede46b100d7a47b74d7e81359dc99b5a6f123db3

Download Submit
memory/824-54-0x0000000075741000-0x0000000075743000-memory.dmp

Filesize
8KB

Download
memory/824-55-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/824-56-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1180-63-0x0000000000000000-mapping.dmp

Download
memory/1180-64-0x00000000000E0000-0x0000000000107000-memory.dmp

Filesize
156KB

Download
memory/1180-65-0x00000000000E0000-0x0000000000107000-memory.dmp

Filesize
156KB

Download
memory/1716-58-0x0000000000000000-mapping.dmp

Download
memory/1716-61-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1716-62-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing