trickbot | e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9

General

Target

e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
Size

532KB
MD5

ea6f39acb40bc7588a44d21aec215fde
SHA1

c808aa81ece93d59cfbae95c9a18eab04357271e
SHA256

e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9
SHA512

aceee666114ae9a1821741352993d591888829ff9ea68ddee45685560731767378423c0bae883ee097d70de6121a03c708a2fb2753734cee535ab18d173f4840
SSDEEP

12288:xiWvyCvI9SzP01uxm7vz+8sexlwXduC7:/P01uxm7vz+8sY6ND7

Score

10^/10

trickbot tot37 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000024

Botnet

tot37

C2

85.93.159.98:449

92.242.214.203:449

202.21.103.194:449

169.239.45.42:449

45.234.248.66:449

103.91.244.102:449

118.67.216.238:449

117.212.193.62:449

201.184.190.59:449

103.29.185.138:449

79.122.166.236:449

37.143.150.186:449

179.191.108.58:449

85.159.214.61:443

149.56.80.31:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

pid process

3404 e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

pid	process
3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

Drops file in Program Files directory 2 IoCs

Processes:

e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

description	ioc	process
File created	C:\Program Files (x86)\DC\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
File opened for modification	C:\Program Files (x86)\DC\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3472 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	3472	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exee4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

pid	process
736	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exee4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe

description	pid	process	target process
PID 736 wrote to memory of 3404	736	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
PID 736 wrote to memory of 3404	736	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
PID 736 wrote to memory of 3404	736	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
PID 3404 wrote to memory of 1276	3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	wermgr.exe
PID 3404 wrote to memory of 1276	3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	wermgr.exe
PID 3404 wrote to memory of 3472	3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	wermgr.exe
PID 3404 wrote to memory of 3472	3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	wermgr.exe
PID 3404 wrote to memory of 3472	3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	wermgr.exe
PID 3404 wrote to memory of 3472	3404	e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
"C:\Users\Admin\AppData\Local\Temp\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:736

C:\Program Files (x86)\DC\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
"C:\Program Files (x86)\DC\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
PID:1276

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DC\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
Filesize
532KB

MD5
ea6f39acb40bc7588a44d21aec215fde

SHA1
c808aa81ece93d59cfbae95c9a18eab04357271e

SHA256
e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9

SHA512
aceee666114ae9a1821741352993d591888829ff9ea68ddee45685560731767378423c0bae883ee097d70de6121a03c708a2fb2753734cee535ab18d173f4840

Download Submit
C:\Program Files (x86)\DC\e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9.exe
Filesize
532KB

MD5
ea6f39acb40bc7588a44d21aec215fde

SHA1
c808aa81ece93d59cfbae95c9a18eab04357271e

SHA256
e4bc23d14095f02070ccdb3fcef59910725450a01015f82eebc14cbaa56237f9

SHA512
aceee666114ae9a1821741352993d591888829ff9ea68ddee45685560731767378423c0bae883ee097d70de6121a03c708a2fb2753734cee535ab18d173f4840

Download Submit
memory/736-134-0x0000000002CA0000-0x0000000002CD4000-memory.dmp

Filesize
208KB

Download
memory/736-135-0x0000000002CA0000-0x0000000002CD4000-memory.dmp

Filesize
208KB

Download
memory/736-143-0x0000000002CA0000-0x0000000002CD4000-memory.dmp

Filesize
208KB

Download
memory/3404-136-0x0000000000000000-mapping.dmp

Download
memory/3404-142-0x0000000002220000-0x0000000002254000-memory.dmp

Filesize
208KB

Download
memory/3404-146-0x0000000002220000-0x0000000002254000-memory.dmp

Filesize
208KB

Download
memory/3472-144-0x0000000000000000-mapping.dmp

Download
memory/3472-145-0x0000027CCF7C0000-0x0000027CCF7E7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads