trickbot | d194827abd2921b2cd29775c574de483a68d8d6669c96d1e55f291a3a9824a3c

General

Target

37414e9054e872f98444f8c5f5ab02b6.exe
Size

577KB
MD5

37414e9054e872f98444f8c5f5ab02b6
SHA1

bb0eff99d9c2329221a9a3709a944da9f19e56b3
SHA256

d194827abd2921b2cd29775c574de483a68d8d6669c96d1e55f291a3a9824a3c
SHA512

a5e8a95b9f72524f185d2efeec867d05df6cf5cb6855e681c0646bb136195f06fd2be0311d5496ca516ce7e85ec56de25dd2d5ad4c3ebb5193f09bd7ded37f58
SSDEEP

12288:Y7Uf8oOcZoqp4VKC/b1GqvDTUZ4YAGbThGb:Y7UflLs/b1GqvDTUaYAGbTwb

Score

10^/10

trickbot lib156 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

lib156

C2

179.42.137.102:443

191.36.152.198:443

179.42.137.104:443

179.42.137.106:443

179.42.137.108:443

202.183.12.124:443

194.190.18.122:443

103.56.207.230:443

171.103.187.218:449

171.103.189.118:449

18.139.111.104:443

179.42.137.105:443

186.4.193.75:443

171.101.229.2:449

179.42.137.107:443

103.56.43.209:449

179.42.137.110:443

45.181.207.156:443

197.44.54.162:449

179.42.137.109:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\DefaultIcon	37414e9054e872f98444f8c5f5ab02b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37414E~1.EXE,1"	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto\command	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto	37414e9054e872f98444f8c5f5ab02b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37414E~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	37414e9054e872f98444f8c5f5ab02b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ = "Widget.Document"	37414e9054e872f98444f8c5f5ab02b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\ = "Widget Document"	37414e9054e872f98444f8c5f5ab02b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37414E~1.EXE \"%1\""	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print\command	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg	37414e9054e872f98444f8c5f5ab02b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ShellNew\NullFile	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open\command	37414e9054e872f98444f8c5f5ab02b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37414E~1.EXE /p \"%1\""	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdg\ShellNew	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\open	37414e9054e872f98444f8c5f5ab02b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Widget.Document\shell\print	37414e9054e872f98444f8c5f5ab02b6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	324	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3532	37414e9054e872f98444f8c5f5ab02b6.exe
3532	37414e9054e872f98444f8c5f5ab02b6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 324	3532	37414e9054e872f98444f8c5f5ab02b6.exe	91
PID 3532 wrote to memory of 324	3532	37414e9054e872f98444f8c5f5ab02b6.exe	91
PID 3532 wrote to memory of 2592	3532	37414e9054e872f98444f8c5f5ab02b6.exe	92
PID 3532 wrote to memory of 2592	3532	37414e9054e872f98444f8c5f5ab02b6.exe	92
PID 3532 wrote to memory of 324	3532	37414e9054e872f98444f8c5f5ab02b6.exe	91
PID 3532 wrote to memory of 324	3532	37414e9054e872f98444f8c5f5ab02b6.exe	91

C:\Users\Admin\AppData\Local\Temp\37414e9054e872f98444f8c5f5ab02b6.exe
"C:\Users\Admin\AppData\Local\Temp\37414e9054e872f98444f8c5f5ab02b6.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/324-10-0x000002A3B1F20000-0x000002A3B1F21000-memory.dmp

Filesize
4KB

Download
memory/324-11-0x000002A3B1DC0000-0x000002A3B1DE9000-memory.dmp

Filesize
164KB

Download
memory/324-14-0x000002A3B1DC0000-0x000002A3B1DE9000-memory.dmp

Filesize
164KB

Download
memory/3532-0-0x00000000024E0000-0x000000000251F000-memory.dmp

Filesize
252KB

Download
memory/3532-1-0x00000000024A0000-0x00000000024DC000-memory.dmp

Filesize
240KB

Download
memory/3532-5-0x0000000002520000-0x000000000255B000-memory.dmp

Filesize
236KB

Download
memory/3532-6-0x0000000002520000-0x000000000255B000-memory.dmp

Filesize
236KB

Download
memory/3532-7-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/3532-8-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/3532-9-0x00000000022D0000-0x00000000022E1000-memory.dmp

Filesize
68KB

Download
memory/3532-13-0x0000000002520000-0x000000000255B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing