trickbot | 0298cdd98ba76ebbbe93bc4036011961efb0971fffb89f1256ff652d751b8689

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8bfdf5d48b8918f94d0e567b833525f8.exe
Size

756KB
MD5

8bfdf5d48b8918f94d0e567b833525f8
SHA1

1c4b488aa2409620bb9b8715cc53290b6dbf74ef
SHA256

0298cdd98ba76ebbbe93bc4036011961efb0971fffb89f1256ff652d751b8689
SHA512

d740bf2650e6608168a28ad4960dbfac165bee34b2b2db725d189e2e8e7afec2e5a043d46034ad72f3618df69495d9c93fdca7cf767a36b656c6a44d61dd40d7
SSDEEP

12288:weTBslq08I3L92xhqmqUVWFxjP2/jxEnU2vMQsK:5tI3L9WqdjP+67j

Score

10^/10

trickbot top115 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

top115

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2536	8bfdf5d48b8918f94d0e567b833525f8.exe
2536	8bfdf5d48b8918f94d0e567b833525f8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3752	2536	8bfdf5d48b8918f94d0e567b833525f8.exe	83
PID 2536 wrote to memory of 3752	2536	8bfdf5d48b8918f94d0e567b833525f8.exe	83
PID 2536 wrote to memory of 1284	2536	8bfdf5d48b8918f94d0e567b833525f8.exe	84
PID 2536 wrote to memory of 1284	2536	8bfdf5d48b8918f94d0e567b833525f8.exe	84
PID 2536 wrote to memory of 3752	2536	8bfdf5d48b8918f94d0e567b833525f8.exe	83
PID 2536 wrote to memory of 3752	2536	8bfdf5d48b8918f94d0e567b833525f8.exe	83

C:\Users\Admin\AppData\Local\Temp\8bfdf5d48b8918f94d0e567b833525f8.exe
"C:\Users\Admin\AppData\Local\Temp\8bfdf5d48b8918f94d0e567b833525f8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-0-0x0000000002420000-0x000000000245C000-memory.dmp

Filesize
240KB

Download
memory/2536-1-0x0000000002460000-0x000000000249F000-memory.dmp

Filesize
252KB

Download
memory/2536-5-0x0000000003CD0000-0x0000000003D0A000-memory.dmp

Filesize
232KB

Download
memory/2536-6-0x0000000003CD0000-0x0000000003D0A000-memory.dmp

Filesize
232KB

Download
memory/2536-8-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2536-7-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2536-9-0x0000000002400000-0x0000000002413000-memory.dmp

Filesize
76KB

Download
memory/2536-13-0x0000000003CD0000-0x0000000003D0A000-memory.dmp

Filesize
232KB

Download
memory/3752-10-0x0000021301E80000-0x0000021301E81000-memory.dmp

Filesize
4KB

Download
memory/3752-11-0x0000021301CE0000-0x0000021301D09000-memory.dmp

Filesize
164KB

Download
memory/3752-15-0x0000021301CE0000-0x0000021301D09000-memory.dmp

Filesize
164KB

Download