trickbot | 352ea94d9fdb88e620f9ae795f810ab70e9b0c4e5c49afb40014c814045b853e

Analysis

Target
9759cddst.exe
Size 330KB
Sample200806-1vvj6wehee
SHA256 352ea94d9fdb88e620f9ae795f810ab70e9b0c4e5c49afb40014c814045b853e
MD5 5ef8a17f02e935caca3e7bc2eea8ffab
SHA1 e42df147f40df6c6cf69b0baf6263135f227fcb4
SHA512 46198f52f83c18d310a89175acc9fb5336e0425d5afb0d25348f5aa338fa52c70ae987190a2d291c189d534e75253eb3eb19a76dd3ca9fecb2ed9efcbdb3c5fd
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3852	3612	9759cddst.exe	68
PID 3612 wrote to memory of 3852	3612	9759cddst.exe	68
PID 3612 wrote to memory of 3852	3612	9759cddst.exe	68
PID 3612 wrote to memory of 3852	3612	9759cddst.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral2/memory/3612-0-0x0000000000A40000-0x0000000000A76000-memory.dmp	dave
behavioral2/memory/3612-0-0x0000000000A40000-0x0000000000A76000-memory.dmp	dave

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	9759cddst.exe
3612	9759cddst.exe

C:\Users\Admin\AppData\Local\Temp\9759cddst.exe
"C:\Users\Admin\AppData\Local\Temp\9759cddst.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3612
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3852

memory/3612-0-0x0000000000A40000-0x0000000000A76000-memory.dmp

Download

memory/3612-1-0x0000000001060000-0x0000000001093000-memory.dmp

Download