trickbot | 42ce7b6f24ecb6147af7f9e878093ffd58d66837bc86d84a62bacbaaeae1a370

Analysis

Target
2679cddst.exe
Size 330KB
Sample200806-345ysfl6ve
SHA256 42ce7b6f24ecb6147af7f9e878093ffd58d66837bc86d84a62bacbaaeae1a370
MD5 2ddfd778a788f653d3c4099f7d0cb627
SHA1 82e4a27eaa3a2707f7345f1361c6c564637aeb47
SHA512 f0852a5ae48831f9138f757a01129e1170a62a441861c4f9add1a2dab96b5bef1de48a2213d63f6f00264368001da13aa557d0e82afd7937ab8f3d8bb26d4b92
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3840	2460	2679cddst.exe	68
PID 2460 wrote to memory of 3840	2460	2679cddst.exe	68
PID 2460 wrote to memory of 3840	2460	2679cddst.exe	68
PID 2460 wrote to memory of 3840	2460	2679cddst.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral2/memory/2460-0-0x0000000000A30000-0x0000000000A66000-memory.dmp	dave
behavioral2/memory/2460-0-0x0000000000A30000-0x0000000000A66000-memory.dmp	dave

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2460	2679cddst.exe
2460	2679cddst.exe

C:\Users\Admin\AppData\Local\Temp\2679cddst.exe
"C:\Users\Admin\AppData\Local\Temp\2679cddst.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:2460
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3840

memory/2460-0-0x0000000000A30000-0x0000000000A66000-memory.dmp

Download

memory/2460-1-0x0000000000AF0000-0x0000000000B23000-memory.dmp

Download