trickbot | e9b27da1ec3f6f1526498a02162e2bb246043da68f68f1a16b07c8f520a22a97

Analysis

Target
9679cddst.exe
Size 330KB
Sample200806-7kb5wf8dsj
SHA256 e9b27da1ec3f6f1526498a02162e2bb246043da68f68f1a16b07c8f520a22a97
MD5 319951d978a2ef56dbcb6116ddbcd04a
SHA1 812c0f2b93c94f624e7f56d4ab45dcf95999b159
SHA512 743cf90d8793d045afa0a0d3e894dae6522198040c38712abf6a9b7f0a489e67b772d5c6140392a66e35952b55ade9ecf57997042772959ce476fcdf83d12021
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral1/memory/1124-0-0x00000000002B0000-0x00000000002E6000-memory.dmp	dave
behavioral1/memory/1124-0-0x00000000002B0000-0x00000000002E6000-memory.dmp	dave

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1124	9679cddst.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1500	1124	9679cddst.exe	25
PID 1124 wrote to memory of 1500	1124	9679cddst.exe	25
PID 1124 wrote to memory of 1500	1124	9679cddst.exe	25
PID 1124 wrote to memory of 1500	1124	9679cddst.exe	25
PID 1124 wrote to memory of 1500	1124	9679cddst.exe	25
PID 1124 wrote to memory of 1500	1124	9679cddst.exe	25

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\9679cddst.exe
"C:\Users\Admin\AppData\Local\Temp\9679cddst.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1500

memory/1124-0-0x00000000002B0000-0x00000000002E6000-memory.dmp

Download

memory/1124-1-0x0000000000340000-0x0000000000373000-memory.dmp

Download