trickbot | e9b27da1ec3f6f1526498a02162e2bb246043da68f68f1a16b07c8f520a22a97

Analysis

Target
9679cddst.exe
Size 330KB
Sample200806-7kb5wf8dsj
SHA256 e9b27da1ec3f6f1526498a02162e2bb246043da68f68f1a16b07c8f520a22a97
MD5 319951d978a2ef56dbcb6116ddbcd04a
SHA1 812c0f2b93c94f624e7f56d4ab45dcf95999b159
SHA512 743cf90d8793d045afa0a0d3e894dae6522198040c38712abf6a9b7f0a489e67b772d5c6140392a66e35952b55ade9ecf57997042772959ce476fcdf83d12021
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral2/memory/3884-0-0x0000000000700000-0x0000000000736000-memory.dmp	dave
behavioral2/memory/3884-0-0x0000000000700000-0x0000000000736000-memory.dmp	dave

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	api.ipify.org
22	api.ipify.org

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3884	9679cddst.exe
3884	9679cddst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3148	3884	9679cddst.exe	68
PID 3884 wrote to memory of 3148	3884	9679cddst.exe	68
PID 3884 wrote to memory of 3148	3884	9679cddst.exe	68
PID 3884 wrote to memory of 3148	3884	9679cddst.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\9679cddst.exe
"C:\Users\Admin\AppData\Local\Temp\9679cddst.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3148

memory/3884-0-0x0000000000700000-0x0000000000736000-memory.dmp

Download

memory/3884-1-0x0000000000F40000-0x0000000000F73000-memory.dmp

Download