trickbot | aa7da7a2626283ac6f13814e42665a2875ec0ee1a0eb0b0d0e5ddf0de3a97ecd

Analysis

Target
9459cddst.exe
Size 330KB
Sample200806-d447de5kbx
SHA256 aa7da7a2626283ac6f13814e42665a2875ec0ee1a0eb0b0d0e5ddf0de3a97ecd
MD5 75ec860fd26849580bad7e4a6f1da0bc
SHA1 c033c5446a5e346cfee1cbc4495503a4bf9ff045
SHA512 c0c9c694202afc2675174c16476f9813ffae06038bba23f086366dc5fb812d7f2c8f35db0bebad23f643e8c19c1d0fa165f35901ac5cd4bbba1a6205ad80e8a3
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral2/memory/3496-0-0x0000000000A90000-0x0000000000AC6000-memory.dmp	dave
behavioral2/memory/3496-0-0x0000000000A90000-0x0000000000AC6000-memory.dmp	dave

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	icanhazip.com

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3496	9459cddst.exe
3496	9459cddst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2488	3496	9459cddst.exe	73
PID 3496 wrote to memory of 2488	3496	9459cddst.exe	73
PID 3496 wrote to memory of 2488	3496	9459cddst.exe	73
PID 3496 wrote to memory of 2488	3496	9459cddst.exe	73

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\9459cddst.exe
"C:\Users\Admin\AppData\Local\Temp\9459cddst.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2488

memory/3496-0-0x0000000000A90000-0x0000000000AC6000-memory.dmp

Download

memory/3496-1-0x0000000000F70000-0x0000000000FA3000-memory.dmp

Download