trickbot | bf40ea308e1ba8f7e80cf196d57836dbc8bdb45ff788308b0857b00fe9295302

Analysis

Target
5589cddst.exe
Size 330KB
Sample200806-hem4yk41qa
SHA256 bf40ea308e1ba8f7e80cf196d57836dbc8bdb45ff788308b0857b00fe9295302
MD5 4e52a824e05aac22d6d12cd901fe1252
SHA1 be348548ee667af98f0f571bf6f9a97482451749
SHA512 2bcaff580d1474af1fc8933a9baca986acb2f0179b524c029e08dff18ef5e8af0a732297c738a4cba3760f7ed55323e6b845f8dd2a1de91994f5576cd498d65b
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
608	5589cddst.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 1600	608	5589cddst.exe	25
PID 608 wrote to memory of 1600	608	5589cddst.exe	25
PID 608 wrote to memory of 1600	608	5589cddst.exe	25
PID 608 wrote to memory of 1600	608	5589cddst.exe	25
PID 608 wrote to memory of 1600	608	5589cddst.exe	25
PID 608 wrote to memory of 1600	608	5589cddst.exe	25

Suspicious use of AdjustPrivilegeToken 3 IoCs

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral1/memory/608-0-0x0000000000390000-0x00000000003C6000-memory.dmp	dave
behavioral1/memory/608-0-0x0000000000390000-0x00000000003C6000-memory.dmp	dave

C:\Users\Admin\AppData\Local\Temp\5589cddst.exe
"C:\Users\Admin\AppData\Local\Temp\5589cddst.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1600

memory/608-0-0x0000000000390000-0x00000000003C6000-memory.dmp

Download

memory/608-1-0x00000000006B0000-0x00000000006E3000-memory.dmp

Download