trickbot | fcd85ad647f97a9c79afab26f46ce4190220cd047c3792b1d5c2d43cc48ec3ad

Analysis

Target
1869cddst.exe
Size 330KB
Sample200806-lhtgexpnxj
SHA256 fcd85ad647f97a9c79afab26f46ce4190220cd047c3792b1d5c2d43cc48ec3ad
MD5 a989685df97d4922cf60af289bb2a311
SHA1 556704f5e12a940738457a5e4f265ef7e8f7dcd8
SHA512 c353dffd6616086c8355513c75f44a6a0f29b92926a4f52c146dfc747ffc0cec1e54ad740d40a0c4cd102aaab8525e64d541b9a03f16e411890ceaf36ff7d403
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1580	2076	1869cddst.exe	69
PID 2076 wrote to memory of 1580	2076	1869cddst.exe	69
PID 2076 wrote to memory of 1580	2076	1869cddst.exe	69
PID 2076 wrote to memory of 1580	2076	1869cddst.exe	69

Suspicious use of AdjustPrivilegeToken 3 IoCs

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral2/memory/2076-0-0x0000000000A40000-0x0000000000A76000-memory.dmp	dave
behavioral2/memory/2076-0-0x0000000000A40000-0x0000000000A76000-memory.dmp	dave

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	1869cddst.exe
2076	1869cddst.exe

C:\Users\Admin\AppData\Local\Temp\1869cddst.exe
"C:\Users\Admin\AppData\Local\Temp\1869cddst.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:2076
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1580

memory/2076-0-0x0000000000A40000-0x0000000000A76000-memory.dmp

Download

memory/2076-1-0x0000000000AC0000-0x0000000000AF3000-memory.dmp

Download