trickbot | 7e583c93312343cdae6b536e554bb45b66445e570c8bd0cede093bd6d22d5c2f

Analysis

Target
7619cddst.exe
Size 330KB
Sample200806-rtyw2k2bfe
SHA256 7e583c93312343cdae6b536e554bb45b66445e570c8bd0cede093bd6d22d5c2f
MD5 28472fd1eaa6c792ea38012bc85bccde
SHA1 9f7e5317625c846773007f45b3b97e9b8207a85a
SHA512 64c16023dbfa4ffe1155155688266dd29521a7a97459efa549be49bb402021661443d31affaf01690214519ed1c6a34ca1a268a91e561a75ec4d454d1674d0f1
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3888	7619cddst.exe
3888	7619cddst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3856	3888	7619cddst.exe	68
PID 3888 wrote to memory of 3856	3888	7619cddst.exe	68
PID 3888 wrote to memory of 3856	3888	7619cddst.exe	68
PID 3888 wrote to memory of 3856	3888	7619cddst.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral2/memory/3888-0-0x0000000000AA0000-0x0000000000AD6000-memory.dmp	dave
behavioral2/memory/3888-0-0x0000000000AA0000-0x0000000000AD6000-memory.dmp	dave

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

C:\Users\Admin\AppData\Local\Temp\7619cddst.exe
"C:\Users\Admin\AppData\Local\Temp\7619cddst.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3856

memory/3888-0-0x0000000000AA0000-0x0000000000AD6000-memory.dmp

Download

memory/3888-1-0x0000000000C30000-0x0000000000C63000-memory.dmp

Download