trickbot | 5c5f07a0786a6bf7efb7a45397b53ffdef7c7ae467cd2c8bd4d1c6c254c1daa5

Analysis

Target
2729cddst.exe
Size 330KB
Sample200806-vy94b77kn2
SHA256 5c5f07a0786a6bf7efb7a45397b53ffdef7c7ae467cd2c8bd4d1c6c254c1daa5
MD5 c50af43999eeb50ff9a76fd2e02eb920
SHA1 383f550d23fd52334ff7c5ee0d52000ade2cda0b
SHA512 a750184189e4bdf9debe470ee925e594d061f06f87ac136f9507b7ff9bd4671950a12a7b157a746c1db9765a24e34c921dedaa8f27807de6593ee36d6e1978d7
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2896	2729cddst.exe
2896	2729cddst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4044	2896	2729cddst.exe	68
PID 2896 wrote to memory of 4044	2896	2729cddst.exe	68
PID 2896 wrote to memory of 4044	2896	2729cddst.exe	68
PID 2896 wrote to memory of 4044	2896	2729cddst.exe	68

Suspicious use of AdjustPrivilegeToken 3 IoCs

Dave packer 2 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

resource	yara_rule
behavioral2/memory/2896-0-0x0000000000A40000-0x0000000000A76000-memory.dmp	dave
behavioral2/memory/2896-0-0x0000000000A40000-0x0000000000A76000-memory.dmp	dave

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	icanhazip.com

C:\Users\Admin\AppData\Local\Temp\2729cddst.exe
"C:\Users\Admin\AppData\Local\Temp\2729cddst.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4044

memory/2896-0-0x0000000000A40000-0x0000000000A76000-memory.dmp

Download

memory/2896-1-0x0000000001060000-0x0000000001093000-memory.dmp

Download