trickbot | 4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9

Target
ACT96MC98SD.bin.dll
Size 260KB
Sample201024-ejsr16d3q6
SHA256 4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9
MD5 a7ddc63878394313d1a854e22b1c323f
SHA1 f4dae0a6e298a594faa76aac8f362030226fab77
SHA512 40fd700b40e52f426f4255bb7993736548f647f3a4831ee970f3128454cdabf15dc4f58c6c3a4fd635941f1703fce6acccfc355a94f7370a61649f577c553302
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ident.me
18	ident.me

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1644	1160	rundll32.exe	24
PID 1160 wrote to memory of 1644	1160	rundll32.exe	24
PID 1160 wrote to memory of 1644	1160	rundll32.exe	24
PID 1160 wrote to memory of 1644	1160	rundll32.exe	24
PID 1160 wrote to memory of 1644	1160	rundll32.exe	24
PID 1160 wrote to memory of 1644	1160	rundll32.exe	24
PID 1160 wrote to memory of 1644	1160	rundll32.exe	24
PID 1644 wrote to memory of 1884	1644	rundll32.exe	29
PID 1644 wrote to memory of 1884	1644	rundll32.exe	29
PID 1644 wrote to memory of 1884	1644	rundll32.exe	29
PID 1644 wrote to memory of 1884	1644	rundll32.exe	29
PID 1644 wrote to memory of 1884	1644	rundll32.exe	29
PID 1644 wrote to memory of 1884	1644	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ACT96MC98SD.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ACT96MC98SD.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1884

memory/1644-1-0x00000000007E0000-0x0000000000818000-memory.dmp

Download

memory/1644-2-0x0000000000820000-0x0000000000856000-memory.dmp

Download