trickbot | 4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9

Target
ACT96MC98SD.bin.dll
Size 260KB
Sample201024-ejsr16d3q6
SHA256 4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9
MD5 a7ddc63878394313d1a854e22b1c323f
SHA1 f4dae0a6e298a594faa76aac8f362030226fab77
SHA512 40fd700b40e52f426f4255bb7993736548f647f3a4831ee970f3128454cdabf15dc4f58c6c3a4fd635941f1703fce6acccfc355a94f7370a61649f577c553302
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Family

Version

Botnet

Attributes

ecc_pubkey.base64

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	wtfismyip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3672	3840	rundll32.exe	69
PID 3840 wrote to memory of 3672	3840	rundll32.exe	69
PID 3840 wrote to memory of 3672	3840	rundll32.exe	69
PID 3672 wrote to memory of 1296	3672	rundll32.exe	75
PID 3672 wrote to memory of 1296	3672	rundll32.exe	75
PID 3672 wrote to memory of 1296	3672	rundll32.exe	75
PID 3672 wrote to memory of 1296	3672	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ACT96MC98SD.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ACT96MC98SD.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1296

memory/3672-1-0x0000000000510000-0x0000000000548000-memory.dmp

Download

memory/3672-2-0x0000000000760000-0x0000000000796000-memory.dmp

Download