trickbot | dde87eaee93e96c14a683e7ac0ae4cbcc30265fc17067fe3fd0f159aa3c2aeeb

Analysis

max time kernel
109s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
04-12-2020 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

284KB
MD5

99b81672c6ec04e7e6e6063b40d9127c
SHA1

2f29fb6c87fd77f2ff5df3312e0c0667b76af3cf
SHA256

447e9c417b7c9cf6e03086ca1da31a718e5159f454bf91efad09f240572db967
SHA512

b0e877ed117457a8a4458816309c8e68a911e0b6d17d449730e09beec84174abd3b97493dcea6b3dc55617471797371d4d6cf84c58f117b8bf826da0349d3e8f

Score

10^/10

trickbot yas31 banker dave trojan

Malware Config

Extracted

Family

trickbot

Version

1000508

Botnet

yas31

164.132.255.19:443

188.119.113.114:443

176.119.159.147:443

51.254.164.243:443

178.156.202.251:443

185.234.72.24:443

194.5.250.52:443

217.12.209.244:443

185.99.2.123:443

185.198.57.75:443

93.189.42.81:443

148.251.185.186:443

79.137.101.2:443

51.89.115.121:443

91.200.100.84:443

194.5.250.69:443

185.14.30.45:443

185.99.2.142:443

107.175.133.162:443

5.196.247.14:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 1 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

dave

Processes:

resource	yara_rule
behavioral2/memory/816-2-0x0000000000A20000-0x0000000000A52000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

sample.exe

pid process

816 sample.exe
816 sample.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3412 wermgr.exe
Token: SeDebugPrivilege 3412 wermgr.exe

pid	process
816	sample.exe
816	sample.exe

description	pid	process
Token: SeDebugPrivilege	3412	wermgr.exe
Token: SeDebugPrivilege	3412	wermgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

sample.exe

description	pid	process	target process
PID 816 wrote to memory of 3412	816	sample.exe	wermgr.exe
PID 816 wrote to memory of 3412	816	sample.exe	wermgr.exe
PID 816 wrote to memory of 3412	816	sample.exe	wermgr.exe
PID 816 wrote to memory of 3412	816	sample.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3412

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-2-0x0000000000A20000-0x0000000000A52000-memory.dmp

Filesize
200KB

Download
memory/816-3-0x0000000000B90000-0x0000000000BBF000-memory.dmp

Filesize
188KB

Download
memory/3412-4-0x0000000000000000-mapping.dmp

Download