trickbot | 02de6c38c553ade4460d627cdcd4db065ee9a59bc0a19d0b6f0b04ecdf38be80

Resubmissions

28-01-2021 16:49

210128-gd9cenjzne 10

28-01-2021 16:42

210128-e1fb24wmss 10

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7v20201028
submitted
28-01-2021 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

asesx.png.dll
Size

3.4MB
MD5

6ebd3ead7ff70ff9badedb980b66728a
SHA1

151afd9f5352fd31fdee9af8b1cfa00afd36dd49
SHA256

02de6c38c553ade4460d627cdcd4db065ee9a59bc0a19d0b6f0b04ecdf38be80
SHA512

df4b54808fd4deb144ea1c6eb058d531013d2b2aebbe69b9c72246192874b02924a9d9fd84f4f2d27207021c5075d8949ab3e69926224fac2dc96f271536db85

Score

10^/10

trickbot rob42 banker trojan vmprotect

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob42

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2032-11-0x0000000010000000-0x0000000010003000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1224 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	1224	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 360 wrote to memory of 2032	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 2032	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 2032	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 2032	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 2032	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 2032	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 2032	360	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1224	2032	regsvr32.exe	wermgr.exe
PID 2032 wrote to memory of 1224	2032	regsvr32.exe	wermgr.exe
PID 2032 wrote to memory of 1224	2032	regsvr32.exe	wermgr.exe
PID 2032 wrote to memory of 1224	2032	regsvr32.exe	wermgr.exe
PID 2032 wrote to memory of 1224	2032	regsvr32.exe	wermgr.exe
PID 2032 wrote to memory of 1224	2032	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\asesx.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:360

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\asesx.png.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-2-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download
memory/1224-5-0x0000000000000000-mapping.dmp

Download
memory/1224-9-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/1224-10-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2032-3-0x0000000000000000-mapping.dmp

Download
memory/2032-4-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2032-8-0x0000000000291000-0x0000000000293000-memory.dmp

Filesize
8KB

Download
memory/2032-6-0x0000000000240000-0x0000000000281000-memory.dmp

Filesize
260KB

Download
memory/2032-7-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2032-11-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download