trickbot | 02de6c38c553ade4460d627cdcd4db065ee9a59bc0a19d0b6f0b04ecdf38be80

Resubmissions

28-01-2021 16:49

210128-gd9cenjzne 10

28-01-2021 16:42

210128-e1fb24wmss 10

Analysis

max time kernel
17s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
28-01-2021 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

asesx.png.dll
Size

3.4MB
MD5

6ebd3ead7ff70ff9badedb980b66728a
SHA1

151afd9f5352fd31fdee9af8b1cfa00afd36dd49
SHA256

02de6c38c553ade4460d627cdcd4db065ee9a59bc0a19d0b6f0b04ecdf38be80
SHA512

df4b54808fd4deb144ea1c6eb058d531013d2b2aebbe69b9c72246192874b02924a9d9fd84f4f2d27207021c5075d8949ab3e69926224fac2dc96f271536db85

Score

10^/10

trickbot rob42 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob42

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3712 2096 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
3712	2096	WerFault.exe	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe
3712	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3712 WerFault.exe
Token: SeBackupPrivilege 3712 WerFault.exe
Token: SeDebugPrivilege 3712 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3712	WerFault.exe
Token: SeBackupPrivilege	3712	WerFault.exe
Token: SeDebugPrivilege	3712	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 644 wrote to memory of 2096	644	regsvr32.exe	regsvr32.exe
PID 644 wrote to memory of 2096	644	regsvr32.exe	regsvr32.exe
PID 644 wrote to memory of 2096	644	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\asesx.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\asesx.png.dll
2⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 624
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-2-0x0000000000000000-mapping.dmp

Download
memory/2096-4-0x0000000000370000-0x00000000003B1000-memory.dmp

Filesize
260KB

Download
memory/3712-3-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download