trickbot | 948d8e5898e3b97498e0b536c416d6532690c71e4a2e39f97dd5bf64e588d573

General

Target

32-422-76.assp.exe.dll
Size

356KB
MD5

51177b8eba011e530083443352d5eff9
SHA1

b9ba834dd1ab9d5951ea7559ad1565a7f2eb6641
SHA256

948d8e5898e3b97498e0b536c416d6532690c71e4a2e39f97dd5bf64e588d573
SHA512

4a10729c2334a6c97ccc74ca87960ec09702483fea83975e20166fc0149d25b30204f5297382b5cbb9a9123f9c8c1b26ed9ca4f11efd115eda1d5c4dbab70197

Score

10^/10

trickbot rob44 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob44

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral1/memory/1836-5-0x0000000010000000-0x0000000013054000-memory.dmp	templ_dll

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1212 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	1212	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 1836	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1836	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1836	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1836	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1836	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1836	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1836	744	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1212	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 1212	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 1212	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 1212	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 1212	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 1212	1836	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32-422-76.assp.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32-422-76.assp.exe.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-6-0x0000000000000000-mapping.dmp

Download
memory/1212-11-0x00000000000E0000-0x0000000000107000-memory.dmp

Filesize
156KB

Download
memory/1212-12-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1836-2-0x0000000000000000-mapping.dmp

Download
memory/1836-3-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1836-4-0x0000000002520000-0x0000000005574000-memory.dmp

Filesize
48.3MB

Download
memory/1836-5-0x0000000010000000-0x0000000013054000-memory.dmp

Filesize
48.3MB

Download
memory/1836-10-0x0000000000171000-0x0000000000173000-memory.dmp

Filesize
8KB

Download
memory/1836-9-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1836-8-0x0000000000440000-0x0000000000481000-memory.dmp

Filesize
260KB

Download
memory/1836-7-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing