trickbot | 81ac16b957d85a968262bed82e298bf6aa8c4e4977567e9b67111c6031480b11 | Triage

Analysis

max time kernel
12s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
27-02-2021 08:55

Sharing

Report Analysis Logs

General

Target

m88.dll
Size

903KB
MD5

833298fdcdf7b634c734d88adbb6517f
SHA1

5d3b4290d28837a4210ccc2c7f981a808af466d4
SHA256

81ac16b957d85a968262bed82e298bf6aa8c4e4977567e9b67111c6031480b11
SHA512

c8f58d9678334cd9688ad7e3b58018b51a79f2c9a8b9276b6e71309f3267ec4cb788636ea4e3f0fe27cde97edaeab4263fee08a6213958462e911f0cdc997ef2

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral2/memory/748-3-0x0000000000A40000-0x0000000000A77000-memory.dmp	templ_dll

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2920 748 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2920 WerFault.exe
Token: SeBackupPrivilege 2920 WerFault.exe
Token: SeDebugPrivilege 2920 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1052 wrote to memory of 748	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 748	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 748	1052	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\m88.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\m88.dll
2⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 620
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-2-0x0000000000000000-mapping.dmp

Download
memory/748-3-0x0000000000A40000-0x0000000000A77000-memory.dmp

Filesize
220KB

Download
memory/748-5-0x0000000000A80000-0x0000000000AC3000-memory.dmp

Filesize
268KB

Download
memory/2920-4-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download