trickbot | 0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb

Analysis

max time kernel
51s
max time network
100s
platform
windows10_x64
resource
win10v20201028
submitted
02/03/2021, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b7ed1742ec9188ecbc5674fc18bfa4f.dll
Size 547KB
Sample210302-bqcemfzrsa
SHA256 0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb
MD5 4b7ed1742ec9188ecbc5674fc18bfa4f
SHA1 13ce16ede2f14b74c0ea4a311e9039e99ad44a52
SHA512 fe54b2cc195c4c67c68162d30ab7b1065b7f5832cba1d0aebb578035103887cd8da45fa30b6d6102eb0e617572b9febf0883af0b671812023ef3e841bec9ed46
MD5 SHA1 SHA512

Score

10^/10

trickbot mon95 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100013

Botnet

mon95

103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

resource	yara_rule
behavioral2/memory/1804-4-0x00000000031D0000-0x0000000003207000-memory.dmp	templ_dll

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	checkip.amazonaws.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	wermgr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1804	1308	rundll32.exe	47
PID 1308 wrote to memory of 1804	1308	rundll32.exe	47
PID 1308 wrote to memory of 1804	1308	rundll32.exe	47
PID 1804 wrote to memory of 3672	1804	rundll32.exe	75
PID 1804 wrote to memory of 3672	1804	rundll32.exe	75
PID 1804 wrote to memory of 2292	1804	rundll32.exe	76
PID 1804 wrote to memory of 2292	1804	rundll32.exe	76
PID 1804 wrote to memory of 2292	1804	rundll32.exe	76
PID 1804 wrote to memory of 2292	1804	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7ed1742ec9188ecbc5674fc18bfa4f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7ed1742ec9188ecbc5674fc18bfa4f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:3672
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-5-0x00000000033E0000-0x0000000003423000-memory.dmp

Download

memory/1804-6-0x0000000003120000-0x0000000003121000-memory.dmp

Download

memory/1804-7-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/1804-4-0x00000000031D0000-0x0000000003207000-memory.dmp

Download

memory/2292-8-0x000002BC6A990000-0x000002BC6A9B8000-memory.dmp

Download

memory/2292-9-0x000002BC6A9D0000-0x000002BC6A9D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads