trickbot | 44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157

Analysis

max time kernel
65s
max time network
128s
platform
windows10_x64
resource
win10v20201028
submitted
13/03/2021, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1036309f7981780bb32ec44fa17a06b4.dll
Size 660KB
Sample210313-cavmca7hwx
SHA256 44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157
MD5 1036309f7981780bb32ec44fa17a06b4
SHA1 ead8f0f329a527ca48d5deccea347b46ad587ad8
SHA512 30b99157af4aec1e079cdc65a6e4fa2a5d159f88bd66606f3665fa25d541dfe6135812d7f8d1d8af5ee5b1a446c4b2fed8801756ed970a3257dee93f9f575f6f
MD5 SHA1 SHA512

Score

10^/10

trickbot mon127 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100013

Botnet

mon127

103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

resource	yara_rule
behavioral2/memory/1200-3-0x0000000002D40000-0x0000000002D79000-memory.dmp	templ_dll
behavioral2/memory/1200-4-0x0000000002D90000-0x0000000002DC7000-memory.dmp	templ_dll
behavioral2/memory/1200-5-0x0000000000C20000-0x0000000000C56000-memory.dmp	templ_dll

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ident.me
18	ident.me

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1200	1192	rundll32.exe	55
PID 1192 wrote to memory of 1200	1192	rundll32.exe	55
PID 1192 wrote to memory of 1200	1192	rundll32.exe	55
PID 1200 wrote to memory of 500	1200	rundll32.exe	76
PID 1200 wrote to memory of 500	1200	rundll32.exe	76
PID 1200 wrote to memory of 500	1200	rundll32.exe	76
PID 1200 wrote to memory of 4036	1200	rundll32.exe	77
PID 1200 wrote to memory of 4036	1200	rundll32.exe	77
PID 1200 wrote to memory of 4036	1200	rundll32.exe	77
PID 1200 wrote to memory of 4036	1200	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1036309f7981780bb32ec44fa17a06b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1036309f7981780bb32ec44fa17a06b4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:500
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-3-0x0000000002D40000-0x0000000002D79000-memory.dmp

Download

memory/1200-4-0x0000000002D90000-0x0000000002DC7000-memory.dmp

Download

memory/1200-5-0x0000000000C20000-0x0000000000C56000-memory.dmp

Download

memory/1200-7-0x0000000010000000-0x0000000010037000-memory.dmp

Download

memory/1200-9-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Download

memory/1200-10-0x0000000002D11000-0x0000000002D13000-memory.dmp

Download

memory/1200-8-0x00000000047B0000-0x00000000047F3000-memory.dmp

Download

memory/4036-12-0x0000023D776E0000-0x0000023D776E1000-memory.dmp

Download

memory/4036-11-0x0000023D774D0000-0x0000023D774F8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads