trickbot | 01b6ab63f7078d952ed1a18850ac202bc201aa6210592c108a2e0a4d16f06fc5

Analysis

max time kernel
101s
max time network
128s
platform
windows10_x64
resource
win10v20201028
submitted
23-03-2021 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe.dll
Size

432KB
MD5

6a653a2eb2417619f4cf1f4e0132b39f
SHA1

bce93fda262914a83ef7590eab8908a97f9cbd09
SHA256

01b6ab63f7078d952ed1a18850ac202bc201aa6210592c108a2e0a4d16f06fc5
SHA512

eb4d9d8e702cb0cf0162e160b7bb5661ea5fd0faf58845477172051a2049cc4fe9984fdcea25b916515e55fa773d7e31ed45a4b76b5af7a974120c631f8bcf1e

Score

10^/10

trickbot rob35 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000027

Botnet

rob35

174.105.236.140:443

67.79.117.70:443

162.155.225.130:443

70.235.74.189:443

72.164.254.204:443

173.219.76.169:443

98.6.253.142:443

137.27.167.58:443

24.182.101.64:449

50.208.68.153:443

67.212.241.127:443

99.147.197.147:443

216.186.128.26:443

174.105.233.82:443

70.119.220.241:443

70.125.241.196:443

24.153.175.236:443

96.68.79.18:443

75.87.15.158:443

47.190.2.12:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral2/memory/4740-3-0x0000000000880000-0x00000000008B7000-memory.dmp	templ_dll

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ident.me
19 ident.me
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3712 wermgr.exe

flow	ioc
18	ident.me
19	ident.me

description	pid	process
Token: SeDebugPrivilege	3712	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4716 wrote to memory of 4740	4716	rundll32.exe	rundll32.exe
PID 4716 wrote to memory of 4740	4716	rundll32.exe	rundll32.exe
PID 4716 wrote to memory of 4740	4716	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 3712	4740	rundll32.exe	wermgr.exe
PID 4740 wrote to memory of 3712	4740	rundll32.exe	wermgr.exe
PID 4740 wrote to memory of 3712	4740	rundll32.exe	wermgr.exe
PID 4740 wrote to memory of 3712	4740	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.exe.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3712-4-0x0000000000000000-mapping.dmp

Download
memory/3712-8-0x0000023922AD0000-0x0000023922AF8000-memory.dmp

Filesize
160KB

Download
memory/3712-9-0x0000023922BE0000-0x0000023922BE1000-memory.dmp

Filesize
4KB

Download
memory/4740-2-0x0000000000000000-mapping.dmp

Download
memory/4740-3-0x0000000000880000-0x00000000008B7000-memory.dmp

Filesize
220KB

Download
memory/4740-5-0x00000000040A0000-0x00000000040E3000-memory.dmp

Filesize
268KB

Download
memory/4740-6-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/4740-7-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download