trickbot | 01b6ab63f7078d952ed1a18850ac202bc201aa6210592c108a2e0a4d16f06fc5

General

Target

GVer.iks.dll
Size

432KB
MD5

6a653a2eb2417619f4cf1f4e0132b39f
SHA1

bce93fda262914a83ef7590eab8908a97f9cbd09
SHA256

01b6ab63f7078d952ed1a18850ac202bc201aa6210592c108a2e0a4d16f06fc5
SHA512

eb4d9d8e702cb0cf0162e160b7bb5661ea5fd0faf58845477172051a2049cc4fe9984fdcea25b916515e55fa773d7e31ed45a4b76b5af7a974120c631f8bcf1e

Score

10^/10

trickbot rob35 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000027

Botnet

rob35

C2

174.105.236.140:443

67.79.117.70:443

162.155.225.130:443

70.235.74.189:443

72.164.254.204:443

173.219.76.169:443

98.6.253.142:443

137.27.167.58:443

24.182.101.64:449

50.208.68.153:443

67.212.241.127:443

99.147.197.147:443

216.186.128.26:443

174.105.233.82:443

70.119.220.241:443

70.125.241.196:443

24.153.175.236:443

96.68.79.18:443

75.87.15.158:443

47.190.2.12:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral1/memory/1980-4-0x00000000002F0000-0x0000000000327000-memory.dmp	templ_dll

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 wtfismyip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 576 wermgr.exe

flow	ioc
6	wtfismyip.com

description	pid	process
Token: SeDebugPrivilege	576	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1616 wrote to memory of 1980	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1980	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1980	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1980	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1980	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1980	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1980	1616	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 576	1980	rundll32.exe	wermgr.exe
PID 1980 wrote to memory of 576	1980	rundll32.exe	wermgr.exe
PID 1980 wrote to memory of 576	1980	rundll32.exe	wermgr.exe
PID 1980 wrote to memory of 576	1980	rundll32.exe	wermgr.exe
PID 1980 wrote to memory of 576	1980	rundll32.exe	wermgr.exe
PID 1980 wrote to memory of 576	1980	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GVer.iks.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GVer.iks.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-5-0x0000000000000000-mapping.dmp

Download
memory/576-9-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/576-10-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1980-2-0x0000000000000000-mapping.dmp

Download
memory/1980-3-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/1980-4-0x00000000002F0000-0x0000000000327000-memory.dmp

Filesize
220KB

Download
memory/1980-6-0x0000000000750000-0x0000000000793000-memory.dmp

Filesize
268KB

Download
memory/1980-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1980-8-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing