Analysis

  • max time kernel
    71s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-04-2021 08:09

General

  • Target

    ee6d7f80f549e9700b0e2d9b7e88aa53.dll

  • Size

    434KB

  • MD5

    ee6d7f80f549e9700b0e2d9b7e88aa53

  • SHA1

    0d58596ec23e23bfeb1ebd95fcaf89e9b2afe08f

  • SHA256

    54f6fe3e63891e2c0b925cf17385c6df56d824cee163111e93fef76c6476a535

  • SHA512

    598cd2ddd63bc565167dbfaa739f73f6f2061e9106eb78c3740a8b2d8cd4ead7fff023af55493a35a8b87043e6bad6ad243eda18a86a63afb7dec466a05e7c83

Malware Config

Extracted

Family

trickbot

Version

2000028

Botnet

rob45

C2

89.250.208.42:449

182.253.184.130:449

31.211.85.110:443

85.112.74.178:449

102.68.17.97:443

103.76.150.14:443

96.9.77.142:443

91.185.236.170:449

87.76.1.81:449

91.225.231.120:443

62.213.14.166:443

81.95.45.234:449

148.216.32.55:443

109.185.139.90:449

202.166.211.197:443

196.41.57.46:449

84.21.206.164:449

190.122.168.219:443

77.95.93.132:449

41.77.134.250:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6d7f80f549e9700b0e2d9b7e88aa53.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6d7f80f549e9700b0e2d9b7e88aa53.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4208-115-0x0000000000000000-mapping.dmp
  • memory/4208-119-0x0000028700A10000-0x0000028700A38000-memory.dmp
    Filesize

    160KB

  • memory/4208-120-0x0000028700B20000-0x0000028700B21000-memory.dmp
    Filesize

    4KB

  • memory/4656-114-0x0000000000000000-mapping.dmp
  • memory/4656-117-0x00000000031D0000-0x00000000031D1000-memory.dmp
    Filesize

    4KB

  • memory/4656-116-0x00000000030F0000-0x0000000003124000-memory.dmp
    Filesize

    208KB

  • memory/4656-118-0x0000000010001000-0x0000000010003000-memory.dmp
    Filesize

    8KB