trickbot | a3cebf31e185cfae066634a108c3bee7de5c32475411c5398525e2e2caf00d80

Analysis

max time kernel
137s
max time network
146s
platform
windows10_x64
resource
win10v20201028
submitted
08/04/2021, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
printme.bin.dll
Size 776KB
Sample210408-l3mj19cfbj
SHA256 a3cebf31e185cfae066634a108c3bee7de5c32475411c5398525e2e2caf00d80
MD5 b304b0f0fed483cc72c977c99122b70a
SHA1 c2f57e490ef68190f769eb8f8971b6e54329de0c
SHA512 4a1c04beb9bbdda63529bbc1aa96aca2b9520ada851daad74294869a70194d49155156c3798dd9b65d8efd5a626465b5217a9de3640784dd48745f10dc806566
MD5 SHA1 SHA512

Score

10^/10

trickbot rob47 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000028

Botnet

rob47

89.250.208.42:449
182.253.184.130:449
31.211.85.110:443
85.112.74.178:449
102.68.17.97:443
103.76.150.14:443
96.9.77.142:443
91.185.236.170:449
87.76.1.81:449
91.225.231.120:443
62.213.14.166:443
81.95.45.234:449
148.216.32.55:443
109.185.139.90:449
202.166.211.197:443
196.41.57.46:449
84.21.206.164:449
190.122.168.219:443
77.95.93.132:449
41.77.134.250:443
87.116.151.237:449
185.205.250.162:443
103.9.188.23:449
78.138.187.231:443
138.185.72.142:443
173.81.4.147:443
31.134.124.90:443
200.90.11.177:449
5.59.205.32:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

resource	yara_rule
behavioral2/memory/4020-115-0x0000000004DA0000-0x0000000004DD9000-memory.dmp	templ_dll
behavioral2/memory/4020-118-0x0000000005140000-0x0000000005177000-memory.dmp	templ_dll
behavioral2/memory/4020-121-0x0000000004D60000-0x0000000004D96000-memory.dmp	templ_dll

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4020	1908	rundll32.exe	72
PID 1908 wrote to memory of 4020	1908	rundll32.exe	72
PID 1908 wrote to memory of 4020	1908	rundll32.exe	72
PID 4020 wrote to memory of 2776	4020	rundll32.exe	76
PID 4020 wrote to memory of 2776	4020	rundll32.exe	76
PID 4020 wrote to memory of 2776	4020	rundll32.exe	76
PID 4020 wrote to memory of 2776	4020	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\printme.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\printme.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-125-0x0000018007430000-0x0000018007458000-memory.dmp

Download

memory/2776-126-0x0000018007470000-0x0000018007471000-memory.dmp

Download

memory/4020-115-0x0000000004DA0000-0x0000000004DD9000-memory.dmp

Download

memory/4020-118-0x0000000005140000-0x0000000005177000-memory.dmp

Download

memory/4020-121-0x0000000004D60000-0x0000000004D96000-memory.dmp

Download

memory/4020-122-0x0000000005180000-0x00000000051C3000-memory.dmp

Download

memory/4020-123-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/4020-124-0x00000000033D1000-0x00000000033D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads