trickbot | 0ae86e5abbc09e96f8c1155556ca6598c22aebd73acbba8d59f2ce702d3115f8

Target

click.php.dll
Size

439KB
MD5

cbea511bd35f247e4b4bf7cc5a3a7cbd
SHA1

8c0d352934271350cfe6c00b7587e8dc8d062817
SHA256

0ae86e5abbc09e96f8c1155556ca6598c22aebd73acbba8d59f2ce702d3115f8
SHA512

aec894d9d3aaccccc029c615d283af4946c5150372db0ecdd616a9d491478759068214bf03db11631a5efb59951150d92c1517c2c11d8c6f0ddf5c8f76734fcf

Score

10^/10

trickbot rob52 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000028

Botnet

rob52

89.250.208.42:449

182.253.184.130:449

31.211.85.110:443

85.112.74.178:449

102.68.17.97:443

103.76.150.14:443

96.9.77.142:443

91.185.236.170:449

87.76.1.81:449

91.225.231.120:443

62.213.14.166:443

81.95.45.234:449

148.216.32.55:443

109.185.139.90:449

202.166.211.197:443

196.41.57.46:449

84.21.206.164:449

190.122.168.219:443

77.95.93.132:449

41.77.134.250:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral1/memory/1736-115-0x0000000004E50000-0x0000000004E87000-memory.dmp	templ_dll

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 ipecho.net
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2716 wermgr.exe

flow	ioc
19	ipecho.net

description	pid	process
Token: SeDebugPrivilege	2716	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2896 wrote to memory of 1736	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 1736	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 1736	2896	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2716	1736	rundll32.exe	wermgr.exe
PID 1736 wrote to memory of 2716	1736	rundll32.exe	wermgr.exe
PID 1736 wrote to memory of 2716	1736	rundll32.exe	wermgr.exe
PID 1736 wrote to memory of 2716	1736	rundll32.exe	wermgr.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2716

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-114-0x0000000000000000-mapping.dmp

Download
memory/1736-115-0x0000000004E50000-0x0000000004E87000-memory.dmp

Filesize
220KB

Download
memory/1736-117-0x0000000004EE0000-0x0000000004F23000-memory.dmp

Filesize
268KB

Download
memory/1736-118-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/1736-119-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/2716-116-0x0000000000000000-mapping.dmp

Download
memory/2716-120-0x000001A386830000-0x000001A386858000-memory.dmp

Filesize
160KB

Download
memory/2716-121-0x000001A386870000-0x000001A386871000-memory.dmp

Filesize
4KB

Download