Resubmissions

04-05-2021 21:49

210504-vy6bjrf15e 10

12-04-2021 15:59

210412-pzkl1vf56j 10

12-04-2021 15:21

210412-wmdnkzp5la 10

Analysis

  • max time kernel
    1800s
  • max time network
    1800s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    12-04-2021 15:59

General

  • Target

    click.php.dll

  • Size

    439KB

  • MD5

    cbea511bd35f247e4b4bf7cc5a3a7cbd

  • SHA1

    8c0d352934271350cfe6c00b7587e8dc8d062817

  • SHA256

    0ae86e5abbc09e96f8c1155556ca6598c22aebd73acbba8d59f2ce702d3115f8

  • SHA512

    aec894d9d3aaccccc029c615d283af4946c5150372db0ecdd616a9d491478759068214bf03db11631a5efb59951150d92c1517c2c11d8c6f0ddf5c8f76734fcf

Malware Config

Extracted

Family

trickbot

Version

2000028

Botnet

rob52

C2

89.250.208.42:449

182.253.184.130:449

31.211.85.110:443

85.112.74.178:449

102.68.17.97:443

103.76.150.14:443

96.9.77.142:443

91.185.236.170:449

87.76.1.81:449

91.225.231.120:443

62.213.14.166:443

81.95.45.234:449

148.216.32.55:443

109.185.139.90:449

202.166.211.197:443

196.41.57.46:449

84.21.206.164:449

190.122.168.219:443

77.95.93.132:449

41.77.134.250:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Templ.dll packer 1 IoCs

    Detects Templ.dll packer which usually loads Trickbot.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2716
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1736-114-0x0000000000000000-mapping.dmp
  • memory/1736-115-0x0000000004E50000-0x0000000004E87000-memory.dmp
    Filesize

    220KB

  • memory/1736-117-0x0000000004EE0000-0x0000000004F23000-memory.dmp
    Filesize

    268KB

  • memory/1736-118-0x0000000004F70000-0x0000000004F71000-memory.dmp
    Filesize

    4KB

  • memory/1736-119-0x0000000010001000-0x0000000010003000-memory.dmp
    Filesize

    8KB

  • memory/2716-116-0x0000000000000000-mapping.dmp
  • memory/2716-120-0x000001A386830000-0x000001A386858000-memory.dmp
    Filesize

    160KB

  • memory/2716-121-0x000001A386870000-0x000001A386871000-memory.dmp
    Filesize

    4KB