trickbot | 0ae86e5abbc09e96f8c1155556ca6598c22aebd73acbba8d59f2ce702d3115f8

Target

click.php.dll
Size

439KB
MD5

cbea511bd35f247e4b4bf7cc5a3a7cbd
SHA1

8c0d352934271350cfe6c00b7587e8dc8d062817
SHA256

0ae86e5abbc09e96f8c1155556ca6598c22aebd73acbba8d59f2ce702d3115f8
SHA512

aec894d9d3aaccccc029c615d283af4946c5150372db0ecdd616a9d491478759068214bf03db11631a5efb59951150d92c1517c2c11d8c6f0ddf5c8f76734fcf

Score

10^/10

trickbot rob52 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000028

Botnet

rob52

89.250.208.42:449

182.253.184.130:449

31.211.85.110:443

85.112.74.178:449

102.68.17.97:443

103.76.150.14:443

96.9.77.142:443

91.185.236.170:449

87.76.1.81:449

91.225.231.120:443

62.213.14.166:443

81.95.45.234:449

148.216.32.55:443

109.185.139.90:449

202.166.211.197:443

196.41.57.46:449

84.21.206.164:449

190.122.168.219:443

77.95.93.132:449

41.77.134.250:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral2/memory/812-116-0x0000000004300000-0x0000000004337000-memory.dmp	templ_dll

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2444 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	2444	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3944 wrote to memory of 812	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 812	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 812	3944	rundll32.exe	rundll32.exe
PID 812 wrote to memory of 2444	812	rundll32.exe	wermgr.exe
PID 812 wrote to memory of 2444	812	rundll32.exe	wermgr.exe
PID 812 wrote to memory of 2444	812	rundll32.exe	wermgr.exe
PID 812 wrote to memory of 2444	812	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\click.php.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-114-0x0000000000000000-mapping.dmp

Download
memory/812-117-0x0000000004340000-0x0000000004383000-memory.dmp

Filesize
268KB

Download
memory/812-118-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/812-116-0x0000000004300000-0x0000000004337000-memory.dmp

Filesize
220KB

Download
memory/812-119-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/2444-115-0x0000000000000000-mapping.dmp

Download
memory/2444-120-0x000001DED4D40000-0x000001DED4D68000-memory.dmp

Filesize
160KB

Download
memory/2444-121-0x000001DED4D80000-0x000001DED4D81000-memory.dmp

Filesize
4KB

Download