trickbot | c22df6708ee597cfbc4079d96503e8159104cdf1f0d3a9fecb6741a9e152d0b2

General

Target

XGetoptTest.exe.dll
Size

368KB
MD5

98e7b944113b0a9d26ed50909e4d30bc
SHA1

1ace53fc97fdd578b2ae13c42af9b44d6fedf7ce
SHA256

c22df6708ee597cfbc4079d96503e8159104cdf1f0d3a9fecb6741a9e152d0b2
SHA512

da704e7dd760c4a5fcb979be5d5fb92f8fd872d00eab128161ba37e2883dad37352876e0c4bc84a219e4df4ce653e53df2911a1f66a4202a2946f358c384388e

Score

10^/10

trickbot rob72 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000029

Botnet

rob72

C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral2/memory/3884-115-0x0000000002ED0000-0x0000000002F09000-memory.dmp	templ_dll
behavioral2/memory/3884-119-0x0000000002D00000-0x0000000002D36000-memory.dmp	templ_dll
behavioral2/memory/3884-118-0x00000000047D0000-0x0000000004807000-memory.dmp	templ_dll

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 myexternalip.com
22 icanhazip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1136 wermgr.exe

flow	ioc
24	myexternalip.com
22	icanhazip.com

description	pid	process
Token: SeDebugPrivilege	1136	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3920 wrote to memory of 3884	3920	rundll32.exe	rundll32.exe
PID 3920 wrote to memory of 3884	3920	rundll32.exe	rundll32.exe
PID 3920 wrote to memory of 3884	3920	rundll32.exe	rundll32.exe
PID 3884 wrote to memory of 1136	3884	rundll32.exe	wermgr.exe
PID 3884 wrote to memory of 1136	3884	rundll32.exe	wermgr.exe
PID 3884 wrote to memory of 1136	3884	rundll32.exe	wermgr.exe
PID 3884 wrote to memory of 1136	3884	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XGetoptTest.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XGetoptTest.exe.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-121-0x0000000000000000-mapping.dmp

Download
memory/1136-125-0x00000226DDF60000-0x00000226DDF88000-memory.dmp

Filesize
160KB

Download
memory/1136-126-0x00000226DE070000-0x00000226DE071000-memory.dmp

Filesize
4KB

Download
memory/3884-114-0x0000000000000000-mapping.dmp

Download
memory/3884-115-0x0000000002ED0000-0x0000000002F09000-memory.dmp

Filesize
228KB

Download
memory/3884-119-0x0000000002D00000-0x0000000002D36000-memory.dmp

Filesize
216KB

Download
memory/3884-118-0x00000000047D0000-0x0000000004807000-memory.dmp

Filesize
220KB

Download
memory/3884-123-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/3884-122-0x0000000004920000-0x0000000004963000-memory.dmp

Filesize
268KB

Download
memory/3884-124-0x0000000002CE1000-0x0000000002CE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing