Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    11-05-2021 10:36

General

  • Target

    a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560.dll

  • Size

    768KB

  • MD5

    958f2d2965ef9b6b23134513688d36aa

  • SHA1

    5929406e2f36f8ad79c45ace27e437d6023fb638

  • SHA256

    a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560

  • SHA512

    56cbf9d0875e603ce3af6948e387043644c54481c3ddd99441686dc530164046e243f644b7aad00b215186b6b9f9d2e6772213da901176858bd6c4fe1b2a7a05

Malware Config

Extracted

Family

trickbot

Version

100013

Botnet

mon123

C2

103.225.138.94:449

122.2.28.70:449

123.200.26.246:449

131.255.106.152:449

142.112.79.223:449

154.126.176.30:449

180.92.238.186:449

187.20.217.129:449

201.20.118.122:449

202.91.41.138:449

95.210.118.90:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Templ.dll packer 3 IoCs

    Detects Templ.dll packer which usually loads Trickbot.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a085aab6c4d8cbc72954160639bb876d0531595a5baa2ff3321b323a55b13560.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe
        3⤵
          PID:1772
        • C:\Windows\system32\wermgr.exe
          C:\Windows\system32\wermgr.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1160

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1160-68-0x0000000000000000-mapping.dmp

    • memory/1160-73-0x0000000000210000-0x0000000000211000-memory.dmp

      Filesize

      4KB

    • memory/1160-72-0x0000000000060000-0x0000000000088000-memory.dmp

      Filesize

      160KB

    • memory/1952-60-0x0000000000000000-mapping.dmp

    • memory/1952-61-0x0000000075A31000-0x0000000075A33000-memory.dmp

      Filesize

      8KB

    • memory/1952-62-0x00000000002E0000-0x0000000000319000-memory.dmp

      Filesize

      228KB

    • memory/1952-65-0x0000000000A20000-0x0000000000A57000-memory.dmp

      Filesize

      220KB

    • memory/1952-67-0x0000000000250000-0x0000000000286000-memory.dmp

      Filesize

      216KB

    • memory/1952-70-0x0000000000390000-0x0000000000391000-memory.dmp

      Filesize

      4KB

    • memory/1952-71-0x0000000000321000-0x0000000000323000-memory.dmp

      Filesize

      8KB

    • memory/1952-69-0x0000000000A60000-0x0000000000AA3000-memory.dmp

      Filesize

      268KB