trickbot | 083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918

Resubmissions

19-08-2021 14:42

210819-glacb4nldj 10

20-06-2021 06:40

210620-my3xhkwtcx 10

Analysis

max time kernel
105s
max time network
142s
platform
windows7_x64
resource
win7v20210410
submitted
20-06-2021 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f5033d76b72ff259bf0d7ab33725141.dll
Size

700KB
MD5

1f5033d76b72ff259bf0d7ab33725141
SHA1

a827a2e9e2072ae57420a22f469e7053de62ea97
SHA256

083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918
SHA512

b771c7230a9757703cf6c13714ab4a34e1135028df520fbba43e7d19d731c6b257d00e4791f44191390392d1e39ef5b3d897a1225ff95fa1e16c2253ade92fca

Score

10^/10

trickbot mon311 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100017

Botnet

mon311

178.72.192.20:443

103.124.145.98:443

45.5.152.39:443

114.7.240.222:443

85.248.1.126:443

94.183.237.101:443

146.196.121.219:443

89.37.1.2:443

94.142.179.77:443

177.221.39.161:443

85.175.171.246:443

103.12.160.164:443

180.178.106.50:443

94.142.179.179:443

46.209.140.220:443

123.231.149.122:443

123.231.149.123:443

182.160.116.190:443

131.0.112.122:443

116.0.6.110:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ipecho.net
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1212 wermgr.exe

flow	ioc
12	ipecho.net

description	pid	process
Token: SeDebugPrivilege	1212	wermgr.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 768 wrote to memory of 2016	768	regsvr32.exe	regsvr32.exe
PID 768 wrote to memory of 2016	768	regsvr32.exe	regsvr32.exe
PID 768 wrote to memory of 2016	768	regsvr32.exe	regsvr32.exe
PID 768 wrote to memory of 2016	768	regsvr32.exe	regsvr32.exe
PID 768 wrote to memory of 2016	768	regsvr32.exe	regsvr32.exe
PID 768 wrote to memory of 2016	768	regsvr32.exe	regsvr32.exe
PID 768 wrote to memory of 2016	768	regsvr32.exe	regsvr32.exe
PID 2016 wrote to memory of 1728	2016	regsvr32.exe	cmd.exe
PID 2016 wrote to memory of 1728	2016	regsvr32.exe	cmd.exe
PID 2016 wrote to memory of 1728	2016	regsvr32.exe	cmd.exe
PID 2016 wrote to memory of 1728	2016	regsvr32.exe	cmd.exe
PID 2016 wrote to memory of 1212	2016	regsvr32.exe	wermgr.exe
PID 2016 wrote to memory of 1212	2016	regsvr32.exe	wermgr.exe
PID 2016 wrote to memory of 1212	2016	regsvr32.exe	wermgr.exe
PID 2016 wrote to memory of 1212	2016	regsvr32.exe	wermgr.exe
PID 2016 wrote to memory of 1212	2016	regsvr32.exe	wermgr.exe
PID 2016 wrote to memory of 1212	2016	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f5033d76b72ff259bf0d7ab33725141.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1f5033d76b72ff259bf0d7ab33725141.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
3⤵
PID:1728

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-60-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1212-76-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1212-75-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/1212-72-0x0000000000000000-mapping.dmp

Download
memory/2016-71-0x00000000008A0000-0x00000000008E3000-memory.dmp

Filesize
268KB

Download
memory/2016-68-0x0000000000860000-0x0000000000898000-memory.dmp

Filesize
224KB

Download
memory/2016-66-0x00000000003F0000-0x0000000000429000-memory.dmp

Filesize
228KB

Download
memory/2016-70-0x0000000000370000-0x00000000003A9000-memory.dmp

Filesize
228KB

Download
memory/2016-63-0x00000000003B0000-0x00000000003EB000-memory.dmp

Filesize
236KB

Download
memory/2016-74-0x0000000000171000-0x0000000000173000-memory.dmp

Filesize
8KB

Download
memory/2016-73-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2016-62-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/2016-61-0x0000000000000000-mapping.dmp

Download