Analysis

  • max time kernel
    123s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    02-07-2021 12:07

General

  • Target

    triage_dropped_file.dll

  • Size

    403KB

  • MD5

    73dea2992305472953f55173a8df4e97

  • SHA1

    c793820db2776f423bca9a7bf517a38a735f3bee

  • SHA256

    30b4227e51c4964d07a5246cdab168f465790dd8846dac5e8376c2afed5a1485

  • SHA512

    fdfba7054410e5a743fad104dc9aaac234897ed598c0cc7b5c87150f288b1eec186890873e03a0ad75a8fc2a72a562d5ea0053bc90d25476f37b843dd71cffd8

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev1

C2

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:340
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/340-60-0x0000000000000000-mapping.dmp
  • memory/340-61-0x00000000762C1000-0x00000000762C3000-memory.dmp
    Filesize

    8KB

  • memory/340-62-0x0000000000200000-0x0000000000280000-memory.dmp
    Filesize

    512KB

  • memory/340-63-0x00000000001C0000-0x00000000001D1000-memory.dmp
    Filesize

    68KB

  • memory/340-64-0x0000000010001000-0x0000000010003000-memory.dmp
    Filesize

    8KB

  • memory/832-65-0x0000000000000000-mapping.dmp
  • memory/832-66-0x00000000000E0000-0x0000000000108000-memory.dmp
    Filesize

    160KB

  • memory/832-67-0x0000000000390000-0x0000000000391000-memory.dmp
    Filesize

    4KB

  • memory/1660-59-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp
    Filesize

    8KB