trickbot | 3e72aecd1d69a6468079da039b4569a56551c0b202f7d90c41e4859a9c26fa08

Resubmissions

06/07/2021, 06:53

210706-c3yk58z67s10

06/07/2021, 06:22

210706-2jwdvtyzzj10

Analysis

max time kernel
139s
max time network
163s
platform
windows10_x64
resource
win10v20210410
submitted
06/07/2021, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80bb8587c2c15a448ba80a24a2ee555f.dll
Size 344KB
Sample210706-2jwdvtyzzj
SHA256 3e72aecd1d69a6468079da039b4569a56551c0b202f7d90c41e4859a9c26fa08
MD5 80bb8587c2c15a448ba80a24a2ee555f
SHA1 89ce859719a17c1fd1580470670eddb2e3be4daa
SHA512 af904482d24872a1bfd596c79b788bdbb08d9dccbcc165d440874fcb99270e469891356250f669f219c647dfca38f0b957f031af5a9afe9c8300ce228b44c66a
MD5 SHA1 SHA512

Score

10^/10

trickbot rob102 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

rob102

38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3972	3540	regsvr32.exe	54
PID 3540 wrote to memory of 3972	3540	regsvr32.exe	54
PID 3540 wrote to memory of 3972	3540	regsvr32.exe	54
PID 3972 wrote to memory of 1764	3972	regsvr32.exe	75
PID 3972 wrote to memory of 1764	3972	regsvr32.exe	75
PID 3972 wrote to memory of 1764	3972	regsvr32.exe	75
PID 3972 wrote to memory of 1812	3972	regsvr32.exe	76
PID 3972 wrote to memory of 1812	3972	regsvr32.exe	76
PID 3972 wrote to memory of 1812	3972	regsvr32.exe	76
PID 3972 wrote to memory of 1812	3972	regsvr32.exe	76

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\80bb8587c2c15a448ba80a24a2ee555f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\80bb8587c2c15a448ba80a24a2ee555f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1764
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1812-128-0x0000027BE1F50000-0x0000027BE1F51000-memory.dmp

Download

memory/1812-127-0x0000027BE1E40000-0x0000027BE1E68000-memory.dmp

Download

memory/3972-115-0x0000000000E20000-0x0000000000E5B000-memory.dmp

Download

memory/3972-118-0x0000000000E60000-0x0000000000E99000-memory.dmp

Download

memory/3972-120-0x00000000044E0000-0x0000000004517000-memory.dmp

Download

memory/3972-122-0x0000000000DE0000-0x0000000000E18000-memory.dmp

Download

memory/3972-124-0x0000000004580000-0x0000000004581000-memory.dmp

Download

memory/3972-125-0x0000000000EB1000-0x0000000000EB3000-memory.dmp

Download

memory/3972-123-0x0000000004520000-0x0000000004563000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads