trickbot | f95adae1cd46200a5b9d61024e3eb887bfacfe2fe63b94f1dc4e6b89edb9cae3

Analysis

max time kernel
144s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
14/07/2021, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81912f51960219818c5b55a0bafa674e.dll
Size 476KB
Sample210714-28btml3tgx
SHA256 f95adae1cd46200a5b9d61024e3eb887bfacfe2fe63b94f1dc4e6b89edb9cae3
MD5 81912f51960219818c5b55a0bafa674e
SHA1 670d7d68bc9248481d9b6e44a2df5535b98e26de
SHA512 a16faca218cf1d7d482c8011b76bfd6055d29c7367079147aa2003534168e48de46d44dbad51a7840873b689f4aad5192f27a4863382027bcb1f8567357425a8
MD5 SHA1 SHA512

Score

10^/10

trickbot rob107 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

rob107

38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4464	4440	rundll32.exe	67
PID 4440 wrote to memory of 4464	4440	rundll32.exe	67
PID 4440 wrote to memory of 4464	4440	rundll32.exe	67
PID 4464 wrote to memory of 5076	4464	rundll32.exe	77
PID 4464 wrote to memory of 5076	4464	rundll32.exe	77
PID 4464 wrote to memory of 5076	4464	rundll32.exe	77
PID 4464 wrote to memory of 5084	4464	rundll32.exe	78
PID 4464 wrote to memory of 5084	4464	rundll32.exe	78
PID 4464 wrote to memory of 5084	4464	rundll32.exe	78
PID 4464 wrote to memory of 5084	4464	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81912f51960219818c5b55a0bafa674e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81912f51960219818c5b55a0bafa674e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5076
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4464-115-0x0000000004E70000-0x0000000004EAB000-memory.dmp

Download

memory/4464-118-0x0000000004EB0000-0x0000000004EE9000-memory.dmp

Download

memory/4464-120-0x0000000004EF0000-0x0000000004F27000-memory.dmp

Download

memory/4464-122-0x0000000004D30000-0x0000000004D68000-memory.dmp

Download

memory/4464-123-0x0000000004F50000-0x0000000004F93000-memory.dmp

Download

memory/4464-125-0x0000000004D81000-0x0000000004D83000-memory.dmp

Download

memory/4464-124-0x0000000004F30000-0x0000000004F31000-memory.dmp

Download

memory/5084-128-0x00000195D6E10000-0x00000195D6E11000-memory.dmp

Download

memory/5084-127-0x00000195D6C00000-0x00000195D6C28000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads