trickbot | bf81ad343dce8b514941ffd47576b78e02b41c23aec991fd5a48ad00c67ad942

General

Target
dHAfdxR.img.dll
Size 656KB
Sample210805-jsfc9lnrd6
SHA256 bf81ad343dce8b514941ffd47576b78e02b41c23aec991fd5a48ad00c67ad942
MD5 7c44e0a43e508476eda5f699d39a0c7f
SHA1 f7233d983272e37c5c74949dafbb07ff767b8bf7
SHA512 0e190f758c115e66aa1f21bd7213a41f93d088d4b5ea6b06dba7539996818983a424383b6bbec72c4fbfa9f2d322e2308cbe0c6a972cbac4220ffd8c85b46954
MD5 SHA1 SHA512

Score

10^/10

trickbot rob120 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob120

C2

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	wtfismyip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	604	wermgr.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2020	1936	rundll32.exe	25
PID 1936 wrote to memory of 2020	1936	rundll32.exe	25
PID 1936 wrote to memory of 2020	1936	rundll32.exe	25
PID 1936 wrote to memory of 2020	1936	rundll32.exe	25
PID 1936 wrote to memory of 2020	1936	rundll32.exe	25
PID 1936 wrote to memory of 2020	1936	rundll32.exe	25
PID 1936 wrote to memory of 2020	1936	rundll32.exe	25
PID 2020 wrote to memory of 1620	2020	rundll32.exe	30
PID 2020 wrote to memory of 1620	2020	rundll32.exe	30
PID 2020 wrote to memory of 1620	2020	rundll32.exe	30
PID 2020 wrote to memory of 1620	2020	rundll32.exe	30
PID 2020 wrote to memory of 604	2020	rundll32.exe	31
PID 2020 wrote to memory of 604	2020	rundll32.exe	31
PID 2020 wrote to memory of 604	2020	rundll32.exe	31
PID 2020 wrote to memory of 604	2020	rundll32.exe	31
PID 2020 wrote to memory of 604	2020	rundll32.exe	31
PID 2020 wrote to memory of 604	2020	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dHAfdxR.img.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dHAfdxR.img.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1620
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-74-0x00000000000E0000-0x0000000000108000-memory.dmp

Download

memory/604-75-0x00000000002A0000-0x00000000002A1000-memory.dmp

Download

memory/2020-61-0x0000000075201000-0x0000000075203000-memory.dmp

Download

memory/2020-62-0x0000000000290000-0x00000000002CB000-memory.dmp

Download

memory/2020-65-0x00000000002E0000-0x0000000000319000-memory.dmp

Download

memory/2020-67-0x0000000001F30000-0x0000000001F68000-memory.dmp

Download

memory/2020-69-0x0000000000180000-0x00000000001B9000-memory.dmp

Download

memory/2020-71-0x0000000001FC0000-0x0000000001FD1000-memory.dmp

Download

memory/2020-72-0x0000000000B01000-0x0000000000B03000-memory.dmp

Download

memory/2020-70-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads