trickbot | bf81ad343dce8b514941ffd47576b78e02b41c23aec991fd5a48ad00c67ad942

Analysis

max time kernel
143s
max time network
146s
platform
windows10_x64
resource
win10v20210410
submitted
05/08/2021, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dHAfdxR.img.dll
Size 656KB
Sample210805-jsfc9lnrd6
SHA256 bf81ad343dce8b514941ffd47576b78e02b41c23aec991fd5a48ad00c67ad942
MD5 7c44e0a43e508476eda5f699d39a0c7f
SHA1 f7233d983272e37c5c74949dafbb07ff767b8bf7
SHA512 0e190f758c115e66aa1f21bd7213a41f93d088d4b5ea6b06dba7539996818983a424383b6bbec72c4fbfa9f2d322e2308cbe0c6a972cbac4220ffd8c85b46954
MD5 SHA1 SHA512

Score

10^/10

trickbot rob120 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob120

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1816	772	rundll32.exe	72
PID 772 wrote to memory of 1816	772	rundll32.exe	72
PID 772 wrote to memory of 1816	772	rundll32.exe	72
PID 1816 wrote to memory of 2152	1816	rundll32.exe	76
PID 1816 wrote to memory of 2152	1816	rundll32.exe	76
PID 1816 wrote to memory of 2152	1816	rundll32.exe	76
PID 1816 wrote to memory of 2260	1816	rundll32.exe	77
PID 1816 wrote to memory of 2260	1816	rundll32.exe	77
PID 1816 wrote to memory of 2260	1816	rundll32.exe	77
PID 1816 wrote to memory of 2260	1816	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dHAfdxR.img.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dHAfdxR.img.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2152
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-115-0x00000000030D0000-0x000000000310B000-memory.dmp

Download

memory/1816-118-0x0000000003110000-0x0000000003149000-memory.dmp

Download

memory/1816-120-0x00000000049C0000-0x00000000049F8000-memory.dmp

Download

memory/1816-123-0x0000000004A00000-0x0000000004A44000-memory.dmp

Download

memory/1816-122-0x0000000002E00000-0x0000000002F4A000-memory.dmp

Download

memory/1816-124-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/1816-125-0x0000000004A61000-0x0000000004A63000-memory.dmp

Download

memory/2260-127-0x000002A6749E0000-0x000002A674A08000-memory.dmp

Download

memory/2260-128-0x000002A674AF0000-0x000002A674AF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads