trickbot | dbdf67590cfb1a76b02700a7c91c11ddf0c75f5963e6d56020e983e15a65c5d9

Resubmissions

13/09/2021, 14:21

210913-rn7w5sghfn10

19/08/2021, 15:37

210819-phk4f1rjde10

28/07/2021, 16:18

210728-vq2csehsha10

Analysis

max time kernel
1776s
max time network
1789s
platform
windows10_x64
resource
win10v20210410
submitted
19/08/2021, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
joinpornhub.pdf.dll
Size 388KB
Sample210819-phk4f1rjde
SHA256 dbdf67590cfb1a76b02700a7c91c11ddf0c75f5963e6d56020e983e15a65c5d9
MD5 e136a977901a98fb11493370926cfcf6
SHA1 11722b1f0fa7f5467a15e98aa0496679f11f6570
SHA512 5817efb02237172e45cf0c4a9d9b36cd5acbcf0acb782f1d974ff3de57c0e5374fd172b78c63389037006df2d9b284a588bed199fd8259b5045e71ca6a703148
MD5 SHA1 SHA512

Score

10^/10

trickbot rob114 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

rob114

38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Contacts Bazar domain
Uses Emercoin blockchain domains associated with Bazar backdoor/loader.
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4608	4464	rundll32.exe	72
PID 4464 wrote to memory of 4608	4464	rundll32.exe	72
PID 4464 wrote to memory of 4608	4464	rundll32.exe	72
PID 4608 wrote to memory of 4924	4608	rundll32.exe	76
PID 4608 wrote to memory of 4924	4608	rundll32.exe	76
PID 4608 wrote to memory of 4924	4608	rundll32.exe	76
PID 4608 wrote to memory of 4932	4608	rundll32.exe	77
PID 4608 wrote to memory of 4932	4608	rundll32.exe	77
PID 4608 wrote to memory of 4932	4608	rundll32.exe	77
PID 4608 wrote to memory of 4932	4608	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\joinpornhub.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\joinpornhub.pdf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4924
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4608-115-0x0000000004E00000-0x0000000004E3B000-memory.dmp

Download

memory/4608-118-0x0000000004F80000-0x0000000004FB9000-memory.dmp

Download

memory/4608-120-0x0000000004FC0000-0x0000000004FF7000-memory.dmp

Download

memory/4608-122-0x0000000004DC0000-0x0000000004DF8000-memory.dmp

Download

memory/4608-123-0x0000000005000000-0x0000000005044000-memory.dmp

Download

memory/4608-124-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download

memory/4608-125-0x0000000004E41000-0x0000000004E43000-memory.dmp

Download

memory/4932-127-0x000002BFD24A0000-0x000002BFD24C8000-memory.dmp

Download

memory/4932-128-0x000002BFD24E0000-0x000002BFD24E1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads