trickbot | 5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0

Target

5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0.dll
Size

424KB
MD5

ae5a227472b36642f4325c2fd4f884f5
SHA1

7efc236d4804073a99337a7833b9536c358c49bc
SHA256

5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0
SHA512

dbb2f38f14785e8e27d5e7e313bf8f8a9812f8cb2bf0aeed3a3fd8f76f246aa8f8a5c4a17c4fb7c48f97dddcd883b9b3a31ee96b6b18bb310db3fb6cab5f3d2a

Score

10^/10

trickbot zem1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000034

Botnet

zem1

103.36.126.221:443

84.236.171.231:443

14.102.72.204:443

176.100.4.31:443

165.73.90.187:443

103.23.237.6:443

122.117.90.133:443

103.61.100.252:443

36.95.110.19:443

103.65.193.144:443

117.220.229.162:443

103.113.105.126:443

14.102.46.9:443

139.255.199.196:443

157.119.215.186:443

151.106.48.226:443

36.91.36.29:443

117.196.235.194:443

14.102.188.227:443

103.75.32.38:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 wtfismyip.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1828 wermgr.exe

flow	ioc
6	wtfismyip.com

description	pid	process
Token: SeDebugPrivilege	1828	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1404 wrote to memory of 1496	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1496	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1496	1404	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 1828	1496	regsvr32.exe	wermgr.exe
PID 1496 wrote to memory of 1828	1496	regsvr32.exe	wermgr.exe
PID 1496 wrote to memory of 1828	1496	regsvr32.exe	wermgr.exe
PID 1496 wrote to memory of 1828	1496	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-114-0x0000000000000000-mapping.dmp

Download
memory/1496-115-0x0000000000E40000-0x0000000000E7B000-memory.dmp

Filesize
236KB

Download
memory/1496-118-0x0000000000E80000-0x0000000000EB9000-memory.dmp

Filesize
228KB

Download
memory/1496-121-0x0000000000EC0000-0x0000000000EF8000-memory.dmp

Filesize
224KB

Download
memory/1496-122-0x0000000000CD0000-0x0000000000D09000-memory.dmp

Filesize
228KB

Download
memory/1496-124-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/1496-123-0x0000000000F40000-0x0000000000F85000-memory.dmp

Filesize
276KB

Download
memory/1496-125-0x0000000000F01000-0x0000000000F03000-memory.dmp

Filesize
8KB

Download
memory/1828-126-0x0000000000000000-mapping.dmp

Download
memory/1828-128-0x000001AE126B0000-0x000001AE126B1000-memory.dmp

Filesize
4KB

Download
memory/1828-127-0x000001AE12670000-0x000001AE12699000-memory.dmp

Filesize
164KB

Download