trickbot | 2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0

Analysis

max time kernel
68s
max time network
134s
platform
windows10_x64
resource
win10v20210408
submitted
05/10/2021, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage_dropped_file.dll
Size 476KB
Sample211005-ve41nsabb6
SHA256 2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
MD5 45bd1517b770fb31e70eb9d1b415dfef
SHA1 cf770ccabffb62bcde88e41c50aa50896d856703
SHA512 3f47b1242936250e3a88338cba099d81f5153ff6692301a70d24beb7675b102b16252fcdf295cdf3d08db5761c71c8bdca9d57534465f182e1f190f675511e7d
MD5 SHA1 SHA512

Score

10^/10

trickbot zvs1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

zvs1

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	888	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 624	628	regsvr32.exe	68
PID 628 wrote to memory of 624	628	regsvr32.exe	68
PID 628 wrote to memory of 624	628	regsvr32.exe	68
PID 624 wrote to memory of 888	624	regsvr32.exe	69
PID 624 wrote to memory of 888	624	regsvr32.exe	69
PID 624 wrote to memory of 888	624	regsvr32.exe	69
PID 624 wrote to memory of 888	624	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-115-0x0000000002FA0000-0x0000000002FDB000-memory.dmp

Download

memory/624-118-0x0000000002E50000-0x0000000002E89000-memory.dmp

Download

memory/624-119-0x0000000002FE0000-0x0000000003019000-memory.dmp

Download

memory/624-121-0x00000000048C0000-0x00000000048F8000-memory.dmp

Download

memory/624-124-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/624-123-0x0000000004910000-0x0000000004955000-memory.dmp

Download

memory/624-125-0x0000000004971000-0x0000000004973000-memory.dmp

Download

memory/888-128-0x000002968C460000-0x000002968C461000-memory.dmp

Download

memory/888-127-0x000002968C420000-0x000002968C449000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads