trickbot | d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908

Analysis

max time kernel
144s
max time network
147s
platform
windows10_x64
resource
win10-en-20210920
submitted
05/10/2021, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage_dropped_file.dll
Size 476KB
Sample211005-vfpblsabb7
SHA256 d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
MD5 7cdbcf8253a45f476d2a8d1dbf7bac37
SHA1 e23a3d3a7ce75f2ff9d1af7591e770042ef7f0db
SHA512 ca111822f57fc0a751179f0f2b29af003ab1f942099afb366271118154369ba19848058d139082fdd27aabaf1b06f2d768d52dae43220e3b7ed253e3148eeafc
MD5 SHA1 SHA512

Score

10^/10

trickbot zvs1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

zvs1

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 3696	3800	regsvr32.exe	70
PID 3800 wrote to memory of 3696	3800	regsvr32.exe	70
PID 3800 wrote to memory of 3696	3800	regsvr32.exe	70
PID 3696 wrote to memory of 2628	3696	regsvr32.exe	71
PID 3696 wrote to memory of 2628	3696	regsvr32.exe	71
PID 3696 wrote to memory of 2628	3696	regsvr32.exe	71
PID 3696 wrote to memory of 2628	3696	regsvr32.exe	71

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-129-0x0000013163670000-0x0000013163671000-memory.dmp

Download

memory/2628-128-0x0000013163460000-0x0000013163489000-memory.dmp

Download

memory/3696-116-0x0000000002F40000-0x0000000002F7B000-memory.dmp

Download

memory/3696-119-0x0000000002F00000-0x0000000002F39000-memory.dmp

Download

memory/3696-120-0x0000000002F80000-0x0000000002FB9000-memory.dmp

Download

memory/3696-122-0x0000000004750000-0x0000000004788000-memory.dmp

Download

memory/3696-124-0x0000000004790000-0x00000000047D5000-memory.dmp

Download

memory/3696-125-0x0000000003000000-0x0000000003001000-memory.dmp

Download

memory/3696-126-0x0000000002FD1000-0x0000000002FD3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads