trickbot | a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09

Analysis

max time kernel
141s
max time network
169s
platform
windows7_x64
resource
win7v20210408
submitted
06/10/2021, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
070d44df8e4e787599fc5834434fe522.dll
Size 476KB
Sample211006-j81pkaagg2
SHA256 a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
MD5 070d44df8e4e787599fc5834434fe522
SHA1 316f7c2646ba8837a7b356bb00bddc85693e78aa
SHA512 0139f16b2350c61537afc88a94cf5797d96481811eb4af0274f54bffe016c221c13831b6bd170e80dc9dcec6fbe477d80ad6290f45aa671cfbbad77b92c792f9
MD5 SHA1 SHA512

Score

10^/10

trickbot zvs1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

zvs1

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	icanhazip.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1952	1892	regsvr32.exe	25
PID 1892 wrote to memory of 1952	1892	regsvr32.exe	25
PID 1892 wrote to memory of 1952	1892	regsvr32.exe	25
PID 1892 wrote to memory of 1952	1892	regsvr32.exe	25
PID 1892 wrote to memory of 1952	1892	regsvr32.exe	25
PID 1892 wrote to memory of 1952	1892	regsvr32.exe	25
PID 1892 wrote to memory of 1952	1892	regsvr32.exe	25
PID 1952 wrote to memory of 2000	1952	regsvr32.exe	26
PID 1952 wrote to memory of 2000	1952	regsvr32.exe	26
PID 1952 wrote to memory of 2000	1952	regsvr32.exe	26
PID 1952 wrote to memory of 2000	1952	regsvr32.exe	26
PID 1952 wrote to memory of 2000	1952	regsvr32.exe	26
PID 1952 wrote to memory of 2000	1952	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\070d44df8e4e787599fc5834434fe522.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\070d44df8e4e787599fc5834434fe522.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-59-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Download

memory/1952-61-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1952-62-0x0000000000420000-0x000000000045B000-memory.dmp

Download

memory/1952-65-0x0000000000690000-0x00000000006C9000-memory.dmp

Download

memory/1952-67-0x0000000000AC0000-0x0000000000AF8000-memory.dmp

Download

memory/1952-69-0x00000000001B0000-0x0000000000230000-memory.dmp

Download

memory/1952-70-0x0000000000B00000-0x0000000000B45000-memory.dmp

Download

memory/1952-71-0x0000000000460000-0x0000000000471000-memory.dmp

Download

memory/1952-72-0x00000000001B0000-0x0000000000230000-memory.dmp

Download

memory/2000-75-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/2000-74-0x0000000000060000-0x0000000000089000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads