trickbot | cf85ad2881d19e6f1a5cf3e0d9edfbfedcf157eb507473e40d0865ef29d0214c

Analysis

max time kernel
69s
max time network
144s
platform
windows10_x64
resource
win10v20210408
submitted
12/10/2021, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svwbe.dll
Size 353KB
Sample211012-wwx45acfgr
SHA256 cf85ad2881d19e6f1a5cf3e0d9edfbfedcf157eb507473e40d0865ef29d0214c
MD5 fcac49c548a0efe33dfb6f2501ad1331
SHA1 3bb9b5b8fd37afd219f23e31248690506ef8eef5
SHA512 129dfb05c69a6ab9ca9aa537ba0fea3b9b524ef3b96a690548f99783b6a73bff04576c3aee88e4ac0a99e0ec7401ad1f17832ddb1c1f77c6a48bd14daeb62252
MD5 SHA1 SHA512

Score

10^/10

trickbot fat1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

fat1

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3024	powershell.exe
3024	powershell.exe
3024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	3480	wermgr.exe
Token: SeDebugPrivilege	3752	wermgr.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 2464	964	rundll32.exe	70
PID 964 wrote to memory of 2464	964	rundll32.exe	70
PID 964 wrote to memory of 2464	964	rundll32.exe	70
PID 3024 wrote to memory of 1540	3024	powershell.exe	76
PID 3024 wrote to memory of 1540	3024	powershell.exe	76
PID 2464 wrote to memory of 2972	2464	rundll32.exe	78
PID 2464 wrote to memory of 2972	2464	rundll32.exe	78
PID 2464 wrote to memory of 2972	2464	rundll32.exe	78
PID 2464 wrote to memory of 3480	2464	rundll32.exe	79
PID 2464 wrote to memory of 3480	2464	rundll32.exe	79
PID 2464 wrote to memory of 3480	2464	rundll32.exe	79
PID 2464 wrote to memory of 3480	2464	rundll32.exe	79
PID 1540 wrote to memory of 2144	1540	cmd.exe	83
PID 1540 wrote to memory of 2144	1540	cmd.exe	83
PID 2144 wrote to memory of 1160	2144	rundll32.exe	84
PID 2144 wrote to memory of 1160	2144	rundll32.exe	84
PID 2144 wrote to memory of 1160	2144	rundll32.exe	84
PID 1160 wrote to memory of 412	1160	rundll32.exe	86
PID 1160 wrote to memory of 412	1160	rundll32.exe	86
PID 1160 wrote to memory of 412	1160	rundll32.exe	86
PID 1160 wrote to memory of 3752	1160	rundll32.exe	85
PID 1160 wrote to memory of 3752	1160	rundll32.exe	85
PID 1160 wrote to memory of 3752	1160	rundll32.exe	85
PID 1160 wrote to memory of 3752	1160	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\svwbe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\svwbe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2972
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\rundll32.exe
    rundll32 svwbe.dll,SetConsoleW
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 svwbe.dll,SetConsoleW
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\system32\wermgr.exe
        
        C:\Windows\system32\wermgr.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3752
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe
        5⤵
        
        PID:412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-179-0x0000000002C00000-0x0000000002D4A000-memory.dmp

Download

memory/1160-180-0x0000000002D50000-0x0000000002D51000-memory.dmp

Download

memory/2464-169-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/2464-168-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Download

memory/2464-167-0x0000000002C00000-0x0000000002C3A000-memory.dmp

Download

memory/3024-122-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-118-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-136-0x00000206B1BA3000-0x00000206B1BA5000-memory.dmp

Download

memory/3024-139-0x00000206B28E0000-0x00000206B28E1000-memory.dmp

Download

memory/3024-150-0x00000206B2B00000-0x00000206B2B01000-memory.dmp

Download

memory/3024-155-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-156-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-123-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-121-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-120-0x00000206B2440000-0x00000206B2441000-memory.dmp

Download

memory/3024-119-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-115-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-116-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-117-0x0000020699450000-0x0000020699452000-memory.dmp

Download

memory/3024-134-0x00000206B1BA0000-0x00000206B1BA2000-memory.dmp

Download

memory/3480-175-0x000001FD13770000-0x000001FD13772000-memory.dmp

Download

memory/3480-176-0x000001FD13770000-0x000001FD13772000-memory.dmp

Download

memory/3480-174-0x000001FD13740000-0x000001FD13741000-memory.dmp

Download

memory/3480-173-0x000001FD13630000-0x000001FD13659000-memory.dmp

Download

memory/3752-182-0x000002DD6DA50000-0x000002DD6DA79000-memory.dmp

Download

memory/3752-184-0x000002DD6DB90000-0x000002DD6DB92000-memory.dmp

Download

memory/3752-183-0x000002DD6DB90000-0x000002DD6DB92000-memory.dmp

Download