5cc895d9c7951c8f20a19a5538270c3bca4c17e650be6209c6aafce3f780c603

General
Target

5cc895d9c7951c8f20a19a5538270c3bca4c17e650be6209c6aafce3f780c603.dll

Filesize

706KB

Completed

21-10-2021 21:30

Score
10/10
MD5

6130d265357ce71154ba46051203c96a

SHA1

4446b675dad569c38126bc170a6dcac18d740500

SHA256

5cc895d9c7951c8f20a19a5538270c3bca4c17e650be6209c6aafce3f780c603

Malware Config

Extracted

Family trickbot
Version 100019
Botnet rob136
C2

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes
autorun
Name:pwgrabb
Name:pwgrabc
ecc_pubkey.base64
Signatures 5

Filter: none

  • Trickbot

    Description

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2

    Description

    suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2

    Tags

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    45wtfismyip.com
  • Suspicious use of AdjustPrivilegeToken
    wermgr.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege920wermgr.exe
  • Suspicious use of WriteProcessMemory
    rundll32.exerundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2336 wrote to memory of 30602336rundll32.exerundll32.exe
    PID 2336 wrote to memory of 30602336rundll32.exerundll32.exe
    PID 2336 wrote to memory of 30602336rundll32.exerundll32.exe
    PID 3060 wrote to memory of 9163060rundll32.execmd.exe
    PID 3060 wrote to memory of 9163060rundll32.execmd.exe
    PID 3060 wrote to memory of 9163060rundll32.execmd.exe
    PID 3060 wrote to memory of 9203060rundll32.exewermgr.exe
    PID 3060 wrote to memory of 9203060rundll32.exewermgr.exe
    PID 3060 wrote to memory of 9203060rundll32.exewermgr.exe
    PID 3060 wrote to memory of 9203060rundll32.exewermgr.exe
Processes 4
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cc895d9c7951c8f20a19a5538270c3bca4c17e650be6209c6aafce3f780c603.dll,#1
    Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cc895d9c7951c8f20a19a5538270c3bca4c17e650be6209c6aafce3f780c603.dll,#1
      Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe
        PID:916
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        Suspicious use of AdjustPrivilegeToken
        PID:920
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/920-121-0x00000270690C0000-0x00000270690E9000-memory.dmp

                          • memory/920-122-0x0000027069100000-0x0000027069101000-memory.dmp

                          • memory/920-123-0x0000027069300000-0x0000027069302000-memory.dmp

                          • memory/920-124-0x0000027069300000-0x0000027069302000-memory.dmp

                          • memory/920-120-0x0000000000000000-mapping.dmp

                          • memory/3060-119-0x0000000010001000-0x0000000010003000-memory.dmp

                          • memory/3060-115-0x0000000000000000-mapping.dmp

                          • memory/3060-116-0x00000000043F0000-0x0000000004658000-memory.dmp

                          • memory/3060-117-0x0000000000B50000-0x0000000000B95000-memory.dmp

                          • memory/3060-118-0x00000000005F0000-0x00000000005F1000-memory.dmp