trickbot | 823a2b72e2c786185eb0e6a9e25144c66c51ec1fa0e145da559f7a3e8830a9d9

Analysis

max time kernel
136s
max time network
152s
platform
windows10_x64
resource
win10-en-20210920
submitted
21-10-2021 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

823a2b72e2c786185eb0e6a9e25144c66c51ec1fa0e145da559f7a3e8830a9d9.dll
Size

706KB
MD5

e5ed8401e0b898e559a92e663df499f9
SHA1

db93cabf928192bd889e94aad739f1a1519c16ca
SHA256

823a2b72e2c786185eb0e6a9e25144c66c51ec1fa0e145da559f7a3e8830a9d9
SHA512

0d94950590700caa89116d234c7e4bfed3205dea1841fab64c9eff6014b966985971d081f4ef5086e006722f6111ded165b1f20f9f032486c724912c7cd6dc99

Score

10^/10

trickbot rob136 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob136

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2972 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	2972	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4088 wrote to memory of 1836	4088	rundll32.exe	rundll32.exe
PID 4088 wrote to memory of 1836	4088	rundll32.exe	rundll32.exe
PID 4088 wrote to memory of 1836	4088	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 1664	1836	rundll32.exe	cmd.exe
PID 1836 wrote to memory of 1664	1836	rundll32.exe	cmd.exe
PID 1836 wrote to memory of 1664	1836	rundll32.exe	cmd.exe
PID 1836 wrote to memory of 2972	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 2972	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 2972	1836	rundll32.exe	wermgr.exe
PID 1836 wrote to memory of 2972	1836	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\823a2b72e2c786185eb0e6a9e25144c66c51ec1fa0e145da559f7a3e8830a9d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\823a2b72e2c786185eb0e6a9e25144c66c51ec1fa0e145da559f7a3e8830a9d9.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
3⤵
PID:1664

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-118-0x0000000000000000-mapping.dmp

Download
memory/1836-119-0x0000000004480000-0x00000000046E8000-memory.dmp

Filesize
2.4MB

Download
memory/1836-120-0x0000000002E00000-0x0000000002E45000-memory.dmp

Filesize
276KB

Download
memory/1836-122-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/1836-121-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/2972-123-0x0000000000000000-mapping.dmp

Download
memory/2972-124-0x000001F04B490000-0x000001F04B4B9000-memory.dmp

Filesize
164KB

Download
memory/2972-125-0x000001F04B5A0000-0x000001F04B5A1000-memory.dmp

Filesize
4KB

Download
memory/2972-127-0x000001F04B5D0000-0x000001F04B5D2000-memory.dmp

Filesize
8KB

Download
memory/2972-126-0x000001F04B5D0000-0x000001F04B5D2000-memory.dmp

Filesize
8KB

Download