trickbot | f5fd02ebd2376fd1bc1ff121e9bfda618755a5c049edc8a4288eb67eb1cc7f9b

Analysis

max time kernel
140s
max time network
151s
submitted
01/01/1970, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dllhost.exe
Size 184KB
Sample211027-w4ww2agcb7
SHA256 f5fd02ebd2376fd1bc1ff121e9bfda618755a5c049edc8a4288eb67eb1cc7f9b
MD5 ea8b7985d8d87460fa4576526c837260
SHA1 d164dcd8d7dd0d8eefc727f959c2a1502e6197f1
SHA512 0410569aecdf92680ec0db3955c10920e6a37f8f22822a52e4ae9f492f15b4e99c42fbf6c7496f6e71be344137518364bf86f332918ecd1d21d393b4b7908434
MD5 SHA1 SHA512

Score

10^/10

trickbot rob137 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob137

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1296	Get-Variable.exe

Loads dropped DLL 1 IoCs

pid	Process
364	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
640	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	wermgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3500	dllhost.exe
3500	dllhost.exe
1296	Get-Variable.exe
1296	Get-Variable.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 640	3500	dllhost.exe	69
PID 3500 wrote to memory of 640	3500	dllhost.exe	69
PID 3500 wrote to memory of 640	3500	dllhost.exe	69
PID 3500 wrote to memory of 1296	3500	dllhost.exe	70
PID 3500 wrote to memory of 1296	3500	dllhost.exe	70
PID 3500 wrote to memory of 1296	3500	dllhost.exe	70
PID 1296 wrote to memory of 364	1296	Get-Variable.exe	71
PID 1296 wrote to memory of 364	1296	Get-Variable.exe	71
PID 1296 wrote to memory of 364	1296	Get-Variable.exe	71
PID 364 wrote to memory of 780	364	rundll32.exe	72
PID 364 wrote to memory of 780	364	rundll32.exe	72
PID 364 wrote to memory of 780	364	rundll32.exe	72
PID 364 wrote to memory of 4008	364	rundll32.exe	73
PID 364 wrote to memory of 4008	364	rundll32.exe	73
PID 364 wrote to memory of 4008	364	rundll32.exe	73
PID 364 wrote to memory of 4008	364	rundll32.exe	73

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\schtasks.exe
  /create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "powershell.exe -windowstyle hidden"
  2⤵
  - Creates scheduled task(s)
  PID:640
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\pig.dll,hat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe
      4⤵
      PID:780
  - - C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-131-0x0000000000690000-0x00000000006CC000-memory.dmp

Download

memory/364-140-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/364-141-0x0000000000AD1000-0x0000000000AD3000-memory.dmp

Download

memory/364-139-0x0000000004120000-0x0000000004165000-memory.dmp

Download

memory/364-138-0x00000000040E0000-0x0000000004119000-memory.dmp

Download

memory/364-137-0x0000000000775000-0x0000000000776000-memory.dmp

Download

memory/364-136-0x0000000000741000-0x0000000000775000-memory.dmp

Download

memory/364-135-0x00000000006D3000-0x00000000006D4000-memory.dmp

Download

memory/364-134-0x00000000006D1000-0x00000000006D3000-memory.dmp

Download

memory/1296-127-0x0000000000601000-0x0000000000606000-memory.dmp

Download

memory/1296-124-0x00000000005F0000-0x00000000005FB000-memory.dmp

Download

memory/3500-115-0x0000000002220000-0x000000000222B000-memory.dmp

Download

memory/3500-118-0x0000000002231000-0x0000000002236000-memory.dmp

Download

memory/3500-119-0x0000000000610000-0x0000000000618000-memory.dmp

Download

memory/4008-143-0x000001CD63220000-0x000001CD63249000-memory.dmp

Download

memory/4008-144-0x000001CD63330000-0x000001CD63331000-memory.dmp

Download

memory/4008-146-0x000001CD63460000-0x000001CD63462000-memory.dmp

Download

memory/4008-145-0x000001CD63460000-0x000001CD63462000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads