trickbot | ddf18de4cbb6d9731b53cff4a3285dfc913ea70fcf4ac88a829a21cf4911bdd6

Analysis

max time kernel
139s
max time network
148s
platform
windows7_x64
resource
win7-en-20211104
submitted
21/11/2021, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ce6bac6ab3c7792af9dc566b81f206a.dll
Size 563KB
Sample211121-meag3aggc8
SHA256 ddf18de4cbb6d9731b53cff4a3285dfc913ea70fcf4ac88a829a21cf4911bdd6
MD5 6ce6bac6ab3c7792af9dc566b81f206a
SHA1 a831a69d35a957e64dc625c73449e0d3f695d7dd
SHA512 3af486e8665a10567f487d58abcfe18d289b4717f945a4dac5c36b5380764d2eb58adad1ada9be9c8ba0859d1aec516191bacaa116e3ca9c1802bd2834592c2c
MD5 SHA1 SHA512

Score

10^/10

trickbot soc1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

soc1

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	576	wermgr.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 804	660	rundll32.exe	28
PID 660 wrote to memory of 804	660	rundll32.exe	28
PID 660 wrote to memory of 804	660	rundll32.exe	28
PID 660 wrote to memory of 804	660	rundll32.exe	28
PID 660 wrote to memory of 804	660	rundll32.exe	28
PID 660 wrote to memory of 804	660	rundll32.exe	28
PID 660 wrote to memory of 804	660	rundll32.exe	28
PID 804 wrote to memory of 620	804	rundll32.exe	29
PID 804 wrote to memory of 620	804	rundll32.exe	29
PID 804 wrote to memory of 620	804	rundll32.exe	29
PID 804 wrote to memory of 620	804	rundll32.exe	29
PID 804 wrote to memory of 576	804	rundll32.exe	30
PID 804 wrote to memory of 576	804	rundll32.exe	30
PID 804 wrote to memory of 576	804	rundll32.exe	30
PID 804 wrote to memory of 576	804	rundll32.exe	30
PID 804 wrote to memory of 576	804	rundll32.exe	30
PID 804 wrote to memory of 576	804	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ce6bac6ab3c7792af9dc566b81f206a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ce6bac6ab3c7792af9dc566b81f206a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:620
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-63-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/576-62-0x0000000000060000-0x0000000000089000-memory.dmp

Download

memory/804-56-0x0000000076341000-0x0000000076343000-memory.dmp

Download

memory/804-57-0x0000000000A00000-0x0000000000C68000-memory.dmp

Download

memory/804-58-0x0000000000290000-0x00000000002D5000-memory.dmp

Download

memory/804-59-0x00000000001F0000-0x0000000000201000-memory.dmp

Download

memory/804-60-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads