trickbot | ddf18de4cbb6d9731b53cff4a3285dfc913ea70fcf4ac88a829a21cf4911bdd6

Analysis

max time kernel
119s
max time network
118s
platform
windows10_x64
resource
win10-en-20211014
submitted
21/11/2021, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ce6bac6ab3c7792af9dc566b81f206a.dll
Size 563KB
Sample211121-meag3aggc8
SHA256 ddf18de4cbb6d9731b53cff4a3285dfc913ea70fcf4ac88a829a21cf4911bdd6
MD5 6ce6bac6ab3c7792af9dc566b81f206a
SHA1 a831a69d35a957e64dc625c73449e0d3f695d7dd
SHA512 3af486e8665a10567f487d58abcfe18d289b4717f945a4dac5c36b5380764d2eb58adad1ada9be9c8ba0859d1aec516191bacaa116e3ca9c1802bd2834592c2c
MD5 SHA1 SHA512

Score

10^/10

trickbot soc1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

soc1

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1872	1752	rundll32.exe	68
PID 1752 wrote to memory of 1872	1752	rundll32.exe	68
PID 1752 wrote to memory of 1872	1752	rundll32.exe	68
PID 1872 wrote to memory of 8	1872	rundll32.exe	69
PID 1872 wrote to memory of 8	1872	rundll32.exe	69
PID 1872 wrote to memory of 8	1872	rundll32.exe	69
PID 1872 wrote to memory of 1508	1872	rundll32.exe	70
PID 1872 wrote to memory of 1508	1872	rundll32.exe	70
PID 1872 wrote to memory of 1508	1872	rundll32.exe	70
PID 1872 wrote to memory of 1508	1872	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ce6bac6ab3c7792af9dc566b81f206a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ce6bac6ab3c7792af9dc566b81f206a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:8
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-121-0x000001E29E820000-0x000001E29E849000-memory.dmp

Download

memory/1508-122-0x000001E29E860000-0x000001E29E861000-memory.dmp

Download

memory/1508-124-0x000001E29EA60000-0x000001E29EA62000-memory.dmp

Download

memory/1508-123-0x000001E29EA60000-0x000001E29EA62000-memory.dmp

Download

memory/1872-116-0x00000000042C0000-0x0000000004528000-memory.dmp

Download

memory/1872-117-0x0000000004530000-0x0000000004575000-memory.dmp

Download

memory/1872-118-0x00000000029F0000-0x00000000029F1000-memory.dmp

Download

memory/1872-119-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads