trickbot | 8bcfddc163b1eab5905425101e6af899c9ece1d64b9ad19ff58e6fa00f828ee5

Analysis

max time kernel
137s
max time network
152s
platform
windows7_x64
resource
win7-en-20211104
submitted
07/12/2021, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roben.png.dll
Size 1.8MB
Sample211207-pgmarahbbk
SHA256 8bcfddc163b1eab5905425101e6af899c9ece1d64b9ad19ff58e6fa00f828ee5
MD5 5880f8b6115f5e8ae3faf01920d38dc7
SHA1 760a4b58b4afb8a8a5b69ea350e5d1941ec83be6
SHA512 cfeb979b7bb504ef56f2d5dd4e7bac1477651d2af4232d1766009211e1ce89e6677ed469d993cd6f395dc4ab2966645bb679b7be3e738d492806442b0b3694a0
MD5 SHA1 SHA512

Score

10^/10

trickbot rob141 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob141

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	wermgr.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1464	1892	rundll32.exe	27
PID 1892 wrote to memory of 1464	1892	rundll32.exe	27
PID 1892 wrote to memory of 1464	1892	rundll32.exe	27
PID 1892 wrote to memory of 1464	1892	rundll32.exe	27
PID 1892 wrote to memory of 1464	1892	rundll32.exe	27
PID 1892 wrote to memory of 1464	1892	rundll32.exe	27
PID 1892 wrote to memory of 1464	1892	rundll32.exe	27
PID 1464 wrote to memory of 568	1464	rundll32.exe	29
PID 1464 wrote to memory of 568	1464	rundll32.exe	29
PID 1464 wrote to memory of 568	1464	rundll32.exe	29
PID 1464 wrote to memory of 568	1464	rundll32.exe	29
PID 1464 wrote to memory of 1420	1464	rundll32.exe	30
PID 1464 wrote to memory of 1420	1464	rundll32.exe	30
PID 1464 wrote to memory of 1420	1464	rundll32.exe	30
PID 1464 wrote to memory of 1420	1464	rundll32.exe	30
PID 1464 wrote to memory of 1420	1464	rundll32.exe	30
PID 1464 wrote to memory of 1420	1464	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\roben.png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\roben.png.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:568
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-63-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/1420-62-0x0000000000060000-0x0000000000088000-memory.dmp

Download

memory/1464-56-0x0000000075981000-0x0000000075983000-memory.dmp

Download

memory/1464-57-0x0000000000910000-0x0000000000B78000-memory.dmp

Download

memory/1464-59-0x0000000000180000-0x0000000000191000-memory.dmp

Download

memory/1464-58-0x0000000000710000-0x0000000000755000-memory.dmp

Download

memory/1464-60-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads