trickbot | 0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa

Analysis

max time kernel
138s
max time network
151s
platform
windows10_x64
resource
win10-en-20211104
submitted
07/12/2021, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roben.png.dll
Size 1.7MB
Sample211207-pmr37acaa6
SHA256 0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa
MD5 19960144c686dac775ed7bca893982b9
SHA1 a9be471157552ca374a615dd99c0452234981a4c
SHA512 3a1da388eb1dc56c791a98bb6c101c418acb59c40927efff5509b8698c3749c44148bf60a175251ea8628a8117960e8146c184742d60aa01fa0e8d8902f5e463
MD5 SHA1 SHA512

Score

10^/10

trickbot rob141 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob141

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2392	2164	rundll32.exe	68
PID 2164 wrote to memory of 2392	2164	rundll32.exe	68
PID 2164 wrote to memory of 2392	2164	rundll32.exe	68
PID 2392 wrote to memory of 2252	2392	rundll32.exe	69
PID 2392 wrote to memory of 2252	2392	rundll32.exe	69
PID 2392 wrote to memory of 2252	2392	rundll32.exe	69
PID 2392 wrote to memory of 2716	2392	rundll32.exe	70
PID 2392 wrote to memory of 2716	2392	rundll32.exe	70
PID 2392 wrote to memory of 2716	2392	rundll32.exe	70
PID 2392 wrote to memory of 2716	2392	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\roben.png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\roben.png.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2252
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-119-0x0000000004110000-0x0000000004378000-memory.dmp

Download

memory/2392-120-0x0000000000B00000-0x0000000000B45000-memory.dmp

Download

memory/2392-121-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/2392-122-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/2716-124-0x0000024DDBB70000-0x0000024DDBB98000-memory.dmp

Download

memory/2716-125-0x0000024DDBC80000-0x0000024DDBC81000-memory.dmp

Download

memory/2716-127-0x0000024DDBDB0000-0x0000024DDBDB2000-memory.dmp

Download

memory/2716-126-0x0000024DDBDB0000-0x0000024DDBDB2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads