trickbot | d9fa1526724efed5f7ec523301bf4bf80ac0918790d7beef8485ed72218afcc1

Analysis

max time kernel
121s
max time network
127s
platform
windows10_x64
resource
win10-en-20211014
submitted
07/12/2021, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15776f46dd81ecf7b4f016d0d6a46ef5.dll
Size 1.7MB
Sample211207-s8r7vsdhf6
SHA256 d9fa1526724efed5f7ec523301bf4bf80ac0918790d7beef8485ed72218afcc1
MD5 15776f46dd81ecf7b4f016d0d6a46ef5
SHA1 cbb89e847ada9cd5e67e1f1532abcee1d3132a54
SHA512 7584ff578a94e65ced5303da2db467db347bdc76b3ab6c47e338d69b0e5f5c1b5bbcac0f4e14080cf7e493edabe73bd2b3c3800b24ca18fa0b7e01289523a5d6
MD5 SHA1 SHA512

Score

10^/10

trickbot rob141 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob141

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ipinfo.io

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2724	2680	rundll32.exe	69
PID 2680 wrote to memory of 2724	2680	rundll32.exe	69
PID 2680 wrote to memory of 2724	2680	rundll32.exe	69
PID 2724 wrote to memory of 3684	2724	rundll32.exe	70
PID 2724 wrote to memory of 3684	2724	rundll32.exe	70
PID 2724 wrote to memory of 3684	2724	rundll32.exe	70
PID 2724 wrote to memory of 3320	2724	rundll32.exe	71
PID 2724 wrote to memory of 3320	2724	rundll32.exe	71
PID 2724 wrote to memory of 3320	2724	rundll32.exe	71
PID 2724 wrote to memory of 3320	2724	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15776f46dd81ecf7b4f016d0d6a46ef5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15776f46dd81ecf7b4f016d0d6a46ef5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3684
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-116-0x0000000004C80000-0x0000000004EE8000-memory.dmp

Download

memory/2724-117-0x0000000004EF0000-0x0000000004F35000-memory.dmp

Download

memory/2724-118-0x0000000003390000-0x0000000003391000-memory.dmp

Download

memory/2724-119-0x0000000010001000-0x0000000010003000-memory.dmp

Download

memory/3320-122-0x0000029A0D6D0000-0x0000029A0D6D1000-memory.dmp

Download

memory/3320-121-0x0000029A0D4C0000-0x0000029A0D4E8000-memory.dmp

Download

memory/3320-123-0x0000029A0D710000-0x0000029A0D712000-memory.dmp

Download

memory/3320-124-0x0000029A0D710000-0x0000029A0D712000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads