trickbot | 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07/05/2022, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
148.dll
Size 740KB
Sample220507-ej1k2sdfgj
SHA256 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5
MD5 7cc91fb0c73b92f4dcb529b5c2489489
SHA1 84ce61490587d848295aa5eebfdd502c50e200bc
SHA512 c7127491c0cf1878b38c2417a072ffe8b123022b2b4d1d14706d783b7a23bc24df7185438c7c04a726dc01dd9d651574828e54dceb51b1094fc9c7abfca81d26
MD5 SHA1 SHA512

Score

10^/10

trickbot mon148 banker packer trojan

Malware Config

Extracted

Family

trickbot

Version

100013

Botnet

mon148

103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

packer

resource	yara_rule
behavioral2/memory/2824-131-0x0000000002D30000-0x0000000002D69000-memory.dmp	templ_dll
behavioral2/memory/2824-135-0x0000000002D70000-0x0000000002DA7000-memory.dmp	templ_dll
behavioral2/memory/2824-138-0x0000000002CF0000-0x0000000002D26000-memory.dmp	templ_dll

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2824	2580	rundll32.exe	83
PID 2580 wrote to memory of 2824	2580	rundll32.exe	83
PID 2580 wrote to memory of 2824	2580	rundll32.exe	83
PID 2824 wrote to memory of 3936	2824	rundll32.exe	84
PID 2824 wrote to memory of 3936	2824	rundll32.exe	84
PID 2824 wrote to memory of 3936	2824	rundll32.exe	84
PID 2824 wrote to memory of 3708	2824	rundll32.exe	85
PID 2824 wrote to memory of 3708	2824	rundll32.exe	85
PID 2824 wrote to memory of 3708	2824	rundll32.exe	85
PID 2824 wrote to memory of 3708	2824	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\148.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3936
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-131-0x0000000002D30000-0x0000000002D69000-memory.dmp

Download

memory/2824-135-0x0000000002D70000-0x0000000002DA7000-memory.dmp

Download

memory/2824-138-0x0000000002CF0000-0x0000000002D26000-memory.dmp

Download

memory/2824-140-0x0000000002EC0000-0x0000000002F03000-memory.dmp

Download

memory/3708-141-0x00000234E2A20000-0x00000234E2A48000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads