trickbot | f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mon48_cr.dll
Size 329KB
Sample220512-t3g1dafecn
SHA256 f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73
MD5 48cab21fcbe254e7c83f4c1d455a39dc
SHA1 b96c1f765abb14eb401cacab6f6e203c3a255df9
SHA512 0375a26a2d6d8990d202b75b4cb6797d03300ddc077c4dcb05778365212644ee49ce6e437fde0b77e1b8179d01ffad028635869d2f3897333b85471724d15ebc
MD5 SHA1 SHA512

Score

10^/10

trickbot mon48 banker packer suricata trojan

Malware Config

Extracted

Family

trickbot

Version

100011

Botnet

mon48

194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

packer

resource	yara_rule
behavioral2/memory/1156-132-0x0000000002200000-0x0000000002237000-memory.dmp	templ_dll

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	wermgr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1156	2200	rundll32.exe	81
PID 2200 wrote to memory of 1156	2200	rundll32.exe	81
PID 2200 wrote to memory of 1156	2200	rundll32.exe	81
PID 1156 wrote to memory of 2088	1156	rundll32.exe	86
PID 1156 wrote to memory of 2088	1156	rundll32.exe	86
PID 1156 wrote to memory of 3456	1156	rundll32.exe	87
PID 1156 wrote to memory of 3456	1156	rundll32.exe	87
PID 1156 wrote to memory of 3456	1156	rundll32.exe	87
PID 1156 wrote to memory of 3456	1156	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mon48_cr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mon48_cr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:2088
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-132-0x0000000002200000-0x0000000002237000-memory.dmp

Download

memory/1156-133-0x0000000002240000-0x0000000002281000-memory.dmp

Download

memory/3456-134-0x000001B4223A0000-0x000001B4223C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads