trickbot | 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5

Analysis

Target
148.dll
Size 740KB
Sample220512-tqmp4aedhm
SHA256 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5
MD5 7cc91fb0c73b92f4dcb529b5c2489489
SHA1 84ce61490587d848295aa5eebfdd502c50e200bc
SHA512 c7127491c0cf1878b38c2417a072ffe8b123022b2b4d1d14706d783b7a23bc24df7185438c7c04a726dc01dd9d651574828e54dceb51b1094fc9c7abfca81d26
MD5 SHA1 SHA512

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

resource	yara_rule
behavioral1/memory/1380-56-0x00000000002B0000-0x00000000002E9000-memory.dmp	templ_dll
behavioral1/memory/1380-60-0x00000000007F0000-0x0000000000827000-memory.dmp	templ_dll
behavioral1/memory/1380-63-0x00000000001F0000-0x0000000000226000-memory.dmp	templ_dll

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1380	1008	rundll32.exe	14
PID 1008 wrote to memory of 1380	1008	rundll32.exe	14
PID 1008 wrote to memory of 1380	1008	rundll32.exe	14
PID 1008 wrote to memory of 1380	1008	rundll32.exe	14
PID 1008 wrote to memory of 1380	1008	rundll32.exe	14
PID 1008 wrote to memory of 1380	1008	rundll32.exe	14
PID 1008 wrote to memory of 1380	1008	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148.dll,#1
1⤵
PID:1380

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008

memory/1380-55-0x0000000075381000-0x0000000075383000-memory.dmp

Download

memory/1380-56-0x00000000002B0000-0x00000000002E9000-memory.dmp

Download

memory/1380-60-0x00000000007F0000-0x0000000000827000-memory.dmp

Download

memory/1380-64-0x0000000001CB0000-0x0000000001CF3000-memory.dmp

Download

memory/1380-63-0x00000000001F0000-0x0000000000226000-memory.dmp

Download