trickbot | 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5

Analysis

Target

148.dll
Size

740KB
MD5

7cc91fb0c73b92f4dcb529b5c2489489
SHA1

84ce61490587d848295aa5eebfdd502c50e200bc
SHA256

606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5
SHA512

c7127491c0cf1878b38c2417a072ffe8b123022b2b4d1d14706d783b7a23bc24df7185438c7c04a726dc01dd9d651574828e54dceb51b1094fc9c7abfca81d26

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral1/memory/1380-56-0x00000000002B0000-0x00000000002E9000-memory.dmp	templ_dll
behavioral1/memory/1380-60-0x00000000007F0000-0x0000000000827000-memory.dmp	templ_dll
behavioral1/memory/1380-63-0x00000000001F0000-0x0000000000226000-memory.dmp	templ_dll

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1008 wrote to memory of 1380	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 1380	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 1380	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 1380	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 1380	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 1380	1008	rundll32.exe	rundll32.exe
PID 1008 wrote to memory of 1380	1008	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148.dll,#1
1⤵
PID:1380

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008

memory/1380-54-0x0000000000000000-mapping.dmp

Download
memory/1380-55-0x0000000075381000-0x0000000075383000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x00000000002B0000-0x00000000002E9000-memory.dmp

Filesize
228KB

Download
memory/1380-60-0x00000000007F0000-0x0000000000827000-memory.dmp

Filesize
220KB

Download
memory/1380-64-0x0000000001CB0000-0x0000000001CF3000-memory.dmp

Filesize
268KB

Download
memory/1380-63-0x00000000001F0000-0x0000000000226000-memory.dmp

Filesize
216KB

Download