trickbot | 680b83b22bd59164735bf48203fb981d53ad8dd1eec1794e205887bdc6ca6f7f

Analysis

max time kernel
112s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/05/2022, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
680b83b22bd59164735bf48203fb981d53ad8dd1eec1794e205887bdc6ca6f7f.dll
Size 296KB
Sample220520-dsxebafcb6
SHA256 680b83b22bd59164735bf48203fb981d53ad8dd1eec1794e205887bdc6ca6f7f
MD5 3b6f1db37c86c9a3be0cee00d7ab0fb2
SHA1 c0f89c79b161fa81348a7737229a0c52d5bf1d61
SHA512 629bdb20f8022198cb1582cc8a79c80947f97260f3bc3d20f82194d69aa0ca261ab46ccfb74a44df47a8e97fb7ca7d66e55bfa33b1664f0f01614e0a47c24551
MD5 SHA1 SHA512

Score

10^/10

trickbot t470 banker packer trojan

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

t470

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

packer

resource	yara_rule
behavioral2/memory/3904-131-0x0000000000E00000-0x0000000000E2E000-memory.dmp	templ_dll
behavioral2/memory/3904-135-0x0000000000E30000-0x0000000000E5D000-memory.dmp	templ_dll
behavioral2/memory/3904-138-0x0000000000BD0000-0x0000000000BFB000-memory.dmp	templ_dll

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	wermgr.exe
Token: SeDebugPrivilege	3900	wermgr.exe
Token: SeDebugPrivilege	3900	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3904	3384	regsvr32.exe	78
PID 3384 wrote to memory of 3904	3384	regsvr32.exe	78
PID 3384 wrote to memory of 3904	3384	regsvr32.exe	78
PID 3904 wrote to memory of 3900	3904	regsvr32.exe	79
PID 3904 wrote to memory of 3900	3904	regsvr32.exe	79
PID 3904 wrote to memory of 3900	3904	regsvr32.exe	79
PID 3904 wrote to memory of 3900	3904	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\680b83b22bd59164735bf48203fb981d53ad8dd1eec1794e205887bdc6ca6f7f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\680b83b22bd59164735bf48203fb981d53ad8dd1eec1794e205887bdc6ca6f7f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3900-141-0x000001D9836D0000-0x000001D9836F0000-memory.dmp

Download

memory/3904-131-0x0000000000E00000-0x0000000000E2E000-memory.dmp

Download

memory/3904-135-0x0000000000E30000-0x0000000000E5D000-memory.dmp

Download

memory/3904-138-0x0000000000BD0000-0x0000000000BFB000-memory.dmp

Download

memory/3904-140-0x0000000000E70000-0x0000000000EA9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads