trickbot | e59e7db0c75cef4bb6e057d725bae7ed5e13fd011b54fe39c3fe7cdb123b684f | Triage

Analysis

max time kernel
33s
max time network
40s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-06-2022 13:51

Sharing

Report Analysis Logs

General

Target

0374bb627e51aa5fa5df0640a5468939cf190a1a1bc0c8a0f3df4bc9b3e92171.dll
Size

442KB
MD5

1eadc669573e390002451cae24c73d2a
SHA1

b53754d5e713b95d3f2a9ad154946fb9ed79cec1
SHA256

0374bb627e51aa5fa5df0640a5468939cf190a1a1bc0c8a0f3df4bc9b3e92171
SHA512

78f5cf2f06d3eb47171b3e6d05ce00cfdfd7b5eb8ddcff07621f7d3f9448a191f95c86b2eada24cd79628ec5ed3ebcd2a37eaf5a4fb837cfed679ef9452a5344

Score

10^/10

trickbot banker packer trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral1/memory/1256-56-0x0000000000260000-0x0000000000297000-memory.dmp	templ_dll

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1900 wrote to memory of 1256	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1256	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1256	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1256	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1256	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1256	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1256	1900	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0374bb627e51aa5fa5df0640a5468939cf190a1a1bc0c8a0f3df4bc9b3e92171.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0374bb627e51aa5fa5df0640a5468939cf190a1a1bc0c8a0f3df4bc9b3e92171.dll,#1
2⤵
PID:1256

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x0000000000000000-mapping.dmp

Download
memory/1256-55-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download
memory/1256-56-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/1256-57-0x0000000000330000-0x0000000000373000-memory.dmp

Filesize
268KB

Download