trickbot | 7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79.exe
Size

448KB
MD5

9dafee1dd1d847462a98b598d1d11064
SHA1

f9c75ca6993a1ea2ad05812aa7ea41aebbedc358
SHA256

7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79
SHA512

3b550198e88b7b009747571088d73d0b26f7d83390c8cec2ddf027b7e81fc5a55ac6591c179d18433cf33a7cbec2244cc69cb8c7a5e4c4c5ac6079f5e794ada1

Score

10^/10

trickbot ono38 banker dave trojan

Malware Config

Extracted

Family

trickbot

Version

1000507

Botnet

ono38

51.89.115.112:443

185.141.27.225:443

151.80.212.114:443

5.182.210.178:443

188.119.113.60:443

91.235.129.199:443

185.234.72.193:443

194.5.250.200:443

185.14.29.141:443

185.99.2.197:443

185.234.72.50:443

194.5.250.201:443

108.170.61.186:443

217.12.209.159:443

185.99.2.44:443

51.89.115.108:443

164.68.120.58:443

164.132.255.19:443

148.251.185.164:443

94.250.250.69:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
behavioral2/memory/2868-130-0x0000000002320000-0x0000000002352000-memory.dmp	dave
behavioral2/memory/2868-135-0x00000000022E0000-0x0000000002310000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79.exe

pid	process
2868	7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79.exe
2868	7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79.exe

C:\Users\Admin\AppData\Local\Temp\7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79.exe
"C:\Users\Admin\AppData\Local\Temp\7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-130-0x0000000002320000-0x0000000002352000-memory.dmp

Filesize
200KB

Download
memory/2868-134-0x00000000028F0000-0x000000000291F000-memory.dmp

Filesize
188KB

Download
memory/2868-135-0x00000000022E0000-0x0000000002310000-memory.dmp

Filesize
192KB

Download
memory/2868-136-0x00000000028C0000-0x00000000028EE000-memory.dmp

Filesize
184KB

Download
memory/2868-137-0x00000000028F1000-0x000000000291F000-memory.dmp

Filesize
184KB

Download