trickbot | 6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397

General

Target

6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe
Size

364KB
MD5

810970fabbd2a023ce00671fe87693bd
SHA1

0ea2d177af7bba1fdc49780e2e4ed91565275a8c
SHA256

6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397
SHA512

ab555ea2aedac6f00c13ca0e800c1dad4fc91657a7c0e2093f90ed22b21672b409a74e678e442c1210dbcd193274dbcfce1461e4f67417f943b075f14dd5baf5
SSDEEP

6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANb:WBOO3VKID90TBEhx4O6ab

Score

10^/10

trickbot banker dave trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
behavioral2/memory/4328-158-0x0000000000A30000-0x0000000000A62000-memory.dmp	dave
behavioral2/memory/4328-164-0x0000000000570000-0x00000000005A0000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe

pid	process
4328	6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe
4328	6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 4832 wermgr.exe
Token: SeDebugPrivilege 4832 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	4832	wermgr.exe
Token: SeDebugPrivilege	4832	wermgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe

description	pid	process	target process
PID 4328 wrote to memory of 4832	4328	6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe	wermgr.exe
PID 4328 wrote to memory of 4832	4328	6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe	wermgr.exe
PID 4328 wrote to memory of 4832	4328	6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe	wermgr.exe
PID 4328 wrote to memory of 4832	4328	6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe
"C:\Users\Admin\AppData\Local\Temp\6344782055cd9547379dee28053fd9b2825e41258bb68f2c583fb951c5da4397.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4328-118-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-119-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-120-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-121-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-122-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-123-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-124-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-125-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-126-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-127-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-128-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-129-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-130-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-131-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-132-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-133-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-134-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-135-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-136-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-137-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-138-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-139-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-140-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-141-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-142-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-143-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-145-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-147-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-148-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-150-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-149-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-146-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-144-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-151-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-152-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-153-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-154-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-155-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-156-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-157-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-158-0x0000000000A30000-0x0000000000A62000-memory.dmp

Filesize
200KB

Download
memory/4328-162-0x00000000026C0000-0x00000000026EF000-memory.dmp

Filesize
188KB

Download
memory/4328-163-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4328-164-0x0000000000570000-0x00000000005A0000-memory.dmp

Filesize
192KB

Download
memory/4328-165-0x0000000000A70000-0x0000000000A9E000-memory.dmp

Filesize
184KB

Download
memory/4328-166-0x00000000026C1000-0x00000000026EF000-memory.dmp

Filesize
184KB

Download
memory/4328-172-0x00000000026C1000-0x00000000026EF000-memory.dmp

Filesize
184KB

Download
memory/4832-167-0x0000000000000000-mapping.dmp

Download
memory/4832-170-0x000001EA57260000-0x000001EA57284000-memory.dmp

Filesize
144KB

Download
memory/4832-171-0x000001EA57260000-0x000001EA57284000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads