trickbot | b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc

Analysis

max time kernel
197s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:51

Target

b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc.dll
Size

205KB
MD5

57e457058c8d921f5a6331b604ed53d2
SHA1

87fbe909120fb3cdaa8f7156d0eb13daaf398c18
SHA256

b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc
SHA512

6e7de1eeaef54b7ec0117d8420d55ecc0a36ebb28f6ed598d1e265610e7f2e600d5c9688c2a048f41498368c3c09ffc5cf7bf36989f96270fa6367eb4377feba
SSDEEP

6144:r5VztJgfZzCBQM/+DLLidZtJfNkeZ74mE:r3zrQzCBQbPLu9fN4Z

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4004 wrote to memory of 3452	4004	regsvr32.exe	regsvr32.exe
PID 4004 wrote to memory of 3452	4004	regsvr32.exe	regsvr32.exe
PID 4004 wrote to memory of 3452	4004	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\b43be2c8aebd65260f61868afdcbc54c63006302fe3e364c94e3c0b105b459dc.dll
2⤵
PID:3452

memory/3452-132-0x0000000000000000-mapping.dmp

Download
memory/3452-133-0x0000000002BC0000-0x0000000002C03000-memory.dmp

Filesize
268KB

Download