trickbot | 31f33078ee56172d1ea5994a50c488b4b4140be8519128a17f7b75ade4bee31a

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.dll
Size

1.4MB
MD5

25492a4aa466acceafbff245d285951d
SHA1

a6d3f6cc95c45e989d542c8b3e5af98b0d4092e6
SHA256

31f33078ee56172d1ea5994a50c488b4b4140be8519128a17f7b75ade4bee31a
SHA512

08602948d2a6004cf13e48ac45ab84464d390e856a5844fd1e53e61744833858a8cee1ec199d6ee8b58c106311344ceac608d31840b71aae0147ea9238b51ae2
SSDEEP

24576:eqgvGA6l5UfquF44Nc3Y/1/ChWsnVTpNEkEQ562Q7:rYGiC463G8H0b7

Score

10^/10

trickbot soc1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

soc1

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2816	1496	regsvr32.exe	84
PID 1496 wrote to memory of 2816	1496	regsvr32.exe	84
PID 1496 wrote to memory of 2816	1496	regsvr32.exe	84
PID 2816 wrote to memory of 2144	2816	regsvr32.exe	95
PID 2816 wrote to memory of 2144	2816	regsvr32.exe	95
PID 2816 wrote to memory of 2144	2816	regsvr32.exe	95
PID 2816 wrote to memory of 1416	2816	regsvr32.exe	96
PID 2816 wrote to memory of 1416	2816	regsvr32.exe	96
PID 2816 wrote to memory of 1416	2816	regsvr32.exe	96
PID 2816 wrote to memory of 1416	2816	regsvr32.exe	96

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2144
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-137-0x00000242A6320000-0x00000242A6321000-memory.dmp

Filesize
4KB

Download
memory/1416-138-0x00000242A61C0000-0x00000242A61E8000-memory.dmp

Filesize
160KB

Download
memory/2816-133-0x0000000000990000-0x00000000009C7000-memory.dmp

Filesize
220KB

Download
memory/2816-134-0x0000000000D20000-0x0000000000D64000-memory.dmp

Filesize
272KB

Download
memory/2816-135-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/2816-136-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2816-139-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download