trickbot | 81fa8a3bdc452dd2b279b61fed92fe83d65e650e06bca9ee4dfcf991a4a59e77

Resubmissions

13-07-2024 07:10

240713-hzkfjs1cpp 10

24-08-2023 07:08

230824-hx7hascc4z 10

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2023 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3.exe
Size

432KB
MD5

7773c8164949a42936c4d1374cf16284
SHA1

9e92535dc7bcdd7bf677a643f90ee730784edfc6
SHA256

81fa8a3bdc452dd2b279b61fed92fe83d65e650e06bca9ee4dfcf991a4a59e77
SHA512

8569116004d7b7154fced5a1a6f9d6ed111cae4cf71a68942fc0b978f5fb42db5b595c059fa77bd787cb923c99894dfc07accbc201c38caa02e3f2a235a9d61c
SSDEEP

6144:K7SsTkhdodKqFnpNB0ZBPpYbDhk2N+mBN0fmWbli/eQ8CAFCKz62bxMP7RTitG:WmhdSHZoY/y2MM0fm6lfQIR62lM9iA

Score

10^/10

trickbot yas45 banker dave trojan

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

yas45

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

resource	yara_rule
behavioral2/memory/4028-0-0x0000000002990000-0x00000000029C7000-memory.dmp	dave
behavioral2/memory/4028-1-0x0000000002320000-0x0000000002354000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4028	3.exe
4028	3.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	wermgr.exe
Token: SeDebugPrivilege	4048	wermgr.exe
Token: SeDebugPrivilege	4048	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4028	3.exe
4028	3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4048	4028	3.exe	91
PID 4028 wrote to memory of 4048	4028	3.exe	91
PID 4028 wrote to memory of 4048	4028	3.exe	91
PID 4028 wrote to memory of 4048	4028	3.exe	91

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-41-0x0000000002890000-0x0000000002981000-memory.dmp

Filesize
964KB

Download
memory/4028-161-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/4028-5-0x0000000002B10000-0x0000000002B43000-memory.dmp

Filesize
204KB

Download
memory/4028-6-0x0000000002AD0000-0x0000000002B03000-memory.dmp

Filesize
204KB

Download
memory/4028-7-0x0000000002B10000-0x0000000002B43000-memory.dmp

Filesize
204KB

Download
memory/4028-40-0x0000000000750000-0x0000000000758000-memory.dmp

Filesize
32KB

Download
memory/4028-1-0x0000000002320000-0x0000000002354000-memory.dmp

Filesize
208KB

Download
memory/4028-42-0x0000000002B10000-0x0000000002B43000-memory.dmp

Filesize
204KB

Download
memory/4028-0-0x0000000002990000-0x00000000029C7000-memory.dmp

Filesize
220KB

Download
memory/4028-162-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/4028-172-0x0000000002B10000-0x0000000002B43000-memory.dmp

Filesize
204KB

Download
memory/4028-166-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/4048-167-0x000001243FCE0000-0x000001243FD04000-memory.dmp

Filesize
144KB

Download
memory/4048-163-0x000001243FCE0000-0x000001243FD04000-memory.dmp

Filesize
144KB

Download
memory/4048-173-0x000001243FCE0000-0x000001243FD04000-memory.dmp

Filesize
144KB

Download