trickbot | d9036fd8f7478eb84034060a374d688bb8473958975534abe01fdfe0e60c5358

Analysis

max time kernel
137s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b289078a00145a1658abb21d58f97773.dll
Size 512KB
Sample231220-plergacfb5
SHA256 d9036fd8f7478eb84034060a374d688bb8473958975534abe01fdfe0e60c5358
MD5 b289078a00145a1658abb21d58f97773
SHA1 3f5550505384e719aee87e77a284c1769120e2c4
SHA512 3f3a633f221125b1019d70f72fece2a434fc87072244514c56ce098e19cddf33e536911099ac3b9f4d015cad9d0d1ab48f1723dc87e030369af693090a3b3d04
SSDEEP 6144:b3oOkxQXFDzaLtFD2aD3YAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM1S7qFp12iwPqvDr2VI9bZa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickbot fat1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

fat1

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	wermgr.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2556	2240	rundll32.exe	14
PID 2240 wrote to memory of 2556	2240	rundll32.exe	14
PID 2240 wrote to memory of 2556	2240	rundll32.exe	14
PID 2240 wrote to memory of 2556	2240	rundll32.exe	14
PID 2240 wrote to memory of 2556	2240	rundll32.exe	14
PID 2240 wrote to memory of 2556	2240	rundll32.exe	14
PID 2240 wrote to memory of 2556	2240	rundll32.exe	14
PID 2556 wrote to memory of 2376	2556	rundll32.exe	19
PID 2556 wrote to memory of 2376	2556	rundll32.exe	19
PID 2556 wrote to memory of 2376	2556	rundll32.exe	19
PID 2556 wrote to memory of 2376	2556	rundll32.exe	19
PID 2556 wrote to memory of 1324	2556	rundll32.exe	20
PID 2556 wrote to memory of 1324	2556	rundll32.exe	20
PID 2556 wrote to memory of 1324	2556	rundll32.exe	20
PID 2556 wrote to memory of 1324	2556	rundll32.exe	20
PID 2556 wrote to memory of 1324	2556	rundll32.exe	20
PID 2556 wrote to memory of 1324	2556	rundll32.exe	20

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b289078a00145a1658abb21d58f97773.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2376
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1324

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b289078a00145a1658abb21d58f97773.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-16-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

Download

memory/1324-20-0x0000000000060000-0x0000000000089000-memory.dmp

Download

memory/1324-17-0x0000000000060000-0x0000000000089000-memory.dmp

Download

memory/2556-13-0x00000000004D0000-0x0000000000514000-memory.dmp

Download

memory/2556-6-0x0000000000190000-0x00000000001C9000-memory.dmp

Download

memory/2556-15-0x0000000000210000-0x0000000000213000-memory.dmp

Download

memory/2556-14-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/2556-2-0x0000000000270000-0x00000000002AB000-memory.dmp

Download

memory/2556-0-0x0000000000190000-0x00000000001C9000-memory.dmp

Download

memory/2556-7-0x0000000000320000-0x0000000000359000-memory.dmp

Download

memory/2556-18-0x00000000004D0000-0x0000000000514000-memory.dmp

Download

memory/2556-19-0x0000000000210000-0x0000000000213000-memory.dmp

Download

memory/2556-10-0x0000000000490000-0x00000000004C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads