trickbot | d9036fd8f7478eb84034060a374d688bb8473958975534abe01fdfe0e60c5358

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b289078a00145a1658abb21d58f97773.dll
Size 512KB
Sample231220-plergacfb5
SHA256 d9036fd8f7478eb84034060a374d688bb8473958975534abe01fdfe0e60c5358
MD5 b289078a00145a1658abb21d58f97773
SHA1 3f5550505384e719aee87e77a284c1769120e2c4
SHA512 3f3a633f221125b1019d70f72fece2a434fc87072244514c56ce098e19cddf33e536911099ac3b9f4d015cad9d0d1ab48f1723dc87e030369af693090a3b3d04
SSDEEP 6144:b3oOkxQXFDzaLtFD2aD3YAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM1S7qFp12iwPqvDr2VI9bZa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickbot fat1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

fat1

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	wermgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 4824	2096	rundll32.exe	86
PID 2096 wrote to memory of 4824	2096	rundll32.exe	86
PID 2096 wrote to memory of 4824	2096	rundll32.exe	86
PID 4824 wrote to memory of 1504	4824	rundll32.exe	89
PID 4824 wrote to memory of 1504	4824	rundll32.exe	89
PID 4824 wrote to memory of 1504	4824	rundll32.exe	89
PID 4824 wrote to memory of 3404	4824	rundll32.exe	90
PID 4824 wrote to memory of 3404	4824	rundll32.exe	90
PID 4824 wrote to memory of 3404	4824	rundll32.exe	90
PID 4824 wrote to memory of 3404	4824	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b289078a00145a1658abb21d58f97773.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b289078a00145a1658abb21d58f97773.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1504
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-14-0x000002CD80CD0000-0x000002CD80CF9000-memory.dmp

Download

memory/3404-15-0x000002CD80E30000-0x000002CD80E31000-memory.dmp

Download

memory/3404-20-0x000002CD80CD0000-0x000002CD80CF9000-memory.dmp

Download

memory/4824-0-0x0000000002070000-0x00000000020AB000-memory.dmp

Download

memory/4824-3-0x0000000002030000-0x0000000002069000-memory.dmp

Download

memory/4824-5-0x00000000020B0000-0x00000000020E9000-memory.dmp

Download

memory/4824-8-0x0000000002240000-0x0000000002278000-memory.dmp

Download

memory/4824-11-0x0000000002280000-0x00000000022C4000-memory.dmp

Download

memory/4824-12-0x00000000022D0000-0x00000000022D1000-memory.dmp

Download

memory/4824-13-0x0000000002100000-0x0000000002103000-memory.dmp

Download

memory/4824-16-0x0000000000A40000-0x0000000000A51000-memory.dmp

Download

memory/4824-17-0x0000000002280000-0x00000000022C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads