trickbot | 3ae06e543ecfd267006a95fe8a8e2410e326fc877aa6bbe38b3d53ca16d4de80

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e9070da3ff85c7748c60eea6d35c0b8.dll
Size

622KB
MD5

0e9070da3ff85c7748c60eea6d35c0b8
SHA1

009d0b3231168a71412ba9a9ce9f02c193d8c4ca
SHA256

3ae06e543ecfd267006a95fe8a8e2410e326fc877aa6bbe38b3d53ca16d4de80
SHA512

da04677f4eb9bc044d151025913a4838ac01aea9ea9a2275c2d0dd565377f0bcd07b17bea1dd6087e4df4eb66332312b5ec68bbc502ba342f56f10f655d6467f
SSDEEP

12288:d6iO8Nuy1Lg6RaN70Y+yYQ3E9pGHNu4B2UdwqQEWpQ+YaeAG9PVCXwvU:TXvgS+rI4rdm2+D+BEg8

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev4

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3208	2708	WerFault.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2708	5044	regsvr32.exe	30
PID 5044 wrote to memory of 2708	5044	regsvr32.exe	30
PID 5044 wrote to memory of 2708	5044	regsvr32.exe	30
PID 2708 wrote to memory of 2600	2708	regsvr32.exe	94
PID 2708 wrote to memory of 2600	2708	regsvr32.exe	94
PID 2708 wrote to memory of 2600	2708	regsvr32.exe	94
PID 2708 wrote to memory of 2600	2708	regsvr32.exe	94

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0e9070da3ff85c7748c60eea6d35c0b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0e9070da3ff85c7748c60eea6d35c0b8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 696
    3⤵
    - Program crash
    PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2708 -ip 2708
1⤵
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-8-0x000001C6996F0000-0x000001C6996F1000-memory.dmp

Filesize
4KB

Download
memory/2600-9-0x000001C699440000-0x000001C699468000-memory.dmp

Filesize
160KB

Download
memory/2600-11-0x000001C699440000-0x000001C699468000-memory.dmp

Filesize
160KB

Download
memory/2708-0-0x0000000002860000-0x0000000002897000-memory.dmp

Filesize
220KB

Download
memory/2708-2-0x0000000002820000-0x0000000002854000-memory.dmp

Filesize
208KB

Download
memory/2708-5-0x00000000028A0000-0x00000000028E0000-memory.dmp

Filesize
256KB

Download
memory/2708-7-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2708-6-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/2708-10-0x00000000028A0000-0x00000000028E0000-memory.dmp

Filesize
256KB

Download