trickbot | 7909d39f4ee6272479d320074ff54b7fd7a1df5d667ad428808d9aae72487d65

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c08f4a0dc13ee5f27c619a7dc35eef1c.dll
Size

401KB
MD5

c08f4a0dc13ee5f27c619a7dc35eef1c
SHA1

b8470829285bdc4dab274b5d5aad57f9a3b6c2ad
SHA256

7909d39f4ee6272479d320074ff54b7fd7a1df5d667ad428808d9aae72487d65
SHA512

292a8cb128eb6ad8fb971f89e5826473a48a284e619372512de04600f41ee6e1e9ca6ba292499979e1536be8f0bb3518fbbdfb08155fc225bc4ab0c8c0b6aaab
SSDEEP

6144:SYbxqY1tkUnvIRKYdZEMiXeUJqFfEGTJ210yGCZ0AlBqhmkh3brRLeeuXkHlFWk7:jxqY1tzwRKYdiMiXvqFfX2St6VmASvln

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev4

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3552 3604 WerFault.exe regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2864 wermgr.exe

pid	pid_target	process	target process
3552	3604	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	2864	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 5116 wrote to memory of 3604	5116	regsvr32.exe	regsvr32.exe
PID 5116 wrote to memory of 3604	5116	regsvr32.exe	regsvr32.exe
PID 5116 wrote to memory of 3604	5116	regsvr32.exe	regsvr32.exe
PID 3604 wrote to memory of 2864	3604	regsvr32.exe	wermgr.exe
PID 3604 wrote to memory of 2864	3604	regsvr32.exe	wermgr.exe
PID 3604 wrote to memory of 2864	3604	regsvr32.exe	wermgr.exe
PID 3604 wrote to memory of 2864	3604	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c08f4a0dc13ee5f27c619a7dc35eef1c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\c08f4a0dc13ee5f27c619a7dc35eef1c.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3604

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 648
3⤵
- Program crash
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3604 -ip 3604
1⤵
PID:4052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-5-0x000001F1F75D0000-0x000001F1F75F8000-memory.dmp

Filesize
160KB

Download
memory/2864-4-0x000001F1F76E0000-0x000001F1F76E1000-memory.dmp

Filesize
4KB

Download
memory/2864-7-0x000001F1F75D0000-0x000001F1F75F8000-memory.dmp

Filesize
160KB

Download
memory/3604-0-0x0000000000540000-0x000000000057F000-memory.dmp

Filesize
252KB

Download
memory/3604-1-0x0000000000540000-0x000000000057F000-memory.dmp

Filesize
252KB

Download
memory/3604-2-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/3604-3-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/3604-6-0x0000000000540000-0x000000000057F000-memory.dmp

Filesize
252KB

Download