trickbot | d757dae933fcab45a39e03e87cc86043a53a3e41ef0f9f1a5d52e09fc7692341

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2024 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d90757aeef1f615d7d6d35e78a39dc07.dll
Size

600KB
MD5

d90757aeef1f615d7d6d35e78a39dc07
SHA1

7ca06db8cf30e52f1e1fd93ec97983898e34d4ae
SHA256

d757dae933fcab45a39e03e87cc86043a53a3e41ef0f9f1a5d52e09fc7692341
SHA512

e3da16f45816c52c31dd8ef430d0c2275125dd82c2c2fabfda8a24ea1f4a5e1332289a97e89a66b667c37a235cb423e504131fb12f0271288daf34ddaee97903
SSDEEP

12288:SubYNTW0k3QRsYgUKkFj60KBQEq4OJZ+133UsdVzkZ2QWVH47xpEwYAD:VbiY3QRmZkFj60KBQEqDk1UsdlcKVYFP

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev4

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1848 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	1848	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4480 wrote to memory of 2132	4480	regsvr32.exe	regsvr32.exe
PID 4480 wrote to memory of 2132	4480	regsvr32.exe	regsvr32.exe
PID 4480 wrote to memory of 2132	4480	regsvr32.exe	regsvr32.exe
PID 2132 wrote to memory of 1848	2132	regsvr32.exe	wermgr.exe
PID 2132 wrote to memory of 1848	2132	regsvr32.exe	wermgr.exe
PID 2132 wrote to memory of 1848	2132	regsvr32.exe	wermgr.exe
PID 2132 wrote to memory of 1848	2132	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d90757aeef1f615d7d6d35e78a39dc07.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d90757aeef1f615d7d6d35e78a39dc07.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-15-0x0000022C7D860000-0x0000022C7D888000-memory.dmp

Filesize
160KB

Download
memory/1848-20-0x0000022C7D860000-0x0000022C7D888000-memory.dmp

Filesize
160KB

Download
memory/1848-14-0x0000022C7D8F0000-0x0000022C7D8F1000-memory.dmp

Filesize
4KB

Download
memory/2132-13-0x00000000024D0000-0x00000000024D3000-memory.dmp

Filesize
12KB

Download
memory/2132-11-0x0000000002480000-0x00000000024C0000-memory.dmp

Filesize
256KB

Download
memory/2132-12-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2132-0-0x00000000022A0000-0x00000000022DB000-memory.dmp

Filesize
236KB

Download
memory/2132-8-0x0000000002430000-0x0000000002467000-memory.dmp

Filesize
220KB

Download
memory/2132-5-0x00000000023F0000-0x0000000002429000-memory.dmp

Filesize
228KB

Download
memory/2132-16-0x00000000021A0000-0x00000000021B3000-memory.dmp

Filesize
76KB

Download
memory/2132-18-0x0000000002480000-0x00000000024C0000-memory.dmp

Filesize
256KB

Download
memory/2132-19-0x00000000024D0000-0x00000000024D3000-memory.dmp

Filesize
12KB

Download
memory/2132-3-0x0000000002260000-0x0000000002298000-memory.dmp

Filesize
224KB

Download