trickbot | 2587e94f3bc1ae54ff7732984925def76de934b3e1b1f7407bd66491db18f7e0

Analysis

max time kernel
177s
max time network
181s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2587e94f3bc1ae54ff7732984925def76de934b3e1b1f7407bd66491db18f7e0.dll
Size

308KB
MD5

582671a5b5f2170a49333296aa81b84b
SHA1

5e35f891922b5d724a4b6f37eb9609ea47e00fc5
SHA256

2587e94f3bc1ae54ff7732984925def76de934b3e1b1f7407bd66491db18f7e0
SHA512

3ea32e3a86b920610b2d9c9fbb97462dbbb8bfbcf20a5a724e2d907a1e6ee1858e2b7b9f8facd3015918e51eedb5cac170c3306eb07548d452fc19002b8db406
SSDEEP

6144:N5ac4RVUnKmLYjTC8aiCZsZbgi07Iml9vl2J8HjnX9jf:N5h3nKm0jTC8afsZbJ0Im3vEJ8DnNjf

Score

10^/10

trickbot rob91 banker packer trojan

Malware Config

Extracted

Family

trickbot

Version

2000030

Botnet

rob91

196.43.106.38:443

186.97.172.178:443

37.228.70.134:443

144.48.139.206:443

190.110.179.139:443

172.105.15.152:443

177.67.137.111:443

27.72.107.215:443

186.66.15.10:443

189.206.78.155:443

202.131.227.229:443

185.9.187.10:443

196.41.57.46:443

212.200.25.118:443

197.254.14.238:443

45.229.71.211:443

181.167.217.53:443

181.129.116.58:443

185.189.55.207:443

172.104.241.29:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 1 IoCs

Detects Templ.dll packer which usually loads Trickbot.

packer

Processes:

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000130000-0x0000000000167000-memory.dmp	templ_dll

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 2548 WerFault.exe regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 2556 wermgr.exe

pid	pid_target	process	target process
2792	2548	WerFault.exe	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	2556	wermgr.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2992 wrote to memory of 2548	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2548	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2548	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2548	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2548	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2548	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2548	2992	regsvr32.exe	regsvr32.exe
PID 2548 wrote to memory of 2556	2548	regsvr32.exe	wermgr.exe
PID 2548 wrote to memory of 2556	2548	regsvr32.exe	wermgr.exe
PID 2548 wrote to memory of 2556	2548	regsvr32.exe	wermgr.exe
PID 2548 wrote to memory of 2556	2548	regsvr32.exe	wermgr.exe
PID 2548 wrote to memory of 2556	2548	regsvr32.exe	wermgr.exe
PID 2548 wrote to memory of 2556	2548	regsvr32.exe	wermgr.exe
PID 2548 wrote to memory of 2792	2548	regsvr32.exe	WerFault.exe
PID 2548 wrote to memory of 2792	2548	regsvr32.exe	WerFault.exe
PID 2548 wrote to memory of 2792	2548	regsvr32.exe	WerFault.exe
PID 2548 wrote to memory of 2792	2548	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2587e94f3bc1ae54ff7732984925def76de934b3e1b1f7407bd66491db18f7e0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2587e94f3bc1ae54ff7732984925def76de934b3e1b1f7407bd66491db18f7e0.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 324
3⤵
- Program crash
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000000130000-0x0000000000167000-memory.dmp

Filesize
220KB

Download
memory/2548-5-0x0000000000180000-0x00000000001C3000-memory.dmp

Filesize
268KB

Download
memory/2548-6-0x0000000000180000-0x00000000001C3000-memory.dmp

Filesize
268KB

Download
memory/2548-7-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2548-10-0x0000000000180000-0x00000000001C3000-memory.dmp

Filesize
268KB

Download
memory/2548-11-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2556-8-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2556-9-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/2556-12-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download