trickbot | 03a71a3059dce6a9ffd9f93546cc0820e7c48a4989fe1a090cf8b28f118e1627

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec0645724c1b0baf759c31d7c95def89_JaffaCakes118.dll
Size

462KB
MD5

ec0645724c1b0baf759c31d7c95def89
SHA1

5df07a3dd6474f4a4ecc77d5ab140b301e53c3e0
SHA256

03a71a3059dce6a9ffd9f93546cc0820e7c48a4989fe1a090cf8b28f118e1627
SHA512

899fda62d9b5aa1f21e71a4b64c3f1194d871708c12d6e102b1b5a982f1cf6da75c38486f4d89dd98644a314c021df2f74c3ad4db33e6fc3eb59c7f95b1216d2
SSDEEP

6144:7bVPXLakbTqht5o+nKivd8Z4sPYwp4KltOzlZRMCKy6fcWWHDecHAI3C+8hkBn:db4DmavdW4svpLtmRlKMHDuIycn

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev4

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3900 wermgr.exe

description	pid	process
Token: SeDebugPrivilege	3900	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3660 wrote to memory of 4564	3660	regsvr32.exe	regsvr32.exe
PID 3660 wrote to memory of 4564	3660	regsvr32.exe	regsvr32.exe
PID 3660 wrote to memory of 4564	3660	regsvr32.exe	regsvr32.exe
PID 4564 wrote to memory of 3900	4564	regsvr32.exe	wermgr.exe
PID 4564 wrote to memory of 3900	4564	regsvr32.exe	wermgr.exe
PID 4564 wrote to memory of 3900	4564	regsvr32.exe	wermgr.exe
PID 4564 wrote to memory of 3900	4564	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec0645724c1b0baf759c31d7c95def89_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ec0645724c1b0baf759c31d7c95def89_JaffaCakes118.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4564

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4944 --field-trial-handle=3408,i,16599691418790971742,134777455365707676,262144 --variations-seed-version /prefetch:8
1⤵
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3900-4-0x000002EADEF20000-0x000002EADEF21000-memory.dmp

Filesize
4KB

Download
memory/3900-5-0x000002EADEE50000-0x000002EADEE78000-memory.dmp

Filesize
160KB

Download
memory/3900-7-0x000002EADEE50000-0x000002EADEE78000-memory.dmp

Filesize
160KB

Download
memory/4564-0-0x00000000025E0000-0x000000000283D000-memory.dmp

Filesize
2.4MB

Download
memory/4564-1-0x0000000000C80000-0x0000000000CC0000-memory.dmp

Filesize
256KB

Download
memory/4564-2-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/4564-3-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/4564-6-0x0000000000C80000-0x0000000000CC0000-memory.dmp

Filesize
256KB

Download