trickbot | a85a168dedec9d2f2e94fe0b5c06ecf78e5a31716c5f454db07a57b98c56aa7f

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8879f643b14459622399e07ab23f0b9_JaffaCakes118.dll
Size 462KB
Sample240418-w8mtxsbf35
SHA256 a85a168dedec9d2f2e94fe0b5c06ecf78e5a31716c5f454db07a57b98c56aa7f
MD5 f8879f643b14459622399e07ab23f0b9
SHA1 f7f9130a8e76242a296b6dd92b2711db098d9184
SHA512 8b15b5da3dd2f1f35e672c4139173c6674185e60a04ea4505fa20986d22f542d94b58494b31b18a4d9ff2b058239db1f48629b93d9bf3c32b891eebe99001c7f
SSDEEP 6144:7bVPXLakbTqht5o+nKivd8Z4sPYwp4KltOzlZRMCKy6fcWWHDecHAI3C+8hkBy:db4DmavdW4svpLtmRlKMHDuIycy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev4

14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1716	4876	regsvr32.exe	83
PID 4876 wrote to memory of 1716	4876	regsvr32.exe	83
PID 4876 wrote to memory of 1716	4876	regsvr32.exe	83
PID 1716 wrote to memory of 4472	1716	regsvr32.exe	87
PID 1716 wrote to memory of 4472	1716	regsvr32.exe	87
PID 1716 wrote to memory of 4472	1716	regsvr32.exe	87
PID 1716 wrote to memory of 4472	1716	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f8879f643b14459622399e07ab23f0b9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f8879f643b14459622399e07ab23f0b9_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-0-0x0000000002E30000-0x000000000308D000-memory.dmp

Download

memory/1716-1-0x0000000001660000-0x00000000016A0000-memory.dmp

Download

memory/1716-2-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/1716-3-0x0000000010000000-0x0000000010003000-memory.dmp

Download

memory/1716-6-0x0000000001660000-0x00000000016A0000-memory.dmp

Download

memory/4472-5-0x0000018D1F7B0000-0x0000018D1F7D8000-memory.dmp

Download

memory/4472-4-0x0000018D1FA50000-0x0000018D1FA51000-memory.dmp

Download

memory/4472-7-0x0000018D1F7B0000-0x0000018D1F7D8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads