trickbot | 4b4b4acce5905c70900e4d63547dedee52446a94750954787f87949715a6179c

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

oniac.dll
Size

400KB
MD5

8f92810eb1bd9e432f0ac2abe254ae24
SHA1

65aa6449d5fb8ed0d71ed6ba491983b344166b2a
SHA256

e02ce2fd3f6b85b8375e889bfdbbe2684c8855260f24a46880169a629b373bc4
SHA512

9e88c3d8db082b6fb97b7cff3c5a1315fdfd2a3e20446e1a8f6f8716e20112c1081daf14f1f67666c932d740ad30e3441716efd4817b9a71e7aea44f7f4407cb
SSDEEP

12288:APsEXAr3sB2fnodijKCNETSfdok7ZSjHZzuTpH:P3sB2fnodiKk6aezkJ

Score

10^/10

trickbot ono82 banker discovery packer trojan

Malware Config

Extracted

Family

trickbot

Version

2000011

Botnet

ono82

131.153.22.145:443

62.108.35.29:443

45.89.127.118:443

185.99.2.123:443

62.108.35.36:443

45.89.127.119:443

51.77.112.255:443

194.5.249.216:443

185.99.2.160:443

80.85.156.116:443

86.104.194.102:443

37.220.6.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Trickbot family
trickbot

Templ.dll packer 4 IoCs

Detects Templ.dll packer which usually loads Trickbot.

packer

resource	yara_rule
behavioral1/memory/1792-0-0x0000000000240000-0x0000000000279000-memory.dmp	templ_dll
behavioral1/memory/1792-5-0x00000000006A0000-0x00000000006D7000-memory.dmp	templ_dll
behavioral1/memory/1792-8-0x0000000000980000-0x00000000009B6000-memory.dmp	templ_dll
behavioral1/memory/1792-4-0x0000000000200000-0x0000000000237000-memory.dmp	templ_dll

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1792	2564	regsvr32.exe	30
PID 2564 wrote to memory of 1792	2564	regsvr32.exe	30
PID 2564 wrote to memory of 1792	2564	regsvr32.exe	30
PID 2564 wrote to memory of 1792	2564	regsvr32.exe	30
PID 2564 wrote to memory of 1792	2564	regsvr32.exe	30
PID 2564 wrote to memory of 1792	2564	regsvr32.exe	30
PID 2564 wrote to memory of 1792	2564	regsvr32.exe	30
PID 1792 wrote to memory of 1592	1792	regsvr32.exe	31
PID 1792 wrote to memory of 1592	1792	regsvr32.exe	31
PID 1792 wrote to memory of 1592	1792	regsvr32.exe	31
PID 1792 wrote to memory of 1592	1792	regsvr32.exe	31
PID 1792 wrote to memory of 1592	1792	regsvr32.exe	31
PID 1792 wrote to memory of 1592	1792	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\oniac.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\oniac.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-15-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1592-14-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/1592-17-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/1792-0-0x0000000000240000-0x0000000000279000-memory.dmp

Filesize
228KB

Download
memory/1792-5-0x00000000006A0000-0x00000000006D7000-memory.dmp

Filesize
220KB

Download
memory/1792-8-0x0000000000980000-0x00000000009B6000-memory.dmp

Filesize
216KB

Download
memory/1792-4-0x0000000000200000-0x0000000000237000-memory.dmp

Filesize
220KB

Download
memory/1792-11-0x00000000009C0000-0x0000000000A01000-memory.dmp

Filesize
260KB

Download
memory/1792-12-0x00000000009C0000-0x0000000000A01000-memory.dmp

Filesize
260KB

Download
memory/1792-13-0x0000000000A10000-0x0000000000A13000-memory.dmp

Filesize
12KB

Download
memory/1792-16-0x00000000009C0000-0x0000000000A01000-memory.dmp

Filesize
260KB

Download