trickbot | 621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391

General

Target

127661.exe
Size

375KB
MD5

309c240336952e3a6afe08f91581aa76
SHA1

7cc257d1dc641c5fc312c7694a1a7be7ce31cb46
SHA256

621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391
SHA512

a7e68157c9d9e6a317fa5a898cf1b96bd884132e4634fecd495af74d5e40b72f54a85446730a0a0ac8379039146f1840229e420c5b7dd64b1eca8be0b09fb104

Score

10^/10

evasion trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000098

Botnet

mac1

C2

79.106.41.9:449

94.250.252.146:443

62.109.18.206:443

62.109.26.193:443

78.24.223.50:443

94.250.252.162:443

92.53.78.209:443

92.53.66.115:443

62.109.16.70:443

62.109.23.229:443

62.109.17.100:443

82.146.47.221:443

195.133.144.43:443

194.87.92.217:443

95.213.194.234:443

195.133.147.44:443

194.87.238.149:443

78.155.206.154:443

185.80.130.195:443

94.250.252.168:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 3 IoCs

Processes:

237772.exe237772.exe237772.exe

pid process

868 237772.exe
1948 237772.exe
1632 237772.exe
Loads dropped DLL 1 IoCs

Processes:

127661.exe

pid process

1600 127661.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ipecho.net
3 wtfismyip.com
5 ipecho.net

pid	process
868	237772.exe
1948	237772.exe
1632	237772.exe

pid	process
1600	127661.exe

flow	ioc
7	ipecho.net
3	wtfismyip.com
5	ipecho.net

Modifies data under HKEY_USERS 42 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTakeOwnershipPrivilege 1108 svchost.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1108	svchost.exe

Suspicious use of WriteProcessMemory 1431 IoCs

Processes:

127661.exe237772.exe

description	pid	process	target process
PID 1600 wrote to memory of 868	1600	127661.exe	237772.exe
PID 1600 wrote to memory of 868	1600	127661.exe	237772.exe
PID 1600 wrote to memory of 868	1600	127661.exe	237772.exe
PID 1600 wrote to memory of 868	1600	127661.exe	237772.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe
PID 868 wrote to memory of 1108	868	237772.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\127661.exe
"C:\Users\Admin\AppData\Local\Temp\127661.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Roaming\services\237772.exe
C:\Users\Admin\AppData\Roaming\services\237772.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\system32\svchost.exe
svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\system32\taskeng.exe
taskeng.exe {0C8BD2F6-A286-46CE-BE43-154C969488F8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1928

C:\Users\Admin\AppData\Roaming\services\237772.exe
C:\Users\Admin\AppData\Roaming\services\237772.exe
2⤵
- Executes dropped EXE
PID:1948

C:\Windows\system32\svchost.exe
svchost.exe
3⤵
PID:1764

C:\Users\Admin\AppData\Roaming\services\237772.exe
C:\Users\Admin\AppData\Roaming\services\237772.exe
2⤵
- Executes dropped EXE
PID:1632

C:\Windows\system32\svchost.exe
svchost.exe
3⤵
- Modifies data under HKEY_USERS
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\services\237772.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\237772.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\237772.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\client_id

Download Submit
\Users\Admin\AppData\Roaming\services\237772.exe

Download Submit
memory/868-4-0x0000000000751000-0x0000000000752000-memory.dmp

Filesize
4KB

Download
memory/868-2-0x0000000000000000-mapping.dmp

Download
memory/1108-6-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1108-5-0x0000000000000000-mapping.dmp

Download
memory/1528-15-0x0000000000000000-mapping.dmp

Download
memory/1600-0-0x00000000006A1000-0x00000000006A2000-memory.dmp

Filesize
4KB

Download
memory/1632-12-0x0000000000000000-mapping.dmp

Download
memory/1632-14-0x0000000000721000-0x0000000000722000-memory.dmp

Filesize
4KB

Download
memory/1764-10-0x0000000000000000-mapping.dmp

Download
memory/1948-9-0x0000000000751000-0x0000000000752000-memory.dmp

Filesize
4KB

Download
memory/1948-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing