trickbot | 274170f2acf032561911675964fe1852e63e5af6bf97c3a76d6273cf7b5bf1c0

General

Target

dilaryi8.exe
Size

343KB
MD5

d02406a2b62215dc5d5a42e0c8e15f6e
SHA1

7ffa70f90eb6bf01b2b7f3b2fde2fbe93ba6acc4
SHA256

274170f2acf032561911675964fe1852e63e5af6bf97c3a76d6273cf7b5bf1c0
SHA512

c6879fa99d961dc1bfc07e136d89054ca94087ca8e3fa50b12b389c983b4e46eae6243cb756947e11eb62c458f8e8b9f652a3069c5ab738575a0c2bd844658b7

Score

10^/10

trojan banker trickbot evasion

Malware Config

Extracted

Family

trickbot

Version

1000102

Botnet

mac1

C2

79.106.41.9:449

185.21.149.41:449

200.111.97.235:449

67.209.219.92:449

209.205.188.238:449

73.252.252.62:449

76.16.105.16:449

82.202.236.84:443

78.155.199.124:443

179.43.160.45:443

94.250.253.142:443

5.200.55.47:443

37.60.177.19:443

94.250.255.50:443

82.146.48.44:443

194.87.93.30:443

194.87.94.225:443

195.62.53.88:443

82.146.48.241:443

195.88.209.128:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 6 IoCs

Processes:

ejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

pid process

1776 ejmaryj8.exe
1836 ejmaryj8.exe
2040 ejmaryj8.exe
1616 ejmaryj8.exe
1392 ejmaryj8.exe
1448 ejmaryj8.exe
Loads dropped DLL 5 IoCs

Processes:

dilaryi8.exedilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

pid process

1516 dilaryi8.exe
1660 dilaryi8.exe
1776 ejmaryj8.exe
2040 ejmaryj8.exe
1392 ejmaryj8.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 myexternalip.com
5 myexternalip.com
6 checkip.amazonaws.com

pid	process
1776	ejmaryj8.exe
1836	ejmaryj8.exe
2040	ejmaryj8.exe
1616	ejmaryj8.exe
1392	ejmaryj8.exe
1448	ejmaryj8.exe

pid	process
1516	dilaryi8.exe
1660	dilaryi8.exe
1776	ejmaryj8.exe
2040	ejmaryj8.exe
1392	ejmaryj8.exe

flow	ioc
3	myexternalip.com
5	myexternalip.com
6	checkip.amazonaws.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

description	pid	process	target process
PID 1516 set thread context of 1660	1516	dilaryi8.exe	dilaryi8.exe
PID 1776 set thread context of 1836	1776	ejmaryj8.exe	ejmaryj8.exe
PID 2040 set thread context of 1616	2040	ejmaryj8.exe	ejmaryj8.exe
PID 1392 set thread context of 1448	1392	ejmaryj8.exe	ejmaryj8.exe

NSIS installer 16 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2

Modifies data under HKEY_USERS 42 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

pid process

1516 dilaryi8.exe
1776 ejmaryj8.exe
2040 ejmaryj8.exe
1392 ejmaryj8.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

svchost.exeejmaryj8.exeejmaryj8.exe

description pid process

Token: SeTakeOwnershipPrivilege 1868 svchost.exe
Token: SeTcbPrivilege 1616 ejmaryj8.exe
Token: SeTcbPrivilege 1448 ejmaryj8.exe

pid	process
1516	dilaryi8.exe
1776	ejmaryj8.exe
2040	ejmaryj8.exe
1392	ejmaryj8.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1868	svchost.exe
Token: SeTcbPrivilege	1616	ejmaryj8.exe
Token: SeTcbPrivilege	1448	ejmaryj8.exe

Suspicious use of WriteProcessMemory 1436 IoCs

Processes:

dilaryi8.exedilaryi8.exeejmaryj8.exeejmaryj8.exe

description	pid	process	target process
PID 1516 wrote to memory of 1660	1516	dilaryi8.exe	dilaryi8.exe
PID 1516 wrote to memory of 1660	1516	dilaryi8.exe	dilaryi8.exe
PID 1516 wrote to memory of 1660	1516	dilaryi8.exe	dilaryi8.exe
PID 1516 wrote to memory of 1660	1516	dilaryi8.exe	dilaryi8.exe
PID 1516 wrote to memory of 1660	1516	dilaryi8.exe	dilaryi8.exe
PID 1660 wrote to memory of 1776	1660	dilaryi8.exe	ejmaryj8.exe
PID 1660 wrote to memory of 1776	1660	dilaryi8.exe	ejmaryj8.exe
PID 1660 wrote to memory of 1776	1660	dilaryi8.exe	ejmaryj8.exe
PID 1660 wrote to memory of 1776	1660	dilaryi8.exe	ejmaryj8.exe
PID 1776 wrote to memory of 1836	1776	ejmaryj8.exe	ejmaryj8.exe
PID 1776 wrote to memory of 1836	1776	ejmaryj8.exe	ejmaryj8.exe
PID 1776 wrote to memory of 1836	1776	ejmaryj8.exe	ejmaryj8.exe
PID 1776 wrote to memory of 1836	1776	ejmaryj8.exe	ejmaryj8.exe
PID 1776 wrote to memory of 1836	1776	ejmaryj8.exe	ejmaryj8.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe
PID 1836 wrote to memory of 1868	1836	ejmaryj8.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe
"C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe
  "C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
      C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\system32\svchost.exe
        
        svchost.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868

C:\Windows\system32\taskeng.exe
taskeng.exe {120F9117-6530-4E55-869A-C494F924D00F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:468
- C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
  C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:2040
- - C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
  - - C:\Windows\system32\svchost.exe
      svchost.exe
      4⤵
      Modifies data under HKEY_USERS
      PID:840
- C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
  C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:1392
- - C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
  - - C:\Windows\system32\svchost.exe
      svchost.exe
      4⤵
      PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ZjUOw

Download Submit
C:\Users\Admin\AppData\Roaming\services\client_id

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Windows\TEMP\ZjUOw

Download Submit
\Users\Admin\AppData\Local\Temp\nsf5560.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsq7D3B.tmp\System.dll

Download Submit
\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
\Windows\Temp\nsb7AFA.tmp\System.dll

Download Submit
\Windows\Temp\nsr73F8.tmp\System.dll

Download Submit
memory/840-25-0x0000000000000000-mapping.dmp

Download
memory/1344-36-0x0000000000000000-mapping.dmp

Download
memory/1392-27-0x0000000000000000-mapping.dmp

Download
memory/1448-32-0x0000000000401B70-mapping.dmp

Download
memory/1616-21-0x0000000000401B70-mapping.dmp

Download
memory/1660-3-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1660-2-0x0000000000401B70-mapping.dmp

Download
memory/1660-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1776-5-0x0000000000000000-mapping.dmp

Download
memory/1836-11-0x0000000000401B70-mapping.dmp

Download
memory/1868-16-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/1868-15-0x0000000000000000-mapping.dmp

Download
memory/2040-17-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads