trickbot | 274170f2acf032561911675964fe1852e63e5af6bf97c3a76d6273cf7b5bf1c0

General

Target

dilaryi8.exe
Size

343KB
MD5

d02406a2b62215dc5d5a42e0c8e15f6e
SHA1

7ffa70f90eb6bf01b2b7f3b2fde2fbe93ba6acc4
SHA256

274170f2acf032561911675964fe1852e63e5af6bf97c3a76d6273cf7b5bf1c0
SHA512

c6879fa99d961dc1bfc07e136d89054ca94087ca8e3fa50b12b389c983b4e46eae6243cb756947e11eb62c458f8e8b9f652a3069c5ab738575a0c2bd844658b7

Score

10^/10

evasion trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

1000102

Botnet

mac1

C2

79.106.41.9:449

185.21.149.41:449

200.111.97.235:449

67.209.219.92:449

209.205.188.238:449

73.252.252.62:449

76.16.105.16:449

82.202.236.84:443

78.155.199.124:443

179.43.160.45:443

94.250.253.142:443

5.200.55.47:443

37.60.177.19:443

94.250.255.50:443

82.146.48.44:443

194.87.93.30:443

194.87.94.225:443

195.62.53.88:443

82.146.48.241:443

195.88.209.128:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 6 IoCs

Processes:

ejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

pid process

3932 ejmaryj8.exe
4020 ejmaryj8.exe
1916 ejmaryj8.exe
2112 ejmaryj8.exe
3900 ejmaryj8.exe
2180 ejmaryj8.exe
Loads dropped DLL 4 IoCs

Processes:

dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

pid process

3020 dilaryi8.exe
3932 ejmaryj8.exe
1916 ejmaryj8.exe
3900 ejmaryj8.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 checkip.amazonaws.com

pid	process
3932	ejmaryj8.exe
4020	ejmaryj8.exe
1916	ejmaryj8.exe
2112	ejmaryj8.exe
3900	ejmaryj8.exe
2180	ejmaryj8.exe

pid	process
3020	dilaryi8.exe
3932	ejmaryj8.exe
1916	ejmaryj8.exe
3900	ejmaryj8.exe

flow	ioc
8	checkip.amazonaws.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

description	pid	process	target process
PID 3020 set thread context of 3852	3020	dilaryi8.exe	dilaryi8.exe
PID 3932 set thread context of 4020	3932	ejmaryj8.exe	ejmaryj8.exe
PID 1916 set thread context of 2112	1916	ejmaryj8.exe	ejmaryj8.exe
PID 3900 set thread context of 2180	3900	ejmaryj8.exe	ejmaryj8.exe

NSIS installer 14 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe	nsis_installer_2

Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

dilaryi8.exeejmaryj8.exeejmaryj8.exeejmaryj8.exe

pid process

3020 dilaryi8.exe
3932 ejmaryj8.exe
1916 ejmaryj8.exe
3900 ejmaryj8.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

svchost.exeejmaryj8.exeejmaryj8.exe

description pid process

Token: SeTakeOwnershipPrivilege 2776 svchost.exe
Token: SeTcbPrivilege 2112 ejmaryj8.exe
Token: SeTcbPrivilege 2180 ejmaryj8.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

pid	process
3020	dilaryi8.exe
3932	ejmaryj8.exe
1916	ejmaryj8.exe
3900	ejmaryj8.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2776	svchost.exe
Token: SeTcbPrivilege	2112	ejmaryj8.exe
Token: SeTcbPrivilege	2180	ejmaryj8.exe

Suspicious use of WriteProcessMemory 1417 IoCs

Processes:

dilaryi8.exedilaryi8.exeejmaryj8.exeejmaryj8.exe

description	pid	process	target process
PID 3020 wrote to memory of 3852	3020	dilaryi8.exe	dilaryi8.exe
PID 3020 wrote to memory of 3852	3020	dilaryi8.exe	dilaryi8.exe
PID 3020 wrote to memory of 3852	3020	dilaryi8.exe	dilaryi8.exe
PID 3020 wrote to memory of 3852	3020	dilaryi8.exe	dilaryi8.exe
PID 3852 wrote to memory of 3932	3852	dilaryi8.exe	ejmaryj8.exe
PID 3852 wrote to memory of 3932	3852	dilaryi8.exe	ejmaryj8.exe
PID 3852 wrote to memory of 3932	3852	dilaryi8.exe	ejmaryj8.exe
PID 3932 wrote to memory of 4020	3932	ejmaryj8.exe	ejmaryj8.exe
PID 3932 wrote to memory of 4020	3932	ejmaryj8.exe	ejmaryj8.exe
PID 3932 wrote to memory of 4020	3932	ejmaryj8.exe	ejmaryj8.exe
PID 3932 wrote to memory of 4020	3932	ejmaryj8.exe	ejmaryj8.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe
PID 4020 wrote to memory of 2776	4020	ejmaryj8.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe
"C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe
"C:\Users\Admin\AppData\Local\Temp\dilaryi8.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3852

C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3932

C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\SYSTEM32\svchost.exe
svchost.exe
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1916

C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\SYSTEM32\svchost.exe
svchost.exe
3⤵
- Modifies data under HKEY_USERS
PID:2136

C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3900

C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\SYSTEM32\svchost.exe
svchost.exe
3⤵
PID:2544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ZjUOw

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Users\Admin\AppData\Roaming\services\ejmaryj8.exe

Download Submit
C:\Windows\TEMP\ZjUOw

Download Submit
\Users\Admin\AppData\Local\Temp\nsl274A.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsr154.tmp\System.dll

Download Submit
\Windows\Temp\nsa236D.tmp\System.dll

Download Submit
\Windows\Temp\nsj1D4E.tmp\System.dll

Download Submit
memory/1916-23-0x0000000000F50000-0x0000000000F8D000-memory.dmp

Filesize
244KB

Download
memory/2112-20-0x0000000000401B70-mapping.dmp

Download
memory/2136-24-0x0000000000000000-mapping.dmp

Download
memory/2180-30-0x0000000000401B70-mapping.dmp

Download
memory/2544-34-0x0000000000000000-mapping.dmp

Download
memory/2776-16-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/2776-15-0x0000000000000000-mapping.dmp

Download
memory/3020-4-0x0000000008FD0000-0x000000000900D000-memory.dmp

Filesize
244KB

Download
memory/3852-3-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3852-2-0x0000000000401B70-mapping.dmp

Download
memory/3852-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3932-5-0x0000000000000000-mapping.dmp

Download
memory/4020-11-0x0000000000401B70-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads