trickbot | 8e2dec23a45879892bf7eab247992d212e93730b3135d98094b095412f3850c9

General

Target

sample.exe
Size

534KB
MD5

8f77e6489fa90273986d3a841bbdeb42
SHA1

312b86e00af45e187b52f2bf30b16233d882b7e8
SHA256

7e29d464e336d904d8aee54edf8b499c4095c3659a8b202218903f071239d983
SHA512

435e8da0737cf341532b4cbff6419efc2b96e70221bb58a7c191e53e7d262abea2028c33d579326c77abb9c1b4b8d4f67a94e1233c1ba9c4de71ab31d133d951

Score

10^/10

trickbot ono23 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000480

Botnet

ono23

C2

144.91.79.9:443

172.245.97.148:443

85.204.116.139:443

185.62.188.117:443

185.222.202.76:443

144.91.79.12:443

185.68.93.43:443

195.123.238.191:443

146.185.219.29:443

195.133.196.151:443

91.235.129.60:443

23.227.206.170:443

185.222.202.192:443

190.154.203.218:449

178.183.150.169:449

200.116.199.10:449

187.58.56.26:449

177.103.240.149:449

81.190.160.139:449

200.21.51.38:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1696-5-0x0000000002080000-0x00000000020AE000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

аНаоすは래별.exeаНаоすは래별.exe

pid process

1696 аНаоすは래별.exe
1240 аНаоすは래별.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 4020 svchost.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

sample.exeаНаоすは래별.exeаНаоすは래별.exe

pid process

648 sample.exe
648 sample.exe
1696 аНаоすは래별.exe
1696 аНаоすは래별.exe
1240 аНаоすは래별.exe
1240 аНаоすは래별.exe

pid	process
1696	аНаоすは래별.exe
1240	аНаоすは래별.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

description	pid	process
Token: SeTcbPrivilege	4020	svchost.exe

pid	process
648	sample.exe
648	sample.exe
1696	аНаоすは래별.exe
1696	аНаоすは래별.exe
1240	аНаоすは래별.exe
1240	аНаоすは래별.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

sample.exeаНаоすは래별.exeаНаоすは래별.exe

description	pid	process	target process
PID 648 wrote to memory of 1696	648	sample.exe	аНаоすは래별.exe
PID 648 wrote to memory of 1696	648	sample.exe	аНаоすは래별.exe
PID 648 wrote to memory of 1696	648	sample.exe	аНаоすは래별.exe
PID 1696 wrote to memory of 1332	1696	аНаоすは래별.exe	svchost.exe
PID 1696 wrote to memory of 1332	1696	аНаоすは래별.exe	svchost.exe
PID 1696 wrote to memory of 1332	1696	аНаоすは래별.exe	svchost.exe
PID 1696 wrote to memory of 1332	1696	аНаоすは래별.exe	svchost.exe
PID 1240 wrote to memory of 4020	1240	аНаоすは래별.exe	svchost.exe
PID 1240 wrote to memory of 4020	1240	аНаоすは래별.exe	svchost.exe
PID 1240 wrote to memory of 4020	1240	аНаоすは래별.exe	svchost.exe
PID 1240 wrote to memory of 4020	1240	аНаоすは래별.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648

C:\ProgramData\аНаоすは래별.exe
"C:\ProgramData\аНаоすは래별.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1332

C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\аНаоすは래별.exe
MD5
8f77e6489fa90273986d3a841bbdeb42

SHA1
312b86e00af45e187b52f2bf30b16233d882b7e8

SHA256
7e29d464e336d904d8aee54edf8b499c4095c3659a8b202218903f071239d983

SHA512
435e8da0737cf341532b4cbff6419efc2b96e70221bb58a7c191e53e7d262abea2028c33d579326c77abb9c1b4b8d4f67a94e1233c1ba9c4de71ab31d133d951

Download Submit
C:\ProgramData\аНаоすは래별.exe
MD5
8f77e6489fa90273986d3a841bbdeb42

SHA1
312b86e00af45e187b52f2bf30b16233d882b7e8

SHA256
7e29d464e336d904d8aee54edf8b499c4095c3659a8b202218903f071239d983

SHA512
435e8da0737cf341532b4cbff6419efc2b96e70221bb58a7c191e53e7d262abea2028c33d579326c77abb9c1b4b8d4f67a94e1233c1ba9c4de71ab31d133d951

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
MD5
8f77e6489fa90273986d3a841bbdeb42

SHA1
312b86e00af45e187b52f2bf30b16233d882b7e8

SHA256
7e29d464e336d904d8aee54edf8b499c4095c3659a8b202218903f071239d983

SHA512
435e8da0737cf341532b4cbff6419efc2b96e70221bb58a7c191e53e7d262abea2028c33d579326c77abb9c1b4b8d4f67a94e1233c1ba9c4de71ab31d133d951

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
MD5
8f77e6489fa90273986d3a841bbdeb42

SHA1
312b86e00af45e187b52f2bf30b16233d882b7e8

SHA256
7e29d464e336d904d8aee54edf8b499c4095c3659a8b202218903f071239d983

SHA512
435e8da0737cf341532b4cbff6419efc2b96e70221bb58a7c191e53e7d262abea2028c33d579326c77abb9c1b4b8d4f67a94e1233c1ba9c4de71ab31d133d951

Download Submit
memory/1332-6-0x0000000000000000-mapping.dmp

Download
memory/1696-2-0x0000000000000000-mapping.dmp

Download
memory/1696-5-0x0000000002080000-0x00000000020AE000-memory.dmp

Filesize
184KB

Download
memory/4020-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing