trickbot | 2f1a6b566dc0d2b8e5fcdcf67adc0be912f73fe14c27b262b610dfcd03cd4686

Analysis

max time kernel
137s
max time network
130s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads1/7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe
Size

441KB
MD5

ba722f76070e001e44c82998b66e9009
SHA1

98136a5f534249449b02528fc0c51be147dca4c8
SHA256

7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a
SHA512

1e805401f9166d53012a342bdbd9eba1253d9374af52440616f615d4e3aa2a9996f40398ca9c60e504e17f19029533445c3feca0900ff45339a37630932c6934

Score

10^/10

trickbot kas89 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000089

Botnet

kas89

187.188.162.150:449

83.0.245.234:449

149.154.68.252:443

62.109.11.80:443

78.24.218.150:443

92.63.97.68:443

82.146.61.187:443

80.87.199.210:443

82.146.59.149:443

188.120.247.223:443

94.250.250.112:443

149.154.71.95:443

37.230.112.76:443

94.250.250.114:443

95.213.237.223:443

185.228.232.242:443

141.255.167.126:443

5.200.47.90:443

185.158.114.126:443

185.125.46.113:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

pid process

340 7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
Loads dropped DLL 1 IoCs

Processes:

7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe

pid process

2004 7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe

pid	process
340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

pid	process
2004	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe
340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe

description	pid	process	target process
PID 2004 wrote to memory of 340	2004	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
PID 2004 wrote to memory of 340	2004	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
PID 2004 wrote to memory of 340	2004	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
PID 2004 wrote to memory of 340	2004	7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe
PID 340 wrote to memory of 1908	340	7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Downloads1\7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads1\7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:1908

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
MD5
ba722f76070e001e44c82998b66e9009

SHA1
98136a5f534249449b02528fc0c51be147dca4c8

SHA256
7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a

SHA512
1e805401f9166d53012a342bdbd9eba1253d9374af52440616f615d4e3aa2a9996f40398ca9c60e504e17f19029533445c3feca0900ff45339a37630932c6934

Download Submit
\Users\Admin\AppData\Roaming\services\7295aa4fg58736330627bd728afd8ab93eefg869ef8g685a7a325fe9823f332a.exe
MD5
ba722f76070e001e44c82998b66e9009

SHA1
98136a5f534249449b02528fc0c51be147dca4c8

SHA256
7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a

SHA512
1e805401f9166d53012a342bdbd9eba1253d9374af52440616f615d4e3aa2a9996f40398ca9c60e504e17f19029533445c3feca0900ff45339a37630932c6934

Download Submit
memory/340-6-0x0000000000000000-mapping.dmp

Download
memory/340-10-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/340-14-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1908-11-0x0000000000000000-mapping.dmp

Download
memory/1908-12-0x0000000140000000-0x0000000140021000-memory.dmp

Filesize
132KB

Download
memory/1908-15-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2004-2-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Filesize
8KB

Download
memory/2004-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2004-4-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download