trickbot | bcdac7b40846874f002e6f59413a381e4ae13bf7181eae60203c0ae69f799a57

General

Target

referenceSet.jpg.dll
Size

594KB
MD5

fbbc24f5345b11b35b8f0b68c9d30caa
SHA1

13a5fd90f3dbc9797a59cf924aa7c6bdc35cacdf
SHA256

bcdac7b40846874f002e6f59413a381e4ae13bf7181eae60203c0ae69f799a57
SHA512

6f05c0d78a7e01e8659410c513a7852709d53db36d885c3a4a32bf8e089cc7cbeab0d129cf669991c779a488ffa515ea2d0ebe49ca03e7881d36ebbc09b13faa

Score

10^/10

trickbot zev1 banker spyware stealer suricata trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev1

C2

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2608 created 1000 2608 WerFault.exe cmd.exe
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
suricata: ET MALWARE Trickbot Checkin Response
suricata: ET MALWARE Trickbot Checkin Response
suricata
suricata: ET MALWARE Win32/Trickbot Data Exfiltration
suricata: ET MALWARE Win32/Trickbot Data Exfiltration
suricata
Blocklisted process makes network request 2 IoCs

Processes:

cmd.execmd.exe

flow pid process

78 740 cmd.exe
81 2524 cmd.exe
Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2608 1000 WerFault.exe cmd.exe
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

3920 net.exe
3236 net.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

3192 ipconfig.exe

description	pid	process	target process
PID 2608 created 1000	2608	WerFault.exe	cmd.exe

flow	pid	process
78	740	cmd.exe
81	2524	cmd.exe

pid	pid_target	process	target process
2608	1000	WerFault.exe	cmd.exe

pid	process
3920	net.exe
3236	net.exe

pid	process
3192	ipconfig.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

cmd.execmd.execmd.exeWerFault.execmd.exe

pid	process
3888	cmd.exe
3888	cmd.exe
3748	cmd.exe
3748	cmd.exe
740	cmd.exe
740	cmd.exe
3748	cmd.exe
3748	cmd.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
3244	cmd.exe
3244	cmd.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

wermgr.execmd.execmd.exeWerFault.execmd.exeLogonUI.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2772	wermgr.exe
Token: SeDebugPrivilege	3888	cmd.exe
Token: SeDebugPrivilege	3748	cmd.exe
Token: SeDebugPrivilege	2608	WerFault.exe
Token: SeDebugPrivilege	3244	cmd.exe
Token: SeShutdownPrivilege	3676	LogonUI.exe
Token: SeCreatePagefilePrivilege	3676	LogonUI.exe
Token: SeShutdownPrivilege	2764	Explorer.EXE
Token: SeCreatePagefilePrivilege	2764	Explorer.EXE
Token: SeShutdownPrivilege	2764	Explorer.EXE
Token: SeCreatePagefilePrivilege	2764	Explorer.EXE
Token: SeShutdownPrivilege	2764	Explorer.EXE
Token: SeCreatePagefilePrivilege	2764	Explorer.EXE
Token: SeShutdownPrivilege	2764	Explorer.EXE
Token: SeCreatePagefilePrivilege	2764	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3676 LogonUI.exe

pid	process
3676	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeregsvr32.exewermgr.exe

description	pid	process	target process
PID 3156 wrote to memory of 592	3156	regsvr32.exe	regsvr32.exe
PID 3156 wrote to memory of 592	3156	regsvr32.exe	regsvr32.exe
PID 3156 wrote to memory of 592	3156	regsvr32.exe	regsvr32.exe
PID 592 wrote to memory of 2772	592	regsvr32.exe	wermgr.exe
PID 592 wrote to memory of 2772	592	regsvr32.exe	wermgr.exe
PID 592 wrote to memory of 2772	592	regsvr32.exe	wermgr.exe
PID 592 wrote to memory of 2772	592	regsvr32.exe	wermgr.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe
PID 2772 wrote to memory of 3888	2772	wermgr.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\referenceSet.jpg.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3156

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\referenceSet.jpg.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:740

C:\Windows\system32\cmd.exe
/c ipconfig /all
6⤵
PID:2256

C:\Windows\system32\ipconfig.exe
ipconfig /all
7⤵
- Gathers network information
PID:3192

C:\Windows\system32\cmd.exe
/c net config workstation
6⤵
PID:588

C:\Windows\system32\net.exe
net config workstation
7⤵
PID:3740

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 config workstation
8⤵
PID:1216

C:\Windows\system32\cmd.exe
/c net view /all
6⤵
PID:2196

C:\Windows\system32\net.exe
net view /all
7⤵
- Discovers systems in the same network
PID:3920

C:\Windows\system32\cmd.exe
/c net view /all /domain
6⤵
PID:2688

C:\Windows\system32\net.exe
net view /all /domain
7⤵
- Discovers systems in the same network
PID:3236

C:\Windows\system32\cmd.exe
/c nltest /domain_trusts
6⤵
PID:520

C:\Windows\system32\nltest.exe
nltest /domain_trusts
7⤵
PID:1268

C:\Windows\system32\cmd.exe
/c nltest /domain_trusts /all_trusts
6⤵
PID:3088

C:\Windows\system32\nltest.exe
nltest /domain_trusts /all_trusts
7⤵
PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
5⤵
PID:1000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1000 -s 328
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
5⤵
- Blocklisted process makes network request
PID:2524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ace855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3676

C:\Windows\System32\LockAppHost.exe
C:\Windows\System32\LockAppHost.exe -Embedding
1⤵
PID:152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-153-0x0000000000000000-mapping.dmp

Download
memory/588-146-0x0000000000000000-mapping.dmp

Download
memory/592-116-0x0000000004860000-0x0000000004897000-memory.dmp

Filesize
220KB

Download
memory/592-118-0x0000000004680000-0x000000000488E000-memory.dmp

Filesize
2.1MB

Download
memory/592-120-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/592-119-0x00000000048A0000-0x00000000048E3000-memory.dmp

Filesize
268KB

Download
memory/592-121-0x00000000048F1000-0x00000000048F3000-memory.dmp

Filesize
8KB

Download
memory/592-114-0x0000000000000000-mapping.dmp

Download
memory/740-140-0x0000000000000000-mapping.dmp

Download
memory/740-141-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/1000-157-0x0000000000000000-mapping.dmp

Download
memory/1216-148-0x0000000000000000-mapping.dmp

Download
memory/1268-154-0x0000000000000000-mapping.dmp

Download
memory/2196-149-0x0000000000000000-mapping.dmp

Download
memory/2256-144-0x0000000000000000-mapping.dmp

Download
memory/2524-163-0x0000000000000000-mapping.dmp

Download
memory/2688-151-0x0000000000000000-mapping.dmp

Download
memory/2764-173-0x0000000000170000-0x0000000000186000-memory.dmp

Filesize
88KB

Download
memory/2764-174-0x0000000000190000-0x00000000001AB000-memory.dmp

Filesize
108KB

Download
memory/2772-123-0x00000285BA310000-0x00000285BA338000-memory.dmp

Filesize
160KB

Download
memory/2772-122-0x0000000000000000-mapping.dmp

Download
memory/2772-124-0x00000285BA420000-0x00000285BA421000-memory.dmp

Filesize
4KB

Download
memory/3088-155-0x0000000000000000-mapping.dmp

Download
memory/3192-145-0x0000000000000000-mapping.dmp

Download
memory/3236-152-0x0000000000000000-mapping.dmp

Download
memory/3244-165-0x0000000000000000-mapping.dmp

Download
memory/3740-147-0x0000000000000000-mapping.dmp

Download
memory/3748-134-0x0000000000000000-mapping.dmp

Download
memory/3768-156-0x0000000000000000-mapping.dmp

Download
memory/3888-127-0x0000000000000000-mapping.dmp

Download
memory/3888-133-0x0000023E9B180000-0x0000023E9B181000-memory.dmp

Filesize
4KB

Download
memory/3920-150-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads