trickbot | 229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c

General

Target

229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe
Size

853KB
MD5

50bd5097a5a731f033d62c64cd732f30
SHA1

d0d761b5a1745838c558ee17c547eb3fdfd25f71
SHA256

229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c
SHA512

8fdca77c73b45dc912d9d89a7c927be8af2b8e86530da8be062f0c3cde07369f60d4cc92041fe99fed0e475e5ab53b3de0d4d061ed9f4c832acca2fcc1b2df32

Score

10^/10

trickbot trgt98888 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000479

Botnet

trgt98888

C2

192.3.104.46:443

23.94.233.210:443

172.82.152.126:443

192.3.247.11:443

202.29.215.114:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/672-62-0x0000000000240000-0x000000000026C000-memory.dmp	trickbot_loader32
behavioral1/memory/1300-67-0x00000000003D0000-0x00000000003FD000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

있서래처길모고른든.exe있서래처길모고른든.exe

pid process

672 있서래처길모고른든.exe
1300 있서래처길모고른든.exe

pid	process
672	있서래처길모고른든.exe
1300	있서래처길모고른든.exe

Loads dropped DLL 2 IoCs

Processes:

229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe

pid	process
1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe
1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 1456 svchost.exe

description	pid	process
Token: SeTcbPrivilege	1456	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe있서래처길모고른든.exe있서래처길모고른든.exe

pid	process
1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe
1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe
672	있서래처길모고른든.exe
672	있서래처길모고른든.exe
1300	있서래처길모고른든.exe
1300	있서래처길모고른든.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe있서래처길모고른든.exetaskeng.exe있서래처길모고른든.exe

description	pid	process	target process
PID 1220 wrote to memory of 672	1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe	있서래처길모고른든.exe
PID 1220 wrote to memory of 672	1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe	있서래처길모고른든.exe
PID 1220 wrote to memory of 672	1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe	있서래처길모고른든.exe
PID 1220 wrote to memory of 672	1220	229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe	있서래처길모고른든.exe
PID 672 wrote to memory of 1676	672	있서래처길모고른든.exe	svchost.exe
PID 672 wrote to memory of 1676	672	있서래처길모고른든.exe	svchost.exe
PID 672 wrote to memory of 1676	672	있서래처길모고른든.exe	svchost.exe
PID 672 wrote to memory of 1676	672	있서래처길모고른든.exe	svchost.exe
PID 672 wrote to memory of 1676	672	있서래처길모고른든.exe	svchost.exe
PID 672 wrote to memory of 1676	672	있서래처길모고른든.exe	svchost.exe
PID 1852 wrote to memory of 1300	1852	taskeng.exe	있서래처길모고른든.exe
PID 1852 wrote to memory of 1300	1852	taskeng.exe	있서래처길모고른든.exe
PID 1852 wrote to memory of 1300	1852	taskeng.exe	있서래처길모고른든.exe
PID 1852 wrote to memory of 1300	1852	taskeng.exe	있서래처길모고른든.exe
PID 1300 wrote to memory of 1456	1300	있서래처길모고른든.exe	svchost.exe
PID 1300 wrote to memory of 1456	1300	있서래처길모고른든.exe	svchost.exe
PID 1300 wrote to memory of 1456	1300	있서래처길모고른든.exe	svchost.exe
PID 1300 wrote to memory of 1456	1300	있서래처길모고른든.exe	svchost.exe
PID 1300 wrote to memory of 1456	1300	있서래처길모고른든.exe	svchost.exe
PID 1300 wrote to memory of 1456	1300	있서래처길모고른든.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe
"C:\Users\Admin\AppData\Local\Temp\229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220

C:\ProgramData\있서래처길모고른든.exe
"C:\ProgramData\있서래처길모고른든.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1676

C:\Windows\system32\taskeng.exe
taskeng.exe {A452831D-7EB6-4F55-84B7-8783455FE07A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\있서래처길모고른든.exe
MD5
50bd5097a5a731f033d62c64cd732f30

SHA1
d0d761b5a1745838c558ee17c547eb3fdfd25f71

SHA256
229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c

SHA512
8fdca77c73b45dc912d9d89a7c927be8af2b8e86530da8be062f0c3cde07369f60d4cc92041fe99fed0e475e5ab53b3de0d4d061ed9f4c832acca2fcc1b2df32

Download Submit
C:\ProgramData\있서래처길모고른든.exe
MD5
50bd5097a5a731f033d62c64cd732f30

SHA1
d0d761b5a1745838c558ee17c547eb3fdfd25f71

SHA256
229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c

SHA512
8fdca77c73b45dc912d9d89a7c927be8af2b8e86530da8be062f0c3cde07369f60d4cc92041fe99fed0e475e5ab53b3de0d4d061ed9f4c832acca2fcc1b2df32

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
MD5
50bd5097a5a731f033d62c64cd732f30

SHA1
d0d761b5a1745838c558ee17c547eb3fdfd25f71

SHA256
229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c

SHA512
8fdca77c73b45dc912d9d89a7c927be8af2b8e86530da8be062f0c3cde07369f60d4cc92041fe99fed0e475e5ab53b3de0d4d061ed9f4c832acca2fcc1b2df32

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
MD5
50bd5097a5a731f033d62c64cd732f30

SHA1
d0d761b5a1745838c558ee17c547eb3fdfd25f71

SHA256
229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c

SHA512
8fdca77c73b45dc912d9d89a7c927be8af2b8e86530da8be062f0c3cde07369f60d4cc92041fe99fed0e475e5ab53b3de0d4d061ed9f4c832acca2fcc1b2df32

Download Submit
\ProgramData\있서래처길모고른든.exe
MD5
50bd5097a5a731f033d62c64cd732f30

SHA1
d0d761b5a1745838c558ee17c547eb3fdfd25f71

SHA256
229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c

SHA512
8fdca77c73b45dc912d9d89a7c927be8af2b8e86530da8be062f0c3cde07369f60d4cc92041fe99fed0e475e5ab53b3de0d4d061ed9f4c832acca2fcc1b2df32

Download Submit
\ProgramData\있서래처길모고른든.exe
MD5
50bd5097a5a731f033d62c64cd732f30

SHA1
d0d761b5a1745838c558ee17c547eb3fdfd25f71

SHA256
229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c

SHA512
8fdca77c73b45dc912d9d89a7c927be8af2b8e86530da8be062f0c3cde07369f60d4cc92041fe99fed0e475e5ab53b3de0d4d061ed9f4c832acca2fcc1b2df32

Download Submit
memory/672-62-0x0000000000240000-0x000000000026C000-memory.dmp

Filesize
176KB

Download
memory/1220-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download
memory/1300-67-0x00000000003D0000-0x00000000003FD000-memory.dmp

Filesize
180KB

Download
memory/1456-69-0x00000000000E0000-0x00000000000FE000-memory.dmp

Filesize
120KB

Download
memory/1676-63-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads