trickbot | f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe

General

Target

f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe
Size

849KB
MD5

08be646d95d65e8ee44bd4dc7281ad78
SHA1

7472dcb193c700180857a33144c5d635770d4978
SHA256

f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe
SHA512

c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59

Score

10^/10

trickbot trgt98888 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000479

Botnet

trgt98888

C2

192.3.104.46:443

23.94.233.210:443

172.82.152.126:443

192.3.247.11:443

202.29.215.114:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1044-117-0x0000000003BC0000-0x0000000003BED000-memory.dmp	trickbot_loader32
behavioral2/memory/1044-119-0x0000000003B90000-0x0000000003BBC000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

있서래처길모고른든.exe있서래처길모고른든.exe

pid process

1044 있서래처길모고른든.exe
3996 있서래처길모고른든.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 704 svchost.exe

pid	process
1044	있서래처길모고른든.exe
3996	있서래처길모고른든.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

description	pid	process
Token: SeTcbPrivilege	704	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe있서래처길모고른든.exe있서래처길모고른든.exe

pid	process
3704	f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe
3704	f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe
1044	있서래처길모고른든.exe
1044	있서래처길모고른든.exe
3996	있서래처길모고른든.exe
3996	있서래처길모고른든.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe있서래처길모고른든.exe있서래처길모고른든.exe

description	pid	process	target process
PID 3704 wrote to memory of 1044	3704	f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe	있서래처길모고른든.exe
PID 3704 wrote to memory of 1044	3704	f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe	있서래처길모고른든.exe
PID 3704 wrote to memory of 1044	3704	f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe	있서래처길모고른든.exe
PID 1044 wrote to memory of 1416	1044	있서래처길모고른든.exe	svchost.exe
PID 1044 wrote to memory of 1416	1044	있서래처길모고른든.exe	svchost.exe
PID 1044 wrote to memory of 1416	1044	있서래처길모고른든.exe	svchost.exe
PID 1044 wrote to memory of 1416	1044	있서래처길모고른든.exe	svchost.exe
PID 3996 wrote to memory of 704	3996	있서래처길모고른든.exe	svchost.exe
PID 3996 wrote to memory of 704	3996	있서래처길모고른든.exe	svchost.exe
PID 3996 wrote to memory of 704	3996	있서래처길모고른든.exe	svchost.exe
PID 3996 wrote to memory of 704	3996	있서래처길모고른든.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe
"C:\Users\Admin\AppData\Local\Temp\f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704

C:\ProgramData\있서래처길모고른든.exe
"C:\ProgramData\있서래처길모고른든.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1416

C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\있서래처길모고른든.exe
MD5
08be646d95d65e8ee44bd4dc7281ad78

SHA1
7472dcb193c700180857a33144c5d635770d4978

SHA256
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe

SHA512
c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59

Download Submit
C:\ProgramData\있서래처길모고른든.exe
MD5
08be646d95d65e8ee44bd4dc7281ad78

SHA1
7472dcb193c700180857a33144c5d635770d4978

SHA256
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe

SHA512
c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
MD5
08be646d95d65e8ee44bd4dc7281ad78

SHA1
7472dcb193c700180857a33144c5d635770d4978

SHA256
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe

SHA512
c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
MD5
08be646d95d65e8ee44bd4dc7281ad78

SHA1
7472dcb193c700180857a33144c5d635770d4978

SHA256
f8940af800cf409efa1603aba3941ac5648ef7218c80b6aa708159ba2be124fe

SHA512
c615c3e15195dfa458460ca2d352f4777b04f6ac77a85b6edee014162edf6434dafe7dffc58cc4d20aeab01d6405d3f31d2029f41dd3406e04c8e0d646a4cd59

Download Submit
memory/704-131-0x0000013BF6740000-0x0000013BF675E000-memory.dmp

Filesize
120KB

Download
memory/1044-117-0x0000000003BC0000-0x0000000003BED000-memory.dmp

Filesize
180KB

Download
memory/1044-119-0x0000000003B90000-0x0000000003BBC000-memory.dmp

Filesize
176KB

Download
memory/1416-122-0x0000021111480000-0x000002111149E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads