trickbot | 14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

General

Target

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
Size

838KB
MD5

c73b681fd96c7b0d8161db0ec6f821a3
SHA1

f29151ef218a47c57dabfa7adc8be3879fd1f9c9
SHA256

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236
SHA512

b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Score

10^/10

trickbot trgt98888 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000479

Botnet

trgt98888

C2

192.3.104.46:443

23.94.233.210:443

172.82.152.126:443

192.3.247.11:443

202.29.215.114:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/968-61-0x00000000003C0000-0x00000000003ED000-memory.dmp	trickbot_loader32
behavioral1/memory/968-64-0x00000000003C1000-0x00000000003EC000-memory.dmp	trickbot_loader32
behavioral1/memory/968-63-0x0000000000250000-0x000000000027C000-memory.dmp	trickbot_loader32
behavioral1/memory/968-66-0x00000000003C1000-0x00000000003EC000-memory.dmp	trickbot_loader32
behavioral1/memory/536-75-0x00000000009A1000-0x00000000009CC000-memory.dmp	trickbot_loader32
behavioral1/memory/536-77-0x00000000009A1000-0x00000000009CC000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

있서래처길모고른든.exe있서래처길모고른든.exe

pid process

968 있서래처길모고른든.exe
536 있서래처길모고른든.exe

pid	process
968	있서래처길모고른든.exe
536	있서래처길모고른든.exe

Loads dropped DLL 2 IoCs

Processes:

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe

pid	process
780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 608 svchost.exe

description	pid	process
Token: SeTcbPrivilege	608	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe있서래처길모고른든.exe있서래처길모고른든.exe

pid	process
780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
968	있서래처길모고른든.exe
968	있서래처길모고른든.exe
536	있서래처길모고른든.exe
536	있서래처길모고른든.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe있서래처길모고른든.exetaskeng.exe있서래처길모고른든.exe

description	pid	process	target process
PID 780 wrote to memory of 968	780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe	있서래처길모고른든.exe
PID 780 wrote to memory of 968	780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe	있서래처길모고른든.exe
PID 780 wrote to memory of 968	780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe	있서래처길모고른든.exe
PID 780 wrote to memory of 968	780	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe	있서래처길모고른든.exe
PID 968 wrote to memory of 1620	968	있서래처길모고른든.exe	svchost.exe
PID 968 wrote to memory of 1620	968	있서래처길모고른든.exe	svchost.exe
PID 968 wrote to memory of 1620	968	있서래처길모고른든.exe	svchost.exe
PID 968 wrote to memory of 1620	968	있서래처길모고른든.exe	svchost.exe
PID 968 wrote to memory of 1620	968	있서래처길모고른든.exe	svchost.exe
PID 968 wrote to memory of 1620	968	있서래처길모고른든.exe	svchost.exe
PID 1364 wrote to memory of 536	1364	taskeng.exe	있서래처길모고른든.exe
PID 1364 wrote to memory of 536	1364	taskeng.exe	있서래처길모고른든.exe
PID 1364 wrote to memory of 536	1364	taskeng.exe	있서래처길모고른든.exe
PID 1364 wrote to memory of 536	1364	taskeng.exe	있서래처길모고른든.exe
PID 536 wrote to memory of 608	536	있서래처길모고른든.exe	svchost.exe
PID 536 wrote to memory of 608	536	있서래처길모고른든.exe	svchost.exe
PID 536 wrote to memory of 608	536	있서래처길모고른든.exe	svchost.exe
PID 536 wrote to memory of 608	536	있서래처길모고른든.exe	svchost.exe
PID 536 wrote to memory of 608	536	있서래처길모고른든.exe	svchost.exe
PID 536 wrote to memory of 608	536	있서래처길모고른든.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
"C:\Users\Admin\AppData\Local\Temp\14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780

C:\ProgramData\있서래처길모고른든.exe
"C:\ProgramData\있서래처길모고른든.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1620

C:\Windows\system32\taskeng.exe
taskeng.exe {048C0900-A1D7-424F-B396-87BFE90CD8F2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:608

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
C:\ProgramData\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
\ProgramData\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
\ProgramData\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
memory/536-70-0x0000000000000000-mapping.dmp

Download
memory/536-77-0x00000000009A1000-0x00000000009CC000-memory.dmp

Filesize
172KB

Download
memory/536-75-0x00000000009A1000-0x00000000009CC000-memory.dmp

Filesize
172KB

Download
memory/608-79-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/608-78-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/608-76-0x0000000000000000-mapping.dmp

Download
memory/780-54-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/968-66-0x00000000003C1000-0x00000000003EC000-memory.dmp

Filesize
172KB

Download
memory/968-57-0x0000000000000000-mapping.dmp

Download
memory/968-61-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/968-64-0x00000000003C1000-0x00000000003EC000-memory.dmp

Filesize
172KB

Download
memory/968-63-0x0000000000250000-0x000000000027C000-memory.dmp

Filesize
176KB

Download
memory/1620-68-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/1620-67-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/1620-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads