trickbot | 14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

General

Target

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
Size

838KB
MD5

c73b681fd96c7b0d8161db0ec6f821a3
SHA1

f29151ef218a47c57dabfa7adc8be3879fd1f9c9
SHA256

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236
SHA512

b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Score

10^/10

trickbot trgt98888 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000479

Botnet

trgt98888

C2

192.3.104.46:443

23.94.233.210:443

172.82.152.126:443

192.3.247.11:443

202.29.215.114:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/408-133-0x00000000021E0000-0x000000000220D000-memory.dmp	trickbot_loader32
behavioral2/memory/408-135-0x00000000021B0000-0x00000000021DC000-memory.dmp	trickbot_loader32
behavioral2/memory/408-136-0x00000000021E1000-0x000000000220C000-memory.dmp	trickbot_loader32
behavioral2/memory/408-138-0x00000000021E1000-0x000000000220C000-memory.dmp	trickbot_loader32
behavioral2/memory/4448-145-0x0000000000DF1000-0x0000000000E1C000-memory.dmp	trickbot_loader32
behavioral2/memory/4448-147-0x0000000000DF1000-0x0000000000E1C000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

있서래처길모고른든.exe있서래처길모고른든.exe

pid process

408 있서래처길모고른든.exe
4448 있서래처길모고른든.exe

pid	process
408	있서래처길모고른든.exe
4448	있서래처길모고른든.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 4420 svchost.exe

description	pid	process
Token: SeTcbPrivilege	4420	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe있서래처길모고른든.exe있서래처길모고른든.exe

pid	process
2584	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
2584	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
408	있서래처길모고른든.exe
408	있서래처길모고른든.exe
4448	있서래처길모고른든.exe
4448	있서래처길모고른든.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe있서래처길모고른든.exe있서래처길모고른든.exe

description	pid	process	target process
PID 2584 wrote to memory of 408	2584	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe	있서래처길모고른든.exe
PID 2584 wrote to memory of 408	2584	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe	있서래처길모고른든.exe
PID 2584 wrote to memory of 408	2584	14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe	있서래처길모고른든.exe
PID 408 wrote to memory of 4816	408	있서래처길모고른든.exe	svchost.exe
PID 408 wrote to memory of 4816	408	있서래처길모고른든.exe	svchost.exe
PID 408 wrote to memory of 4816	408	있서래처길모고른든.exe	svchost.exe
PID 408 wrote to memory of 4816	408	있서래처길모고른든.exe	svchost.exe
PID 4448 wrote to memory of 4420	4448	있서래처길모고른든.exe	svchost.exe
PID 4448 wrote to memory of 4420	4448	있서래처길모고른든.exe	svchost.exe
PID 4448 wrote to memory of 4420	4448	있서래처길모고른든.exe	svchost.exe
PID 4448 wrote to memory of 4420	4448	있서래처길모고른든.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe
"C:\Users\Admin\AppData\Local\Temp\14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584

C:\ProgramData\있서래처길모고른든.exe
"C:\ProgramData\있서래처길모고른든.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4816

C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
C:\ProgramData\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\있서래처길모고른든.exe
Filesize
838KB

MD5
c73b681fd96c7b0d8161db0ec6f821a3

SHA1
f29151ef218a47c57dabfa7adc8be3879fd1f9c9

SHA256
14bf422be503835fe71f78ed9305e5ff47a58158533e6913e6998364bed95236

SHA512
b1736aaa38ca59aa17a443e5b180bf1e758d18b37798e54e116e45fc6a6fd86d3575548b4288d4381f1a8606a7909b44e1581f0aacf5e81c684cf98fb38139b4

Download Submit
memory/408-133-0x00000000021E0000-0x000000000220D000-memory.dmp

Filesize
180KB

Download
memory/408-135-0x00000000021B0000-0x00000000021DC000-memory.dmp

Filesize
176KB

Download
memory/408-136-0x00000000021E1000-0x000000000220C000-memory.dmp

Filesize
172KB

Download
memory/408-138-0x00000000021E1000-0x000000000220C000-memory.dmp

Filesize
172KB

Download
memory/408-130-0x0000000000000000-mapping.dmp

Download
memory/4420-148-0x000001E0FE1D0000-0x000001E0FE1EE000-memory.dmp

Filesize
120KB

Download
memory/4420-146-0x0000000000000000-mapping.dmp

Download
memory/4448-145-0x0000000000DF1000-0x0000000000E1C000-memory.dmp

Filesize
172KB

Download
memory/4448-147-0x0000000000DF1000-0x0000000000E1C000-memory.dmp

Filesize
172KB

Download
memory/4816-140-0x00000287DD180000-0x00000287DD19E000-memory.dmp

Filesize
120KB

Download
memory/4816-139-0x00000287DD180000-0x00000287DD19E000-memory.dmp

Filesize
120KB

Download
memory/4816-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads