trickbot | ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

Analysis

max time kernel
114s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
Size

728KB
MD5

ffef98580ded08a36ffac93f8686d997
SHA1

d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468
SHA256

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b
SHA512

4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Score

10^/10

trickbot lib641 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000493

Botnet

lib641

195.123.220.178:443

198.23.209.201:443

188.165.62.34:443

164.68.120.60:443

146.185.253.191:443

185.213.20.246:443

45.137.151.198:443

185.141.27.190:443

51.89.115.124:443

188.120.254.68:443

78.24.223.88:443

185.177.59.163:443

5.182.210.109:443

5.2.70.145:443

172.82.152.11:443

190.214.13.2:449

181.140.173.186:449

181.129.104.139:449

181.113.28.146:449

181.112.157.42:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 5 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1960-61-0x00000000003C0000-0x00000000003EE000-memory.dmp	trickbot_loader32
behavioral1/memory/1960-72-0x0000000000390000-0x00000000003BD000-memory.dmp	trickbot_loader32
behavioral1/memory/1960-73-0x00000000003C1000-0x00000000003ED000-memory.dmp	trickbot_loader32
behavioral1/memory/1220-74-0x00000000003A1000-0x00000000003CD000-memory.dmp	trickbot_loader32
behavioral1/memory/1696-84-0x0000000000651000-0x000000000067D000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

ñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exe

pid process

1960 ñâà÷ìñïàåíÂÿ÷.exe
1220 ñâà÷ìñïàåíÂÿ÷.exe
1696 ñâà÷ìñïàåíÂÿ÷.exe

pid	process
1960	ñâà÷ìñïàåíÂÿ÷.exe
1220	ñâà÷ìñïàåíÂÿ÷.exe
1696	ñâà÷ìñïàåíÂÿ÷.exe

Loads dropped DLL 4 IoCs

Processes:

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exeñâà÷ìñïàåíÂÿ÷.exe

pid	process
2008	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
2008	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
1960	ñâà÷ìñïàåíÂÿ÷.exe
1960	ñâà÷ìñïàåíÂÿ÷.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ñâà÷ìñïàåíÂÿ÷.exe

description pid process

Token: SeTcbPrivilege 1696 ñâà÷ìñïàåíÂÿ÷.exe

description	pid	process
Token: SeTcbPrivilege	1696	ñâà÷ìñïàåíÂÿ÷.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exe

pid	process
2008	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
1960	ñâà÷ìñïàåíÂÿ÷.exe
1220	ñâà÷ìñïàåíÂÿ÷.exe
1696	ñâà÷ìñïàåíÂÿ÷.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exetaskeng.exeñâà÷ìñïàåíÂÿ÷.exe

description	pid	process	target process
PID 2008 wrote to memory of 1960	2008	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 2008 wrote to memory of 1960	2008	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 2008 wrote to memory of 1960	2008	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 2008 wrote to memory of 1960	2008	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 1960 wrote to memory of 1220	1960	ñâà÷ìñïàåíÂÿ÷.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 1960 wrote to memory of 1220	1960	ñâà÷ìñïàåíÂÿ÷.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 1960 wrote to memory of 1220	1960	ñâà÷ìñïàåíÂÿ÷.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 1960 wrote to memory of 1220	1960	ñâà÷ìñïàåíÂÿ÷.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 1220 wrote to memory of 1368	1220	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1220 wrote to memory of 1368	1220	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1220 wrote to memory of 1368	1220	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1220 wrote to memory of 1368	1220	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1220 wrote to memory of 1368	1220	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1220 wrote to memory of 1368	1220	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 268 wrote to memory of 1696	268	taskeng.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 268 wrote to memory of 1696	268	taskeng.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 268 wrote to memory of 1696	268	taskeng.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 268 wrote to memory of 1696	268	taskeng.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 1696 wrote to memory of 1180	1696	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1696 wrote to memory of 1180	1696	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1696 wrote to memory of 1180	1696	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1696 wrote to memory of 1180	1696	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1696 wrote to memory of 1180	1696	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 1696 wrote to memory of 1180	1696	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
"C:\Users\Admin\AppData\Local\Temp\ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
"C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:1368

C:\Windows\system32\taskeng.exe
taskeng.exe {23EAB5F6-D9E7-487B-B57C-24C80C67B4CF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1180

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
memory/1180-87-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1180-86-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1180-83-0x0000000000000000-mapping.dmp

Download
memory/1220-65-0x0000000000000000-mapping.dmp

Download
memory/1220-74-0x00000000003A1000-0x00000000003CD000-memory.dmp

Filesize
176KB

Download
memory/1220-75-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/1368-77-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1368-76-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1368-71-0x0000000000000000-mapping.dmp

Download
memory/1696-78-0x0000000000000000-mapping.dmp

Download
memory/1696-85-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/1696-84-0x0000000000651000-0x000000000067D000-memory.dmp

Filesize
176KB

Download
memory/1960-73-0x00000000003C1000-0x00000000003ED000-memory.dmp

Filesize
176KB

Download
memory/1960-72-0x0000000000390000-0x00000000003BD000-memory.dmp

Filesize
180KB

Download
memory/1960-61-0x00000000003C0000-0x00000000003EE000-memory.dmp

Filesize
184KB

Download
memory/1960-57-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads