trickbot | ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

General

Target

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
Size

728KB
MD5

ffef98580ded08a36ffac93f8686d997
SHA1

d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468
SHA256

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b
SHA512

4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Score

10^/10

trickbot lib641 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000493

Botnet

lib641

C2

195.123.220.178:443

198.23.209.201:443

188.165.62.34:443

164.68.120.60:443

146.185.253.191:443

185.213.20.246:443

45.137.151.198:443

185.141.27.190:443

51.89.115.124:443

188.120.254.68:443

78.24.223.88:443

185.177.59.163:443

5.182.210.109:443

5.2.70.145:443

172.82.152.11:443

190.214.13.2:449

181.140.173.186:449

181.129.104.139:449

181.113.28.146:449

181.112.157.42:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/3936-133-0x00000000022C0000-0x00000000022EE000-memory.dmp	trickbot_loader32
behavioral2/memory/3936-135-0x0000000002260000-0x000000000228D000-memory.dmp	trickbot_loader32
behavioral2/memory/3936-136-0x00000000022C1000-0x00000000022ED000-memory.dmp	trickbot_loader32
behavioral2/memory/3608-144-0x00000000021D1000-0x00000000021FD000-memory.dmp	trickbot_loader32
behavioral2/memory/3936-146-0x00000000022C1000-0x00000000022ED000-memory.dmp	trickbot_loader32
behavioral2/memory/4748-151-0x0000000000A01000-0x0000000000A2D000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

ñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exe

pid process

3936 ñâà÷ìñïàåíÂÿ÷.exe
3608 ñâà÷ìñïàåíÂÿ÷.exe
4748 ñâà÷ìñïàåíÂÿ÷.exe

pid	process
3936	ñâà÷ìñïàåíÂÿ÷.exe
3608	ñâà÷ìñïàåíÂÿ÷.exe
4748	ñâà÷ìñïàåíÂÿ÷.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ñâà÷ìñïàåíÂÿ÷.exe

description pid process

Token: SeTcbPrivilege 4748 ñâà÷ìñïàåíÂÿ÷.exe

description	pid	process
Token: SeTcbPrivilege	4748	ñâà÷ìñïàåíÂÿ÷.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exe

pid	process
312	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
3936	ñâà÷ìñïàåíÂÿ÷.exe
3608	ñâà÷ìñïàåíÂÿ÷.exe
4748	ñâà÷ìñïàåíÂÿ÷.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exeñâà÷ìñïàåíÂÿ÷.exe

description	pid	process	target process
PID 312 wrote to memory of 3936	312	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 312 wrote to memory of 3936	312	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 312 wrote to memory of 3936	312	ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 3936 wrote to memory of 3608	3936	ñâà÷ìñïàåíÂÿ÷.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 3936 wrote to memory of 3608	3936	ñâà÷ìñïàåíÂÿ÷.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 3936 wrote to memory of 3608	3936	ñâà÷ìñïàåíÂÿ÷.exe	ñâà÷ìñïàåíÂÿ÷.exe
PID 3608 wrote to memory of 3148	3608	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 3608 wrote to memory of 3148	3608	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 3608 wrote to memory of 3148	3608	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 3608 wrote to memory of 3148	3608	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 4748 wrote to memory of 4864	4748	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 4748 wrote to memory of 4864	4748	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 4748 wrote to memory of 4864	4748	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe
PID 4748 wrote to memory of 4864	4748	ñâà÷ìñïàåíÂÿ÷.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe
"C:\Users\Admin\AppData\Local\Temp\ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:312

C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
"C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936

C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:3148

C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:4864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\ProgramData\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
C:\Users\Admin\AppData\Roaming\adirecttools\ñâà÷ìñïàåíÂÿ÷.exe
Filesize
728KB

MD5
ffef98580ded08a36ffac93f8686d997

SHA1
d19db2dc9a16cf8ed8a315c779fc2fbe26aa3468

SHA256
ceeb48e3c2b1e0ccc5fc6b5168797e945c5a8ecc037c147607e8b4a2b3bb426b

SHA512
4d1da965c08275f3eebf661c91038fce9e6bc190ce9ce4063a727f924782c6871beed503c68faf447d0863f6e356178fae0aa1b72af20f4044f740c8f536faee

Download Submit
memory/3148-143-0x0000017C34F20000-0x0000017C34F40000-memory.dmp

Filesize
128KB

Download
memory/3148-142-0x0000000000000000-mapping.dmp

Download
memory/3608-137-0x0000000000000000-mapping.dmp

Download
memory/3608-144-0x00000000021D1000-0x00000000021FD000-memory.dmp

Filesize
176KB

Download
memory/3608-145-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/3936-136-0x00000000022C1000-0x00000000022ED000-memory.dmp

Filesize
176KB

Download
memory/3936-130-0x0000000000000000-mapping.dmp

Download
memory/3936-135-0x0000000002260000-0x000000000228D000-memory.dmp

Filesize
180KB

Download
memory/3936-146-0x00000000022C1000-0x00000000022ED000-memory.dmp

Filesize
176KB

Download
memory/3936-133-0x00000000022C0000-0x00000000022EE000-memory.dmp

Filesize
184KB

Download
memory/4748-151-0x0000000000A01000-0x0000000000A2D000-memory.dmp

Filesize
176KB

Download
memory/4748-152-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4864-150-0x0000000000000000-mapping.dmp

Download
memory/4864-153-0x00000231FA530000-0x00000231FA550000-memory.dmp

Filesize
128KB

Download
memory/4864-154-0x00000231FA530000-0x00000231FA550000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads