trickbot | 3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb

General

Target

3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe
Size

828KB
MD5

821e4ed507878cd2e1b6c7c215da9090
SHA1

0216f295e6b498dd09376e6de693b5573c17456e
SHA256

3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb
SHA512

4c836bf11da4ffd0d2fa5e1d0575e592f48ec8fbe489371a648c5b1f0e24d3168ea444af7a6a3b85567cf2d616b9219caa529a53543bbbc4ed33388928f28ce1

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 8 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/4604-132-0x0000000002D30000-0x0000000002D5B000-memory.dmp	trickbot_loader32
behavioral2/memory/4604-134-0x0000000002D30000-0x0000000002D5B000-memory.dmp	trickbot_loader32
behavioral2/memory/4604-140-0x0000000002D30000-0x0000000002D5B000-memory.dmp	trickbot_loader32
behavioral2/memory/4704-143-0x0000000002B10000-0x0000000002B3B000-memory.dmp	trickbot_loader32
behavioral2/memory/4704-144-0x0000000002B10000-0x0000000002B3B000-memory.dmp	trickbot_loader32
behavioral2/memory/4704-155-0x0000000002B10000-0x0000000002B3B000-memory.dmp	trickbot_loader32
behavioral2/memory/3948-161-0x0000000000E90000-0x0000000000EBB000-memory.dmp	trickbot_loader32
behavioral2/memory/3948-172-0x0000000000E90000-0x0000000000EBB000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

pid	process
4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

description pid process

Token: SeTcbPrivilege 3948 3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

description	pid	process
Token: SeTcbPrivilege	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

pid	process
4604	3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe
4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe

description	pid	process	target process
PID 4604 wrote to memory of 4704	4604	3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
PID 4604 wrote to memory of 4704	4604	3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
PID 4604 wrote to memory of 4704	4604	3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 4704 wrote to memory of 4456	4704	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe
PID 3948 wrote to memory of 2800	3948	3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe
"C:\Users\Admin\AppData\Local\Temp\3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604

C:\Users\Admin\AppData\Roaming\wnetwork\3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
C:\Users\Admin\AppData\Roaming\wnetwork\3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4456

C:\Users\Admin\AppData\Roaming\wnetwork\3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
C:\Users\Admin\AppData\Roaming\wnetwork\3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wnetwork\3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
Filesize
828KB

MD5
821e4ed507878cd2e1b6c7c215da9090

SHA1
0216f295e6b498dd09376e6de693b5573c17456e

SHA256
3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb

SHA512
4c836bf11da4ffd0d2fa5e1d0575e592f48ec8fbe489371a648c5b1f0e24d3168ea444af7a6a3b85567cf2d616b9219caa529a53543bbbc4ed33388928f28ce1

Download Submit
C:\Users\Admin\AppData\Roaming\wnetwork\3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
Filesize
828KB

MD5
821e4ed507878cd2e1b6c7c215da9090

SHA1
0216f295e6b498dd09376e6de693b5573c17456e

SHA256
3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb

SHA512
4c836bf11da4ffd0d2fa5e1d0575e592f48ec8fbe489371a648c5b1f0e24d3168ea444af7a6a3b85567cf2d616b9219caa529a53543bbbc4ed33388928f28ce1

Download Submit
C:\Users\Admin\AppData\Roaming\wnetwork\3d772fc9008d70de29099098e395fbc55dccdd9b9f9923509df67c0acbc530eb.exe
Filesize
828KB

MD5
821e4ed507878cd2e1b6c7c215da9090

SHA1
0216f295e6b498dd09376e6de693b5573c17456e

SHA256
3d662fc8007d60de28089087e384fbc44dccdd8b8f8923409df56c0acbc430eb

SHA512
4c836bf11da4ffd0d2fa5e1d0575e592f48ec8fbe489371a648c5b1f0e24d3168ea444af7a6a3b85567cf2d616b9219caa529a53543bbbc4ed33388928f28ce1

Download Submit
memory/2800-166-0x0000000000000000-mapping.dmp

Download
memory/3948-172-0x0000000000E90000-0x0000000000EBB000-memory.dmp

Filesize
172KB

Download
memory/3948-161-0x0000000000E90000-0x0000000000EBB000-memory.dmp

Filesize
172KB

Download
memory/4456-149-0x0000000000000000-mapping.dmp

Download
memory/4456-151-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4604-132-0x0000000002D30000-0x0000000002D5B000-memory.dmp

Filesize
172KB

Download
memory/4604-140-0x0000000002D30000-0x0000000002D5B000-memory.dmp

Filesize
172KB

Download
memory/4604-134-0x0000000002D30000-0x0000000002D5B000-memory.dmp

Filesize
172KB

Download
memory/4704-146-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4704-144-0x0000000002B10000-0x0000000002B3B000-memory.dmp

Filesize
172KB

Download
memory/4704-155-0x0000000002B10000-0x0000000002B3B000-memory.dmp

Filesize
172KB

Download
memory/4704-135-0x0000000000000000-mapping.dmp

Download
memory/4704-143-0x0000000002B10000-0x0000000002B3B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads