trickbot | 3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

General

Target

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
Size

428KB
MD5

54bc795028a9a3f1467d8ba8a3f1f5a2
SHA1

e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d
SHA256

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa
SHA512

35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Score

10^/10

trickbot ser0629 banker evasion trojan

Malware Config

Extracted

Family

trickbot

Version

1000219

Botnet

ser0629

C2

138.34.32.218:443

86.61.177.139:443

47.40.90.210:443

93.109.242.134:443

45.36.155.244:443

158.58.131.54:443

46.59.89.119:449

66.229.97.133:443

45.56.2.247:443

109.86.227.152:443

209.131.236.23:443

200.2.126.98:443

62.31.150.202:443

90.69.224.122:443

194.68.23.182:443

182.253.210.130:449

67.159.157.150:443

172.117.118.98:443

201.174.70.238:443

138.34.32.74:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/784-54-0x0000000010000000-0x0000000010040000-memory.dmp	trickbot_loader32
behavioral1/memory/2016-69-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral1/memory/1520-90-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

pid	process
936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Loads dropped DLL 1 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe

pid process

2016 3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

description	pid	process	target process
PID 784 set thread context of 2016	784	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 936 set thread context of 1520	936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

1244 sc.exe
1864 sc.exe

pid	process
1244	sc.exe
1864	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exepowershell.exe

pid	process
2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
1956	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

pid	process
784	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1956 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1956	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.execmd.execmd.execmd.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

description	pid	process	target process
PID 784 wrote to memory of 2016	784	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 784 wrote to memory of 2016	784	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 784 wrote to memory of 2016	784	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 784 wrote to memory of 2016	784	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 784 wrote to memory of 2016	784	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 2016 wrote to memory of 2044	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 2044	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 2044	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 2044	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1892	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1892	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1892	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 1892	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	cmd.exe
PID 2016 wrote to memory of 936	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 2016 wrote to memory of 936	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 2016 wrote to memory of 936	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 2016 wrote to memory of 936	2016	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 1980 wrote to memory of 1244	1980	cmd.exe	sc.exe
PID 1980 wrote to memory of 1244	1980	cmd.exe	sc.exe
PID 1980 wrote to memory of 1244	1980	cmd.exe	sc.exe
PID 1980 wrote to memory of 1244	1980	cmd.exe	sc.exe
PID 2044 wrote to memory of 1864	2044	cmd.exe	sc.exe
PID 2044 wrote to memory of 1864	2044	cmd.exe	sc.exe
PID 2044 wrote to memory of 1864	2044	cmd.exe	sc.exe
PID 2044 wrote to memory of 1864	2044	cmd.exe	sc.exe
PID 1892 wrote to memory of 1956	1892	cmd.exe	powershell.exe
PID 1892 wrote to memory of 1956	1892	cmd.exe	powershell.exe
PID 1892 wrote to memory of 1956	1892	cmd.exe	powershell.exe
PID 1892 wrote to memory of 1956	1892	cmd.exe	powershell.exe
PID 936 wrote to memory of 1520	936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 936 wrote to memory of 1520	936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 936 wrote to memory of 1520	936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 936 wrote to memory of 1520	936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 936 wrote to memory of 1520	936	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 1520 wrote to memory of 588	1520	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
"C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
"C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
4⤵
- Launches sc.exe
PID:1864

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
4⤵
- Launches sc.exe
PID:1244

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:936

C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
5⤵
PID:588

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
Filesize
428KB

MD5
54bc795028a9a3f1467d8ba8a3f1f5a2

SHA1
e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d

SHA256
3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

SHA512
35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Download Submit
C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
Filesize
428KB

MD5
54bc795028a9a3f1467d8ba8a3f1f5a2

SHA1
e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d

SHA256
3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

SHA512
35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Download Submit
\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
Filesize
428KB

MD5
54bc795028a9a3f1467d8ba8a3f1f5a2

SHA1
e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d

SHA256
3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

SHA512
35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Download Submit
memory/588-84-0x0000000140000000-0x0000000140036000-memory.dmp

Filesize
216KB

Download
memory/588-82-0x0000000000000000-mapping.dmp

Download
memory/784-54-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download
memory/936-63-0x0000000000000000-mapping.dmp

Download
memory/1244-65-0x0000000000000000-mapping.dmp

Download
memory/1520-90-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1520-79-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1520-75-0x0000000000401000-mapping.dmp

Download
memory/1864-66-0x0000000000000000-mapping.dmp

Download
memory/1892-61-0x0000000000000000-mapping.dmp

Download
memory/1956-70-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1956-71-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1956-67-0x0000000000000000-mapping.dmp

Download
memory/1980-60-0x0000000000000000-mapping.dmp

Download
memory/2016-69-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2016-58-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/2016-57-0x0000000000401000-mapping.dmp

Download
memory/2044-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads