trickbot | 3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

General

Target

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
Size

428KB
MD5

54bc795028a9a3f1467d8ba8a3f1f5a2
SHA1

e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d
SHA256

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa
SHA512

35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Score

10^/10

trickbot ser0629 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000219

Botnet

ser0629

C2

138.34.32.218:443

86.61.177.139:443

47.40.90.210:443

93.109.242.134:443

45.36.155.244:443

158.58.131.54:443

46.59.89.119:449

66.229.97.133:443

45.56.2.247:443

109.86.227.152:443

209.131.236.23:443

200.2.126.98:443

62.31.150.202:443

90.69.224.122:443

194.68.23.182:443

182.253.210.130:449

67.159.157.150:443

172.117.118.98:443

201.174.70.238:443

138.34.32.74:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/2684-130-0x0000000010000000-0x0000000010040000-memory.dmp	trickbot_loader32
behavioral2/memory/1324-137-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral2/memory/4324-155-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

pid	process
4124	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe = "C:\\Users\\Admin\\AppData\\Roaming\\sysmon\\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe"	svchost.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 myexternalip.com
51 myexternalip.com

flow	ioc
38	myexternalip.com
51	myexternalip.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

description	pid	process	target process
PID 2684 set thread context of 1324	2684	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 4124 set thread context of 4324	4124	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

pid	process
2684	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
4124	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe

description	pid	process	target process
PID 2684 wrote to memory of 1324	2684	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 2684 wrote to memory of 1324	2684	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 2684 wrote to memory of 1324	2684	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 2684 wrote to memory of 1324	2684	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
PID 1324 wrote to memory of 4124	1324	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 1324 wrote to memory of 4124	1324	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 1324 wrote to memory of 4124	1324	3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 4124 wrote to memory of 4324	4124	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 4124 wrote to memory of 4324	4124	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 4124 wrote to memory of 4324	4124	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 4124 wrote to memory of 4324	4124	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe
PID 4324 wrote to memory of 4076	4324	3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
"C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2684

C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe
"C:\Users\Admin\AppData\Local\Temp\3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4124

C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
5⤵
- Adds Run key to start application
PID:4076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
Filesize
428KB

MD5
54bc795028a9a3f1467d8ba8a3f1f5a2

SHA1
e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d

SHA256
3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

SHA512
35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Download Submit
C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
Filesize
428KB

MD5
54bc795028a9a3f1467d8ba8a3f1f5a2

SHA1
e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d

SHA256
3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

SHA512
35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Download Submit
C:\Users\Admin\AppData\Roaming\sysmon\3c6b09874e91c101cb4e169ce6bd978206641b99e08ff66978a617cb1d8962fa.exe
Filesize
428KB

MD5
54bc795028a9a3f1467d8ba8a3f1f5a2

SHA1
e5f7ba4baeb7bd0beef022c7535c071ab2c7d89d

SHA256
3c5b08764e81c101cb4e158ce5bd867205541b99e07ff55967a516cb1d7852fa

SHA512
35b27257fc7a86aafbf5ee143e0b69562117de2491740a8a02282f2b698caeb8272b061da1310b8a1be1f0a7955c8616ff93cf78aadf61ceba46adc4487a5edf

Download Submit
memory/1324-133-0x0000000000000000-mapping.dmp

Download
memory/1324-137-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2684-130-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download
memory/4076-147-0x0000000000000000-mapping.dmp

Download
memory/4076-149-0x0000000140000000-0x0000000140036000-memory.dmp

Filesize
216KB

Download
memory/4124-134-0x0000000000000000-mapping.dmp

Download
memory/4324-141-0x0000000000000000-mapping.dmp

Download
memory/4324-144-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4324-155-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads