trickbot | 576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

General

Target

576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
Size

380KB
MD5

44de98af8b6588ea597cdc95844fdda6
SHA1

2c222cf976ab93c63a494bab2c4bf35b0e3c894a
SHA256

576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2
SHA512

cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

Score

10^/10

trickbot ser0516 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000194

Botnet

ser0516

C2

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

173.220.6.194:449

179.107.89.145:449

46.20.207.204:443

69.122.117.95:449

68.96.73.154:449

185.42.192.194:449

189.84.125.37:443

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449

37.230.112.67:443

92.53.78.159:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 5 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1948-132-0x0000000000000000-mapping.dmp	trickbot_loader32
behavioral2/memory/1948-133-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral2/memory/1948-139-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral2/memory/2276-140-0x0000000000000000-mapping.dmp	trickbot_loader32
behavioral2/memory/2276-155-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

pid	process
568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\diskcheck\\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe"	svchost.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ipecho.net
9 ipecho.net

flow	ioc
7	ipecho.net
9	ipecho.net

Suspicious use of SetThreadContext 2 IoCs

Processes:

576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

description	pid	process	target process
PID 2584 set thread context of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 568 set thread context of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

pid	process
2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

description	pid	process	target process
PID 2584 wrote to memory of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 2584 wrote to memory of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 2584 wrote to memory of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 2584 wrote to memory of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 2584 wrote to memory of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 2584 wrote to memory of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 2584 wrote to memory of 1948	2584	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
PID 1948 wrote to memory of 568	1948	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 1948 wrote to memory of 568	1948	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 1948 wrote to memory of 568	1948	576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 568 wrote to memory of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 568 wrote to memory of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 568 wrote to memory of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 568 wrote to memory of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 568 wrote to memory of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 568 wrote to memory of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 568 wrote to memory of 2276	568	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe
PID 2276 wrote to memory of 2308	2276	687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
"C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe
  "C:\Users\Admin\AppData\Local\Temp\576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
    C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
      C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Adds Run key to start application
        
        PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

Filesize
380KB

MD5
44de98af8b6588ea597cdc95844fdda6

SHA1
2c222cf976ab93c63a494bab2c4bf35b0e3c894a

SHA256
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

SHA512
cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

Download Submit
C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

Filesize
380KB

MD5
44de98af8b6588ea597cdc95844fdda6

SHA1
2c222cf976ab93c63a494bab2c4bf35b0e3c894a

SHA256
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

SHA512
cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

Download Submit
C:\Users\Admin\AppData\Roaming\diskcheck\687362d82a728ae9cffc60abd3ca9930e92ec923824b4b6197a1dbd2df1d49a2.exe

Filesize
380KB

MD5
44de98af8b6588ea597cdc95844fdda6

SHA1
2c222cf976ab93c63a494bab2c4bf35b0e3c894a

SHA256
576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

SHA512
cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

Download Submit
memory/568-134-0x0000000000000000-mapping.dmp

Download
memory/1948-132-0x0000000000000000-mapping.dmp

Download
memory/1948-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1948-139-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2276-140-0x0000000000000000-mapping.dmp

Download
memory/2276-144-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2276-155-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2308-147-0x0000000000000000-mapping.dmp

Download
memory/2308-149-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads