trickbot | 609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6

General

Target

609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6.exe
Size

340KB
MD5

f0bd265c4732a39c800c7f36c4f6d5cc
SHA1

664b0bb2e21dd167d3fd5ee6f804b188773f9ded
SHA256

609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6
SHA512

b6f11c19ba6c3030ef54a7ba3ac944a6b172b628e7898decca8766a4b68bfa65919ee9bcf179b1d0babd7ca4bdbaa87ef39268104e81f9da9d4d997bda71d8a3

Score

10^/10

trickbot ser0511 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000192

Botnet

ser0511

C2

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:449

109.95.114.28:449

118.91.178.106:449

173.220.6.194:449

179.107.89.145:449

46.20.207.204:449

91.206.4.216:449

69.122.117.95:449

68.96.73.154:449

185.42.192.194:449

189.84.125.37:449

68.227.31.46:449

107.144.49.162:449

46.72.175.17:449

144.48.51.8:449

46.243.179.212:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/2160-133-0x0000000003400000-0x000000000349B000-memory.dmp	trickbot_loader32
behavioral2/memory/2876-135-0x00000000032A0000-0x000000000333B000-memory.dmp	trickbot_loader32
behavioral2/memory/2876-147-0x00000000032A0000-0x000000000333B000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe

pid process

2876 709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe

pid	process
2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\wsxmail\709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\wsxmail\\709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe"	svchost.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

67 ipecho.net
80 ipinfo.io

flow	ioc
67	ipecho.net
80	ipinfo.io

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6.exe709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe

description	pid	process	target process
PID 2160 wrote to memory of 2876	2160	609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6.exe	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe
PID 2160 wrote to memory of 2876	2160	609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6.exe	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe
PID 2160 wrote to memory of 2876	2160	609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6.exe	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe
PID 2876 wrote to memory of 5028	2876	709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6.exe
"C:\Users\Admin\AppData\Local\Temp\609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Roaming\wsxmail\709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe
  C:\Users\Admin\AppData\Roaming\wsxmail\709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wsxmail\709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe

Filesize
340KB

MD5
f0bd265c4732a39c800c7f36c4f6d5cc

SHA1
664b0bb2e21dd167d3fd5ee6f804b188773f9ded

SHA256
609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6

SHA512
b6f11c19ba6c3030ef54a7ba3ac944a6b172b628e7898decca8766a4b68bfa65919ee9bcf179b1d0babd7ca4bdbaa87ef39268104e81f9da9d4d997bda71d8a3

Download Submit
C:\Users\Admin\AppData\Roaming\wsxmail\709cc34849da8ce7e9dbb3de9b8d0be03eca4cea73a4f3b1c393a3d493d0ecd7.exe

Filesize
340KB

MD5
f0bd265c4732a39c800c7f36c4f6d5cc

SHA1
664b0bb2e21dd167d3fd5ee6f804b188773f9ded

SHA256
609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6

SHA512
b6f11c19ba6c3030ef54a7ba3ac944a6b172b628e7898decca8766a4b68bfa65919ee9bcf179b1d0babd7ca4bdbaa87ef39268104e81f9da9d4d997bda71d8a3

Download Submit
memory/2160-133-0x0000000003400000-0x000000000349B000-memory.dmp

Filesize
620KB

Download
memory/2876-130-0x0000000000000000-mapping.dmp

Download
memory/2876-136-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2876-135-0x00000000032A0000-0x000000000333B000-memory.dmp

Filesize
620KB

Download
memory/2876-147-0x00000000032A0000-0x000000000333B000-memory.dmp

Filesize
620KB

Download
memory/5028-139-0x0000000000000000-mapping.dmp

Download
memory/5028-141-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads