trickbot | fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7

General

Target

fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe
Size

412KB
MD5

5780f9ea6f92bff6655f6534beeb9c59
SHA1

2607967bbef0e63efd00bdd9f403dcab9add0a74
SHA256

fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7
SHA512

de33996df1575e0a0d028173106b46417c72f46e6b2c98142aabd4d8af58508c583007cb759f1cf900200f839f59ac761c00e96c64b71593fd942dad0480d497

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 5 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1008-146-0x0000000002270000-0x000000000229E000-memory.dmp	trickbot_loader32
behavioral2/memory/1008-149-0x0000000002270000-0x000000000229E000-memory.dmp	trickbot_loader32
behavioral2/memory/1008-151-0x0000000002270000-0x000000000229E000-memory.dmp	trickbot_loader32
behavioral2/memory/4876-175-0x0000000000EC0000-0x0000000000EEE000-memory.dmp	trickbot_loader32
behavioral2/memory/4876-177-0x0000000000EC0000-0x0000000000EEE000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe

pid process

4876 fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 1684 svchost.exe

pid	process
4876	fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe

description	pid	process
Token: SeTcbPrivilege	1684	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exefa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe

pid	process
1008	fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe
1008	fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe
4876	fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe
4876	fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exefa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe

description	pid	process	target process
PID 1008 wrote to memory of 4356	1008	fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe	svchost.exe
PID 1008 wrote to memory of 4356	1008	fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe	svchost.exe
PID 1008 wrote to memory of 4356	1008	fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe	svchost.exe
PID 1008 wrote to memory of 4356	1008	fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe	svchost.exe
PID 4876 wrote to memory of 1684	4876	fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe	svchost.exe
PID 4876 wrote to memory of 1684	4876	fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe	svchost.exe
PID 4876 wrote to memory of 1684	4876	fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe	svchost.exe
PID 4876 wrote to memory of 1684	4876	fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe
"C:\Users\Admin\AppData\Local\Temp\fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:4356

C:\Users\Admin\AppData\Roaming\HttpService\fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe
C:\Users\Admin\AppData\Roaming\HttpService\fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\HttpService\fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe
Filesize
412KB

MD5
5780f9ea6f92bff6655f6534beeb9c59

SHA1
2607967bbef0e63efd00bdd9f403dcab9add0a74

SHA256
fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7

SHA512
de33996df1575e0a0d028173106b46417c72f46e6b2c98142aabd4d8af58508c583007cb759f1cf900200f839f59ac761c00e96c64b71593fd942dad0480d497

Download Submit
C:\Users\Admin\AppData\Roaming\HttpService\fa80df4e1908202dd40d2df87dc2924efce8a99e93bd38db948f0c212ff87aa9.exe
Filesize
412KB

MD5
5780f9ea6f92bff6655f6534beeb9c59

SHA1
2607967bbef0e63efd00bdd9f403dcab9add0a74

SHA256
fa60df4e1708202dd40d2df85dc2924efce6a77e93bd36db748f0c212ff65aa7

SHA512
de33996df1575e0a0d028173106b46417c72f46e6b2c98142aabd4d8af58508c583007cb759f1cf900200f839f59ac761c00e96c64b71593fd942dad0480d497

Download Submit
memory/1008-143-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-134-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-137-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-136-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-140-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-139-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-141-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-142-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-135-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-144-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-145-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-146-0x0000000002270000-0x000000000229E000-memory.dmp

Filesize
184KB

Download
memory/1008-148-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-149-0x0000000002270000-0x000000000229E000-memory.dmp

Filesize
184KB

Download
memory/1008-133-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1008-151-0x0000000002270000-0x000000000229E000-memory.dmp

Filesize
184KB

Download
memory/1008-138-0x0000000002260000-0x0000000002263000-memory.dmp

Filesize
12KB

Download
memory/1684-178-0x0000023098040000-0x000002309805E000-memory.dmp

Filesize
120KB

Download
memory/1684-179-0x0000023098040000-0x000002309805E000-memory.dmp

Filesize
120KB

Download
memory/1684-176-0x0000000000000000-mapping.dmp

Download
memory/4356-153-0x000001E8D8860000-0x000001E8D887E000-memory.dmp

Filesize
120KB

Download
memory/4356-152-0x000001E8D8860000-0x000001E8D887E000-memory.dmp

Filesize
120KB

Download
memory/4356-150-0x0000000000000000-mapping.dmp

Download
memory/4876-168-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-170-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-160-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-167-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-166-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-162-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-169-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-164-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-171-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-174-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-175-0x0000000000EC0000-0x0000000000EEE000-memory.dmp

Filesize
184KB

Download
memory/4876-163-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-177-0x0000000000EC0000-0x0000000000EEE000-memory.dmp

Filesize
184KB

Download
memory/4876-161-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download
memory/4876-165-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads