trickbot | 6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac

General

Target

6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe
Size

748KB
MD5

955a58eb796749424e76bc559da71d99
SHA1

0c4c46797d0975c03b49f9f31b74d9b3e72539c7
SHA256

6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac
SHA512

5d715ccb22de3a8dc283635a9285bf83273c84af62e268d79b93d28bac0aa0310067d895d7c0b53a1b2ecd1b196c342c0b80074935b5480ec7419232cb2027f0

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1828-55-0x00000000002C0000-0x00000000002ED000-memory.dmp	trickbot_loader32
behavioral1/memory/1828-56-0x0000000000290000-0x00000000002BD000-memory.dmp	trickbot_loader32
behavioral1/memory/1828-57-0x00000000002C1000-0x00000000002ED000-memory.dmp	trickbot_loader32
behavioral1/memory/1828-59-0x00000000002C1000-0x00000000002ED000-memory.dmp	trickbot_loader32
behavioral1/memory/1176-68-0x00000000001E1000-0x000000000020D000-memory.dmp	trickbot_loader32
behavioral1/memory/1176-70-0x00000000001E1000-0x000000000020D000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe

pid process

1176 8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 1380 svchost.exe

pid	process
1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe

description	pid	process
Token: SeTcbPrivilege	1380	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe

pid	process
1828	6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe
1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exetaskeng.exe8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe

description	pid	process	target process
PID 1828 wrote to memory of 2004	1828	6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe	svchost.exe
PID 1828 wrote to memory of 2004	1828	6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe	svchost.exe
PID 1828 wrote to memory of 2004	1828	6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe	svchost.exe
PID 1828 wrote to memory of 2004	1828	6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe	svchost.exe
PID 1828 wrote to memory of 2004	1828	6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe	svchost.exe
PID 1828 wrote to memory of 2004	1828	6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe	svchost.exe
PID 1200 wrote to memory of 1176	1200	taskeng.exe	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
PID 1200 wrote to memory of 1176	1200	taskeng.exe	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
PID 1200 wrote to memory of 1176	1200	taskeng.exe	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
PID 1200 wrote to memory of 1176	1200	taskeng.exe	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
PID 1176 wrote to memory of 1380	1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe	svchost.exe
PID 1176 wrote to memory of 1380	1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe	svchost.exe
PID 1176 wrote to memory of 1380	1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe	svchost.exe
PID 1176 wrote to memory of 1380	1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe	svchost.exe
PID 1176 wrote to memory of 1380	1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe	svchost.exe
PID 1176 wrote to memory of 1380	1176	8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe
"C:\Users\Admin\AppData\Local\Temp\6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:2004

C:\Windows\system32\taskeng.exe
taskeng.exe {360B10D4-3F45-444D-8C5E-64D4BB3CD4ED} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Roaming\taskhealth\8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
C:\Users\Admin\AppData\Roaming\taskhealth\8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\taskhealth\8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
Filesize
748KB

MD5
955a58eb796749424e76bc559da71d99

SHA1
0c4c46797d0975c03b49f9f31b74d9b3e72539c7

SHA256
6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac

SHA512
5d715ccb22de3a8dc283635a9285bf83273c84af62e268d79b93d28bac0aa0310067d895d7c0b53a1b2ecd1b196c342c0b80074935b5480ec7419232cb2027f0

Download Submit
C:\Users\Admin\AppData\Roaming\taskhealth\8a7c0112890ffb39a840a1800f08b9a23c8973ff8ba172f14da8cdbde0d79cac.exe
Filesize
748KB

MD5
955a58eb796749424e76bc559da71d99

SHA1
0c4c46797d0975c03b49f9f31b74d9b3e72539c7

SHA256
6a5c0112870ffb39a840a1800f08b7a23c8753ff6ba152f14da6cdbde0d57cac

SHA512
5d715ccb22de3a8dc283635a9285bf83273c84af62e268d79b93d28bac0aa0310067d895d7c0b53a1b2ecd1b196c342c0b80074935b5480ec7419232cb2027f0

Download Submit
memory/1176-68-0x00000000001E1000-0x000000000020D000-memory.dmp

Filesize
176KB

Download
memory/1176-70-0x00000000001E1000-0x000000000020D000-memory.dmp

Filesize
176KB

Download
memory/1176-64-0x0000000000000000-mapping.dmp

Download
memory/1380-71-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1380-69-0x0000000000000000-mapping.dmp

Download
memory/1380-72-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1828-57-0x00000000002C1000-0x00000000002ED000-memory.dmp

Filesize
176KB

Download
memory/1828-59-0x00000000002C1000-0x00000000002ED000-memory.dmp

Filesize
176KB

Download
memory/1828-60-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/1828-54-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download
memory/1828-56-0x0000000000290000-0x00000000002BD000-memory.dmp

Filesize
180KB

Download
memory/1828-55-0x00000000002C0000-0x00000000002ED000-memory.dmp

Filesize
180KB

Download
memory/2004-58-0x0000000000000000-mapping.dmp

Download
memory/2004-62-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/2004-61-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads