trickbot | 601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165

General

Target

601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe
Size

365KB
MD5

f29bc2a03740daf8e403b23c8d920cf7
SHA1

ace92a37574960979f9ad6e8bff4cfb385590e3d
SHA256

601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165
SHA512

2b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/3860-130-0x00000000006B0000-0x00000000006D9000-memory.dmp	trickbot_loader32
behavioral2/memory/3860-134-0x00000000006B0000-0x00000000006D9000-memory.dmp	trickbot_loader32
behavioral2/memory/1596-146-0x00000000006B0000-0x00000000006D9000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe

pid	process
1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
4760	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe

description	pid	process	target process
PID 3860 wrote to memory of 1596	3860	601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
PID 3860 wrote to memory of 1596	3860	601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
PID 3860 wrote to memory of 1596	3860	601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe
PID 1596 wrote to memory of 4328	1596	701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe
"C:\Users\Admin\AppData\Local\Temp\601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4328

C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
1⤵
- Executes dropped EXE
PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1101907861-274115917-2188613224-1000\0f5007522459c86e95ffcc62f32308f1_146eccbb-68c5-4730-b193-ca9b081460a7
Filesize
1KB

MD5
400944f5efb9de9161b9749b7a560475

SHA1
2366ede0b03fbf1af67121433a7d5393dc0b6c71

SHA256
5f6dca36098d13b00d1215626d3a55248fdab9b5ca085491592a6e9c54745664

SHA512
86b117af1a31ed4ef70f227b420ac72e8f21f27377e23e98acc30fef75328d057c923d15e2ecb690b787b986f6c9ee2a0af79204a90ea2c03414a74ec9864d1d

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
Filesize
365KB

MD5
f29bc2a03740daf8e403b23c8d920cf7

SHA1
ace92a37574960979f9ad6e8bff4cfb385590e3d

SHA256
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165

SHA512
2b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
Filesize
365KB

MD5
f29bc2a03740daf8e403b23c8d920cf7

SHA1
ace92a37574960979f9ad6e8bff4cfb385590e3d

SHA256
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165

SHA512
2b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\701c0992b7ec8bb296dc1ba9869c0972e27b91ea7fe1b69a3029f16bc287c176.exe
Filesize
365KB

MD5
f29bc2a03740daf8e403b23c8d920cf7

SHA1
ace92a37574960979f9ad6e8bff4cfb385590e3d

SHA256
601c0982b6ec7bb295dc1ba9759c0862e26b91ea6fe1b59a3029f15bc276c165

SHA512
2b92f6d33a2ef7d6131a6dad46a97bd81bace2525e3c453f354b37f7f4443c8149cf034f9ed26ae39aaa9af6510b0f36fe10c208eb86ec6e691fc189c93f0f44

Download Submit
memory/1596-131-0x0000000000000000-mapping.dmp

Download
memory/1596-146-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/1596-137-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3860-130-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/3860-134-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/4328-142-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/4328-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads