trickbot | 76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

General

Target

76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe
Size

492KB
MD5

e29212a7f10f41c4404f694162b91de8
SHA1

cb189d1eb74822a12b3f4efba5328400d7d81da0
SHA256

76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0
SHA512

a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/2000-61-0x0000000000290000-0x00000000002BD000-memory.dmp	trickbot_loader32
behavioral1/memory/2000-64-0x0000000000291000-0x00000000002BD000-memory.dmp	trickbot_loader32
behavioral1/memory/2000-63-0x0000000000230000-0x000000000025D000-memory.dmp	trickbot_loader32
behavioral1/memory/456-74-0x0000000000581000-0x00000000005AD000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

àâûñ÷âöóûâïï.exeàâûñ÷âöóûâïï.exe

pid process

2000 àâûñ÷âöóûâïï.exe
456 àâûñ÷âöóûâïï.exe

pid	process
2000	àâûñ÷âöóûâïï.exe
456	àâûñ÷âöóûâïï.exe

Loads dropped DLL 2 IoCs

Processes:

76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe

pid	process
1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe
1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exeàâûñ÷âöóûâïï.exeàâûñ÷âöóûâïï.exe

pid	process
1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe
1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe
2000	àâûñ÷âöóûâïï.exe
2000	àâûñ÷âöóûâïï.exe
456	àâûñ÷âöóûâïï.exe
456	àâûñ÷âöóûâïï.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exeàâûñ÷âöóûâïï.exetaskeng.exeàâûñ÷âöóûâïï.exe

description	pid	process	target process
PID 1436 wrote to memory of 2000	1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe	àâûñ÷âöóûâïï.exe
PID 1436 wrote to memory of 2000	1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe	àâûñ÷âöóûâïï.exe
PID 1436 wrote to memory of 2000	1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe	àâûñ÷âöóûâïï.exe
PID 1436 wrote to memory of 2000	1436	76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe	àâûñ÷âöóûâïï.exe
PID 2000 wrote to memory of 1736	2000	àâûñ÷âöóûâïï.exe	svchost.exe
PID 2000 wrote to memory of 1736	2000	àâûñ÷âöóûâïï.exe	svchost.exe
PID 2000 wrote to memory of 1736	2000	àâûñ÷âöóûâïï.exe	svchost.exe
PID 2000 wrote to memory of 1736	2000	àâûñ÷âöóûâïï.exe	svchost.exe
PID 2000 wrote to memory of 1736	2000	àâûñ÷âöóûâïï.exe	svchost.exe
PID 2000 wrote to memory of 1736	2000	àâûñ÷âöóûâïï.exe	svchost.exe
PID 1056 wrote to memory of 456	1056	taskeng.exe	àâûñ÷âöóûâïï.exe
PID 1056 wrote to memory of 456	1056	taskeng.exe	àâûñ÷âöóûâïï.exe
PID 1056 wrote to memory of 456	1056	taskeng.exe	àâûñ÷âöóûâïï.exe
PID 1056 wrote to memory of 456	1056	taskeng.exe	àâûñ÷âöóûâïï.exe
PID 456 wrote to memory of 1724	456	àâûñ÷âöóûâïï.exe	svchost.exe
PID 456 wrote to memory of 1724	456	àâûñ÷âöóûâïï.exe	svchost.exe
PID 456 wrote to memory of 1724	456	àâûñ÷âöóûâïï.exe	svchost.exe
PID 456 wrote to memory of 1724	456	àâûñ÷âöóûâïï.exe	svchost.exe
PID 456 wrote to memory of 1724	456	àâûñ÷âöóûâïï.exe	svchost.exe
PID 456 wrote to memory of 1724	456	àâûñ÷âöóûâïï.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe
"C:\Users\Admin\AppData\Local\Temp\76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436

C:\ProgramData\àâûñ÷âöóûâïï.exe
"C:\ProgramData\àâûñ÷âöóûâïï.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1736

C:\Windows\system32\taskeng.exe
taskeng.exe {66DD5075-EAB2-4E3D-A729-00B7559BDDF5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Roaming\taskhealth\àâûñ÷âöóûâïï.exe
C:\Users\Admin\AppData\Roaming\taskhealth\àâûñ÷âöóûâïï.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1724

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\àâûñ÷âöóûâïï.exe
Filesize
492KB

MD5
e29212a7f10f41c4404f694162b91de8

SHA1
cb189d1eb74822a12b3f4efba5328400d7d81da0

SHA256
76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

SHA512
a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Download Submit
C:\ProgramData\àâûñ÷âöóûâïï.exe
Filesize
492KB

MD5
e29212a7f10f41c4404f694162b91de8

SHA1
cb189d1eb74822a12b3f4efba5328400d7d81da0

SHA256
76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

SHA512
a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Download Submit
C:\Users\Admin\AppData\Roaming\taskhealth\àâûñ÷âöóûâïï.exe
Filesize
492KB

MD5
e29212a7f10f41c4404f694162b91de8

SHA1
cb189d1eb74822a12b3f4efba5328400d7d81da0

SHA256
76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

SHA512
a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Download Submit
C:\Users\Admin\AppData\Roaming\taskhealth\àâûñ÷âöóûâïï.exe
Filesize
492KB

MD5
e29212a7f10f41c4404f694162b91de8

SHA1
cb189d1eb74822a12b3f4efba5328400d7d81da0

SHA256
76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

SHA512
a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Download Submit
\ProgramData\àâûñ÷âöóûâïï.exe
Filesize
492KB

MD5
e29212a7f10f41c4404f694162b91de8

SHA1
cb189d1eb74822a12b3f4efba5328400d7d81da0

SHA256
76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

SHA512
a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Download Submit
\ProgramData\àâûñ÷âöóûâïï.exe
Filesize
492KB

MD5
e29212a7f10f41c4404f694162b91de8

SHA1
cb189d1eb74822a12b3f4efba5328400d7d81da0

SHA256
76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

SHA512
a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Download Submit
memory/456-74-0x0000000000581000-0x00000000005AD000-memory.dmp

Filesize
176KB

Download
memory/456-69-0x0000000000000000-mapping.dmp

Download
memory/1436-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1724-75-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1724-73-0x0000000000000000-mapping.dmp

Download
memory/1736-67-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1736-66-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1736-62-0x0000000000000000-mapping.dmp

Download
memory/2000-63-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/2000-64-0x0000000000291000-0x00000000002BD000-memory.dmp

Filesize
176KB

Download
memory/2000-65-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/2000-61-0x0000000000290000-0x00000000002BD000-memory.dmp

Filesize
180KB

Download
memory/2000-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads