trickbot | 5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325

General

Target

5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325.exe
Size

565KB
MD5

d61ca02b30b949fcc13e1876304a66a4
SHA1

c33de07051e054c0ddeacdbcea94a348681d9233
SHA256

5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325
SHA512

0c3e7e023c85a4cbe4c285ca8d3fd87d5a3ae65dc5cdc263e78c68956bc07af3457d20bedee31364faf1acd21044bac531106d92488f4a5ab6cc924fd8361f53

Score

10^/10

trickbot sat76 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000275

Botnet

sat76

C2

51.68.184.101:443

94.181.47.198:449

31.31.161.165:449

158.69.177.176:443

181.113.17.230:449

212.23.70.149:443

185.251.38.178:443

170.81.32.66:449

42.115.91.177:443

54.39.167.242:443

71.94.101.25:443

68.45.243.125:449

192.252.209.44:443

182.50.64.148:449

187.190.249.230:443

107.175.127.147:443

82.222.40.119:449

198.100.157.163:443

23.226.138.169:443

103.110.91.118:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/3560-131-0x0000000000710000-0x000000000074D000-memory.dmp	trickbot_loader32
behavioral2/memory/3560-150-0x0000000000710000-0x000000000074D000-memory.dmp	trickbot_loader32
behavioral2/memory/1396-151-0x0000000000FA0000-0x0000000000FDD000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe

pid process

1396 6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe

pid	process
1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMY\6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMY\\6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe"	svchost.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 wtfismyip.com
43 ip.anysrc.net
54 api.ipify.org
55 api.ipify.org

flow	ioc
38	wtfismyip.com
43	ip.anysrc.net
54	api.ipify.org
55	api.ipify.org

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325.exe6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe

description	pid	process	target process
PID 3560 wrote to memory of 1396	3560	5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325.exe	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe
PID 3560 wrote to memory of 1396	3560	5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325.exe	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe
PID 3560 wrote to memory of 1396	3560	5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325.exe	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe
PID 1396 wrote to memory of 2784	1396	6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325.exe
"C:\Users\Admin\AppData\Local\Temp\5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Users\Admin\AppData\Roaming\AIMY\6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe
C:\Users\Admin\AppData\Roaming\AIMY\6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:2784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AIMY\6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe
Filesize
565KB

MD5
d61ca02b30b949fcc13e1876304a66a4

SHA1
c33de07051e054c0ddeacdbcea94a348681d9233

SHA256
5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325

SHA512
0c3e7e023c85a4cbe4c285ca8d3fd87d5a3ae65dc5cdc263e78c68956bc07af3457d20bedee31364faf1acd21044bac531106d92488f4a5ab6cc924fd8361f53

Download Submit
C:\Users\Admin\AppData\Roaming\AIMY\6ec64b2f42a93caefb38ff13b069ca892c0fba7629412498eda9493bc7941326.exe
Filesize
565KB

MD5
d61ca02b30b949fcc13e1876304a66a4

SHA1
c33de07051e054c0ddeacdbcea94a348681d9233

SHA256
5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325

SHA512
0c3e7e023c85a4cbe4c285ca8d3fd87d5a3ae65dc5cdc263e78c68956bc07af3457d20bedee31364faf1acd21044bac531106d92488f4a5ab6cc924fd8361f53

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1101907861-274115917-2188613224-1000\0f5007522459c86e95ffcc62f32308f1_146eccbb-68c5-4730-b193-ca9b081460a7
Filesize
1KB

MD5
efb0bc307579faa7f45b73c8a80470bf

SHA1
057afa95e3a6ad73796da444b447263c88c585ba

SHA256
ef6af052eeba67608fe5332f3b936af36bb2ad69bde4c236fe4d38e248bc612c

SHA512
58afe005dc4e03bbadbfd7bfd0e9bb60df9bf4ada2b809131480837c12afc61fbd272bfc6f45b268d6a141209a02eaaa2ef1e5dd00a21c5c1c5b0f9017a1a2c8

Download Submit
memory/1396-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1396-132-0x0000000000000000-mapping.dmp

Download
memory/1396-138-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1396-151-0x0000000000FA0000-0x0000000000FDD000-memory.dmp

Filesize
244KB

Download
memory/1396-152-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2784-141-0x0000000000000000-mapping.dmp

Download
memory/2784-143-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3560-131-0x0000000000710000-0x000000000074D000-memory.dmp

Filesize
244KB

Download
memory/3560-130-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3560-149-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3560-150-0x0000000000710000-0x000000000074D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads