Analysis
-
max time kernel
75s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/09/2022, 20:38
Static task
static1
Behavioral task
behavioral1
Sample
2018-05-16-Trickbot-malware-binary.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2018-05-16-Trickbot-malware-binary.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
2018-05-16-Trickbot-malware-binary.exe
-
Size
166KB
-
MD5
96985dff8be2912fe2d02752b5d4a073
-
SHA1
483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
-
SHA256
fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
-
SHA512
3dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
-
SSDEEP
3072:Rbx/OZbql/eMRiVUV0g0bHV6h/ke1zEpq4KaxnD9RRUQ5l/MQ85Cw5suN:RufEi2V05rVe8eJUq4Ka1RUQT0QgCwO+
Malware Config
Signatures
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/1568-57-0x0000000000400000-0x0000000000429000-memory.dmp trickbot_loader32 behavioral1/memory/1568-58-0x0000000000400000-0x0000000000429000-memory.dmp trickbot_loader32 behavioral1/memory/1568-21058-0x0000000000401000-mapping.dmp trickbot_loader32 behavioral1/memory/1568-21693-0x0000000000400000-0x0000000000429000-memory.dmp trickbot_loader32 behavioral1/memory/1616-42068-0x0000000000401000-mapping.dmp trickbot_loader32 behavioral1/memory/1616-42083-0x0000000000400000-0x0000000000429000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 472 2019-06-17-Tsickbot-malwase-binasy.exe 1616 2019-06-17-Tsickbot-malwase-binasy.exe -
Loads dropped DLL 1 IoCs
pid Process 1568 2018-05-16-Trickbot-malware-binary.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 set thread context of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 968 wrote to memory of 1568 968 2018-05-16-Trickbot-malware-binary.exe 27 PID 1568 wrote to memory of 472 1568 2018-05-16-Trickbot-malware-binary.exe 28 PID 1568 wrote to memory of 472 1568 2018-05-16-Trickbot-malware-binary.exe 28 PID 1568 wrote to memory of 472 1568 2018-05-16-Trickbot-malware-binary.exe 28 PID 1568 wrote to memory of 472 1568 2018-05-16-Trickbot-malware-binary.exe 28 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 472 wrote to memory of 1616 472 2019-06-17-Tsickbot-malwase-binasy.exe 29 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30 PID 1616 wrote to memory of 1944 1616 2019-06-17-Tsickbot-malwase-binasy.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exeC:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exe"C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1944
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166KB
MD596985dff8be2912fe2d02752b5d4a073
SHA1483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
SHA256fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
SHA5123dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
-
Filesize
166KB
MD596985dff8be2912fe2d02752b5d4a073
SHA1483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
SHA256fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
SHA5123dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
-
Filesize
166KB
MD596985dff8be2912fe2d02752b5d4a073
SHA1483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
SHA256fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
SHA5123dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c