Analysis
-
max time kernel
75s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
05-09-2022 20:38
General
-
Target
2018-05-16-Trickbot-malware-binary.exe
-
Size
166KB
-
MD5
96985dff8be2912fe2d02752b5d4a073
-
SHA1
483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
-
SHA256
fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
-
SHA512
3dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
-
SSDEEP
3072:Rbx/OZbql/eMRiVUV0g0bHV6h/ke1zEpq4KaxnD9RRUQ5l/MQ85Cw5suN:RufEi2V05rVe8eJUq4Ka1RUQT0QgCwO+
Malware Config
Signatures
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exeC:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exe"C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exeFilesize
166KB
MD596985dff8be2912fe2d02752b5d4a073
SHA1483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
SHA256fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
SHA5123dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
-
C:\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exeFilesize
166KB
MD596985dff8be2912fe2d02752b5d4a073
SHA1483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
SHA256fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
SHA5123dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
-
\Users\Admin\AppData\Roaming\diskcheck\2019-06-17-Tsickbot-malwase-binasy.exeFilesize
166KB
MD596985dff8be2912fe2d02752b5d4a073
SHA1483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
SHA256fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
SHA5123dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
-
memory/472-21061-0x0000000000000000-mapping.dmp
-
memory/1568-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1568-21058-0x0000000000401000-mapping.dmp
-
memory/1568-54-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1568-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1568-21693-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1568-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1616-42068-0x0000000000401000-mapping.dmp
-
memory/1616-42083-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1944-42075-0x0000000000000000-mapping.dmp