trickbot | 2c418f0823efa7af1ce88a816add23e45058ff7ff5951251a450718861a4beb5

General

Target

b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe
Size

451KB
MD5

933103a4d17cfb59c3cdd3bc5562b9c0
SHA1

b28e3da94bbeadd3d73d80007f889c1cde73bd53
SHA256

2c418f0823efa7af1ce88a816add23e45058ff7ff5951251a450718861a4beb5
SHA512

1b6b634292c6fab53bbfcef90c45a422a8cf4c5a36e051c5f82b79b0e9347b3ea00ac2c8b3855559f7b662bce92ea771e7aa4f8b332c185e9176608fa772e116
SSDEEP

6144:A6D6bAa+urTedef/xi9hFj7AqnjtGaatHlqW6shOteyvd6XfRY:bXJfoijtGaaPqm0ey8XfRY

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/616-135-0x0000000000900000-0x0000000000930000-memory.dmp	trickbot_loader32
behavioral1/memory/616-136-0x00000000008D0000-0x00000000008FF000-memory.dmp	trickbot_loader32
behavioral1/memory/616-137-0x0000000000901000-0x0000000000930000-memory.dmp	trickbot_loader32
behavioral1/memory/616-140-0x0000000000901000-0x0000000000930000-memory.dmp	trickbot_loader32
behavioral1/memory/1164-146-0x0000000000E61000-0x0000000000E90000-memory.dmp	trickbot_loader32
behavioral1/memory/1164-148-0x0000000000E61000-0x0000000000E90000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exeGCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe

pid process

616 ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
1164 GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe

pid	process
616	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
1164	GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 40 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 4876 svchost.exe

description	pid	process
Token: SeTcbPrivilege	4876	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b28e3da94bbeadd3d73d80007f889c1cde73bd53.exeICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exeGCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe

pid	process
2368	b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe
616	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
1164	GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b28e3da94bbeadd3d73d80007f889c1cde73bd53.exeICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exeGCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe

description	pid	process	target process
PID 2368 wrote to memory of 616	2368	b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
PID 2368 wrote to memory of 616	2368	b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
PID 2368 wrote to memory of 616	2368	b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
PID 616 wrote to memory of 2072	616	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe
PID 616 wrote to memory of 2072	616	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe
PID 616 wrote to memory of 2072	616	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe
PID 616 wrote to memory of 2072	616	ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe
PID 1164 wrote to memory of 4876	1164	GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe
PID 1164 wrote to memory of 4876	1164	GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe
PID 1164 wrote to memory of 4876	1164	GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe
PID 1164 wrote to memory of 4876	1164	GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe
"C:\Users\Admin\AppData\Local\Temp\b28e3da94bbeadd3d73d80007f889c1cde73bd53.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

C:\ProgramData\ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
"C:\ProgramData\ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2072

C:\Users\Admin\AppData\Roaming\WinNetCore\GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
C:\Users\Admin\AppData\Roaming\WinNetCore\GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
Filesize
451KB

MD5
933103a4d17cfb59c3cdd3bc5562b9c0

SHA1
b28e3da94bbeadd3d73d80007f889c1cde73bd53

SHA256
2c418f0823efa7af1ce88a816add23e45058ff7ff5951251a450718861a4beb5

SHA512
1b6b634292c6fab53bbfcef90c45a422a8cf4c5a36e051c5f82b79b0e9347b3ea00ac2c8b3855559f7b662bce92ea771e7aa4f8b332c185e9176608fa772e116

Download Submit
C:\ProgramData\ICCMXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
Filesize
451KB

MD5
933103a4d17cfb59c3cdd3bc5562b9c0

SHA1
b28e3da94bbeadd3d73d80007f889c1cde73bd53

SHA256
2c418f0823efa7af1ce88a816add23e45058ff7ff5951251a450718861a4beb5

SHA512
1b6b634292c6fab53bbfcef90c45a422a8cf4c5a36e051c5f82b79b0e9347b3ea00ac2c8b3855559f7b662bce92ea771e7aa4f8b332c185e9176608fa772e116

Download Submit
C:\Users\Admin\AppData\Roaming\WinNetCore\GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
Filesize
451KB

MD5
933103a4d17cfb59c3cdd3bc5562b9c0

SHA1
b28e3da94bbeadd3d73d80007f889c1cde73bd53

SHA256
2c418f0823efa7af1ce88a816add23e45058ff7ff5951251a450718861a4beb5

SHA512
1b6b634292c6fab53bbfcef90c45a422a8cf4c5a36e051c5f82b79b0e9347b3ea00ac2c8b3855559f7b662bce92ea771e7aa4f8b332c185e9176608fa772e116

Download Submit
C:\Users\Admin\AppData\Roaming\WinNetCore\GCCKXåïàï;;;êâûâ;;;;ìà;;îðïïïà.exe
Filesize
451KB

MD5
933103a4d17cfb59c3cdd3bc5562b9c0

SHA1
b28e3da94bbeadd3d73d80007f889c1cde73bd53

SHA256
2c418f0823efa7af1ce88a816add23e45058ff7ff5951251a450718861a4beb5

SHA512
1b6b634292c6fab53bbfcef90c45a422a8cf4c5a36e051c5f82b79b0e9347b3ea00ac2c8b3855559f7b662bce92ea771e7aa4f8b332c185e9176608fa772e116

Download Submit
memory/616-136-0x00000000008D0000-0x00000000008FF000-memory.dmp

Filesize
188KB

Download
memory/616-132-0x0000000000000000-mapping.dmp

Download
memory/616-135-0x0000000000900000-0x0000000000930000-memory.dmp

Filesize
192KB

Download
memory/616-140-0x0000000000901000-0x0000000000930000-memory.dmp

Filesize
188KB

Download
memory/616-138-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/616-141-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/616-137-0x0000000000901000-0x0000000000930000-memory.dmp

Filesize
188KB

Download
memory/1164-146-0x0000000000E61000-0x0000000000E90000-memory.dmp

Filesize
188KB

Download
memory/1164-148-0x0000000000E61000-0x0000000000E90000-memory.dmp

Filesize
188KB

Download
memory/2072-142-0x0000026A7B4E0000-0x0000026A7B502000-memory.dmp

Filesize
136KB

Download
memory/2072-139-0x0000000000000000-mapping.dmp

Download
memory/4876-147-0x0000000000000000-mapping.dmp

Download
memory/4876-149-0x000001BED6B00000-0x000001BED6B22000-memory.dmp

Filesize
136KB

Download
memory/4876-150-0x000001BED6B00000-0x000001BED6B22000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads