trickbot | ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 14:05

Target

ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe
Size

300KB
MD5

afcda05f69adec287b84012f2ec3d535
SHA1

8966fa733be9a8e1f16a174018398932a053162e
SHA256

ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9
SHA512

6c71a3e2639bbc4f752595568cbff93fd9f86d1da3ed5245228328fac90dadd5cc747af696c55ed74fc241e1426daa91564a16b9567df5cecc08c0e5043ae236
SSDEEP

6144:qnx9RtQLCgTCK44RFSrIPcLL4rK0j2TW/8c7earkWPdt0IF8sK3CXIUg:ucPcv420jLoWPdtVusyCX

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1688-55-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral1/memory/1688-56-0x00000000003D0000-0x00000000003FB000-memory.dmp	trickbot_loader32
behavioral1/memory/1688-57-0x00000000003D0000-0x00000000003FB000-memory.dmp	trickbot_loader32

C:\Users\Admin\AppData\Local\Temp\ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe
"C:\Users\Admin\AppData\Local\Temp\ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe"
1⤵
PID:1688

memory/1688-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1688-55-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1688-56-0x00000000003D0000-0x00000000003FB000-memory.dmp

Filesize
172KB

Download
memory/1688-57-0x00000000003D0000-0x00000000003FB000-memory.dmp

Filesize
172KB

Download