trickbot | ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9

General

Target

ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe
Size

300KB
MD5

afcda05f69adec287b84012f2ec3d535
SHA1

8966fa733be9a8e1f16a174018398932a053162e
SHA256

ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9
SHA512

6c71a3e2639bbc4f752595568cbff93fd9f86d1da3ed5245228328fac90dadd5cc747af696c55ed74fc241e1426daa91564a16b9567df5cecc08c0e5043ae236
SSDEEP

6144:qnx9RtQLCgTCK44RFSrIPcLL4rK0j2TW/8c7earkWPdt0IF8sK3CXIUg:ucPcv420jLoWPdtVusyCX

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 7 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/3336-133-0x00000000006E0000-0x000000000070B000-memory.dmp	trickbot_loader32
behavioral2/memory/3336-138-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/3336-139-0x00000000006E0000-0x000000000070B000-memory.dmp	trickbot_loader32
behavioral2/memory/648-140-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/648-141-0x00000000009F0000-0x0000000000A1B000-memory.dmp	trickbot_loader32
behavioral2/memory/648-152-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/648-153-0x00000000009F0000-0x0000000000A1B000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe

pid process

648 ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe

pid	process
648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exeec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe

description	pid	process	target process
PID 3336 wrote to memory of 648	3336	ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe
PID 3336 wrote to memory of 648	3336	ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe
PID 3336 wrote to memory of 648	3336	ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe
PID 648 wrote to memory of 4020	648	ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe
"C:\Users\Admin\AppData\Local\Temp\ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3336

C:\Users\Admin\AppData\Roaming\winnet\ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe
C:\Users\Admin\AppData\Roaming\winnet\ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2971393436-602173351-1645505021-1000\0f5007522459c86e95ffcc62f32308f1_957af1f1-6875-4c40-9804-a0dcc430f453
Filesize
1KB

MD5
35859d291829f5d583fd20b3bb3c88fe

SHA1
5713e93f220428c09ab7c0e192700d26f0a43699

SHA256
73e38436d1efb71873a1e2d1b381387148dd8a89a4c3d2d1fa555bac702e40c1

SHA512
6d36a3c149bbdc9c9c39bd4c5e1a64a0f3694af1b04f26676a37882f194e1909540bcb4dc59f544032acc8c7b00332cd27fa9579f378aae327795d6d815fb2b0

Download Submit
C:\Users\Admin\AppData\Roaming\winnet\ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe
Filesize
300KB

MD5
afcda05f69adec287b84012f2ec3d535

SHA1
8966fa733be9a8e1f16a174018398932a053162e

SHA256
ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9

SHA512
6c71a3e2639bbc4f752595568cbff93fd9f86d1da3ed5245228328fac90dadd5cc747af696c55ed74fc241e1426daa91564a16b9567df5cecc08c0e5043ae236

Download Submit
C:\Users\Admin\AppData\Roaming\winnet\ec1cbe082cca91c0e9f692db78ff83251660ed1a6386661d96283a8c973096b9.exe
Filesize
300KB

MD5
afcda05f69adec287b84012f2ec3d535

SHA1
8966fa733be9a8e1f16a174018398932a053162e

SHA256
ec1cbe072cca81c0e8f582db67ff73241550ed1a5375551d95273a7c863095b9

SHA512
6c71a3e2639bbc4f752595568cbff93fd9f86d1da3ed5245228328fac90dadd5cc747af696c55ed74fc241e1426daa91564a16b9567df5cecc08c0e5043ae236

Download Submit
memory/648-141-0x00000000009F0000-0x0000000000A1B000-memory.dmp

Filesize
172KB

Download
memory/648-134-0x0000000000000000-mapping.dmp

Download
memory/648-140-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/648-143-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/648-152-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/648-153-0x00000000009F0000-0x0000000000A1B000-memory.dmp

Filesize
172KB

Download
memory/3336-133-0x00000000006E0000-0x000000000070B000-memory.dmp

Filesize
172KB

Download
memory/3336-138-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3336-139-0x00000000006E0000-0x000000000070B000-memory.dmp

Filesize
172KB

Download
memory/3336-132-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4020-146-0x0000000000000000-mapping.dmp

Download
memory/4020-148-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing