trickbot | 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f

General

Target

6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
Size

473KB
MD5

87bc1902b89ac09e8904fb77f997bf02
SHA1

7f193a3ca6f3e20e005d1890ccc30197ef5df1e0
SHA256

6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f
SHA512

8fa91c61513b80fcb67ecc1640359db4c481013346f7ced0d79afa08bbd5621282f57e29fd8014e7f2f651cda68705874a2e22e9340d77bf7c77b531cb86fb8e
SSDEEP

6144:JnXOFxDkS6WtG6gGUgy9ZWHhnP9Ba5CfZomKKg7+uTAVg9EVJ0BVKvh82CYBuBNk:JRS6Wefq9Ba5oO7TUUk

Score

10^/10

trickbot banker evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/2672-141-0x00000000006D0000-0x00000000006FB000-memory.dmp	trickbot_loader32
behavioral2/memory/2672-145-0x00000000006D0000-0x00000000006FB000-memory.dmp	trickbot_loader32
behavioral2/memory/1028-157-0x00000000028F0000-0x000000000291B000-memory.dmp	trickbot_loader32
behavioral2/memory/1028-168-0x00000000028F0000-0x000000000291B000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe

pid process

1028 7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

4368 sc.exe
1384 sc.exe
4048 sc.exe
516 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

440 powershell.exe
440 powershell.exe
4040 powershell.exe
4040 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 440 powershell.exe
Token: SeDebugPrivilege 4040 powershell.exe

pid	process
4368	sc.exe
1384	sc.exe
4048	sc.exe
516	sc.exe

pid	process
440	powershell.exe
440	powershell.exe
4040	powershell.exe
4040	powershell.exe

description	pid	process
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.execmd.execmd.execmd.exe7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2672 wrote to memory of 3624	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	cmd.exe
PID 2672 wrote to memory of 3624	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	cmd.exe
PID 2672 wrote to memory of 3608	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	cmd.exe
PID 2672 wrote to memory of 3608	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	cmd.exe
PID 2672 wrote to memory of 3640	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	cmd.exe
PID 2672 wrote to memory of 3640	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	cmd.exe
PID 3608 wrote to memory of 4368	3608	cmd.exe	sc.exe
PID 3608 wrote to memory of 4368	3608	cmd.exe	sc.exe
PID 3624 wrote to memory of 1384	3624	cmd.exe	sc.exe
PID 3624 wrote to memory of 1384	3624	cmd.exe	sc.exe
PID 3640 wrote to memory of 440	3640	cmd.exe	powershell.exe
PID 3640 wrote to memory of 440	3640	cmd.exe	powershell.exe
PID 2672 wrote to memory of 1028	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
PID 2672 wrote to memory of 1028	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
PID 2672 wrote to memory of 1028	2672	6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
PID 1028 wrote to memory of 868	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	cmd.exe
PID 1028 wrote to memory of 868	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	cmd.exe
PID 1028 wrote to memory of 4440	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	cmd.exe
PID 1028 wrote to memory of 4440	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	cmd.exe
PID 1028 wrote to memory of 3856	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	cmd.exe
PID 1028 wrote to memory of 3856	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	cmd.exe
PID 868 wrote to memory of 4048	868	cmd.exe	sc.exe
PID 868 wrote to memory of 4048	868	cmd.exe	sc.exe
PID 4440 wrote to memory of 516	4440	cmd.exe	sc.exe
PID 4440 wrote to memory of 516	4440	cmd.exe	sc.exe
PID 3856 wrote to memory of 4040	3856	cmd.exe	powershell.exe
PID 3856 wrote to memory of 4040	3856	cmd.exe	powershell.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe
PID 1028 wrote to memory of 4652	1028	7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
"C:\Users\Admin\AppData\Local\Temp\6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:3624

C:\Windows\system32\sc.exe
sc stop WinDefend
3⤵
- Launches sc.exe
PID:1384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc delete WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\system32\sc.exe
sc delete WinDefend
3⤵
- Launches sc.exe
PID:4368

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Users\Admin\AppData\Roaming\wnetwork\7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
C:\Users\Admin\AppData\Roaming\wnetwork\7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\system32\sc.exe
sc stop WinDefend
4⤵
- Launches sc.exe
PID:4048

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc delete WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\system32\sc.exe
sc delete WinDefend
4⤵
- Launches sc.exe
PID:516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Suspicious use of WriteProcessMemory
PID:3856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Disabling Security Tools

1

T1089

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2386679933-1492765628-3466841596-1000\0f5007522459c86e95ffcc62f32308f1_8329e3af-909b-464f-88cb-23d8b2c5eadf
Filesize
1KB

MD5
4865949c02bf4409338dd9f4a62d2b92

SHA1
0a9d718be45177a0a52575f66f8729876ffb8a16

SHA256
5506e7ec06b6cc8a07ec62afa38d33dbf2514dd7a09f90251aca90294fb49ef5

SHA512
a6a920d4176d711ef296e1580e9b59f9c24fa51e2c4df474569b36fbeebd2644061d243bf40208ac063a4d4fc797ff79aeb2d6825cbeef4e00dfac6756cd7105

Download Submit
C:\Users\Admin\AppData\Roaming\wnetwork\7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
Filesize
473KB

MD5
87bc1902b89ac09e8904fb77f997bf02

SHA1
7f193a3ca6f3e20e005d1890ccc30197ef5df1e0

SHA256
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f

SHA512
8fa91c61513b80fcb67ecc1640359db4c481013346f7ced0d79afa08bbd5621282f57e29fd8014e7f2f651cda68705874a2e22e9340d77bf7c77b531cb86fb8e

Download Submit
C:\Users\Admin\AppData\Roaming\wnetwork\7c70b3c8f89329a67feda888b52591368ecc3c978c6decaee091df9e6239fb8f.exe
Filesize
473KB

MD5
87bc1902b89ac09e8904fb77f997bf02

SHA1
7f193a3ca6f3e20e005d1890ccc30197ef5df1e0

SHA256
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f

SHA512
8fa91c61513b80fcb67ecc1640359db4c481013346f7ced0d79afa08bbd5621282f57e29fd8014e7f2f651cda68705874a2e22e9340d77bf7c77b531cb86fb8e

Download Submit
memory/440-139-0x00007FFAB1DA0000-0x00007FFAB2861000-memory.dmp

Filesize
10.8MB

Download
memory/440-140-0x00007FFAB1DA0000-0x00007FFAB2861000-memory.dmp

Filesize
10.8MB

Download
memory/440-137-0x0000000000000000-mapping.dmp

Download
memory/440-138-0x000002072F870000-0x000002072F892000-memory.dmp

Filesize
136KB

Download
memory/516-150-0x0000000000000000-mapping.dmp

Download
memory/868-146-0x0000000000000000-mapping.dmp

Download
memory/1028-168-0x00000000028F0000-0x000000000291B000-memory.dmp

Filesize
172KB

Download
memory/1028-159-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1028-142-0x0000000000000000-mapping.dmp

Download
memory/1028-157-0x00000000028F0000-0x000000000291B000-memory.dmp

Filesize
172KB

Download
memory/1384-136-0x0000000000000000-mapping.dmp

Download
memory/2672-145-0x00000000006D0000-0x00000000006FB000-memory.dmp

Filesize
172KB

Download
memory/2672-141-0x00000000006D0000-0x00000000006FB000-memory.dmp

Filesize
172KB

Download
memory/3608-133-0x0000000000000000-mapping.dmp

Download
memory/3624-132-0x0000000000000000-mapping.dmp

Download
memory/3640-134-0x0000000000000000-mapping.dmp

Download
memory/3856-148-0x0000000000000000-mapping.dmp

Download
memory/4040-151-0x0000000000000000-mapping.dmp

Download
memory/4040-154-0x00007FFAB1370000-0x00007FFAB1E31000-memory.dmp

Filesize
10.8MB

Download
memory/4040-156-0x00007FFAB1370000-0x00007FFAB1E31000-memory.dmp

Filesize
10.8MB

Download
memory/4048-149-0x0000000000000000-mapping.dmp

Download
memory/4368-135-0x0000000000000000-mapping.dmp

Download
memory/4440-147-0x0000000000000000-mapping.dmp

Download
memory/4652-162-0x0000000000000000-mapping.dmp

Download
memory/4652-164-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads