trickbot | 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe

General

Target

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe
Size

504KB
MD5

a379f491b8da10b9c3ae56c96aaa53f9
SHA1

408f4d2ba1f36528345420922bca21c1ddfbde72
SHA256

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
SHA512

e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715
SSDEEP

6144:MHjoPGLwAy0nHjoPGLwEtiqs4iPuvJS1NHCDf/qZOPS893cQmU/lNU:0joelTjoeSWJSziDf/qY6g3cINU

Score

10^/10

trickbot jim321 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000270

Botnet

jim321

C2

154.16.137.73:443

94.181.47.198:449

81.21.121.138:449

23.94.41.215:443

181.113.17.230:449

212.23.70.149:443

54.37.134.207:443

170.81.32.66:449

42.115.91.177:443

107.173.102.231:443

121.58.242.206:449

167.114.13.91:443

192.252.209.44:443

182.50.64.148:449

187.190.249.230:443

107.175.127.147:443

82.222.40.119:449

198.100.157.163:443

23.226.138.169:443

103.110.91.118:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1156-134-0x0000000002260000-0x000000000229D000-memory.dmp	trickbot_loader32
behavioral2/memory/1436-156-0x0000000002170000-0x00000000021AD000-memory.dmp	trickbot_loader32
behavioral2/memory/1156-155-0x0000000002260000-0x000000000229D000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe

pid process

1436 1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe

pid	process
1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMT\\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 checkip.amazonaws.com

flow	ioc
43	checkip.amazonaws.com

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe

pid	process
1156	1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe
1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe

description	pid	process	target process
PID 1156 wrote to memory of 1436	1156	1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe
PID 1156 wrote to memory of 1436	1156	1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe
PID 1156 wrote to memory of 1436	1156	1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe
PID 1436 wrote to memory of 2020	1436	1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe
"C:\Users\Admin\AppData\Local\Temp\1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe
C:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe
Filesize
504KB

MD5
a379f491b8da10b9c3ae56c96aaa53f9

SHA1
408f4d2ba1f36528345420922bca21c1ddfbde72

SHA256
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe

SHA512
e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715

Download Submit
C:\Users\Admin\AppData\Roaming\AIMT\1960caf9fe66cb202bf6bae0b7a426b2b04043681426efff9ad90688d11e3afe.exe
Filesize
504KB

MD5
a379f491b8da10b9c3ae56c96aaa53f9

SHA1
408f4d2ba1f36528345420922bca21c1ddfbde72

SHA256
1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe

SHA512
e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715

Download Submit
memory/1156-134-0x0000000002260000-0x000000000229D000-memory.dmp

Filesize
244KB

Download
memory/1156-155-0x0000000002260000-0x000000000229D000-memory.dmp

Filesize
244KB

Download
memory/1436-136-0x0000000000000000-mapping.dmp

Download
memory/1436-144-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1436-156-0x0000000002170000-0x00000000021AD000-memory.dmp

Filesize
244KB

Download
memory/2020-147-0x0000000000000000-mapping.dmp

Download
memory/2020-149-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads