trickbot | 1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534

General

Target

1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe
Size

299KB
MD5

fa04235f2c1acd6e551ec5ffecdcf71b
SHA1

3b7d78b3cf06f6b0caa20b7b8ae9dc395548a723
SHA256

1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534
SHA512

6d1ee393551222413f3f07252ef7201b51047ef4b76dd8cdc74e2477e3be784dd2866d17da2481c79945b9bb9574bf2a4a6a923c43d9cb4432dd6a814cf73c67
SSDEEP

6144:HAemIDCLNJHnjIxTjJHfn0lkQGCXtZnALh7pBuc:g6KExT98lRXw7pB

Score

10^/10

trickbot lib314 banker evasion trojan

Malware Config

Extracted

Family

trickbot

Version

1000263

Botnet

lib314

C2

118.97.119.218:449

94.181.47.198:449

144.121.143.129:449

185.200.60.138:449

185.42.52.126:449

181.174.112.74:449

178.116.83.49:443

121.58.242.206:449

182.50.64.148:449

82.222.40.119:449

97.78.222.18:449

67.79.15.106:449

168.167.87.79:443

103.111.53.126:449

182.253.20.66:449

192.188.120.164:443

81.17.86.112:443

95.154.80.154:449

46.149.182.112:449

69.9.232.167:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/996-66-0x00000000004A0000-0x00000000004DD000-memory.dmp	trickbot_loader32
behavioral1/memory/1340-83-0x00000000004A0000-0x00000000004DD000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe

pid process

1340 1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe

Loads dropped DLL 2 IoCs

Processes:

1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe

pid	process
996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe
996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

1976 sc.exe
2040 sc.exe

pid	process
1976	sc.exe
2040	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exepowershell.exe

pid	process
996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe
996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe
996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe
1764	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1764 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1764	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.execmd.execmd.execmd.exe1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe

description	pid	process	target process
PID 996 wrote to memory of 1520	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1520	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1520	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1520	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1584	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1584	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1584	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1584	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1436	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1436	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1436	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1436	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	cmd.exe
PID 996 wrote to memory of 1340	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
PID 996 wrote to memory of 1340	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
PID 996 wrote to memory of 1340	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
PID 996 wrote to memory of 1340	996	1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
PID 1436 wrote to memory of 1764	1436	cmd.exe	powershell.exe
PID 1436 wrote to memory of 1764	1436	cmd.exe	powershell.exe
PID 1436 wrote to memory of 1764	1436	cmd.exe	powershell.exe
PID 1436 wrote to memory of 1764	1436	cmd.exe	powershell.exe
PID 1520 wrote to memory of 1976	1520	cmd.exe	sc.exe
PID 1520 wrote to memory of 1976	1520	cmd.exe	sc.exe
PID 1520 wrote to memory of 1976	1520	cmd.exe	sc.exe
PID 1520 wrote to memory of 1976	1520	cmd.exe	sc.exe
PID 1584 wrote to memory of 2040	1584	cmd.exe	sc.exe
PID 1584 wrote to memory of 2040	1584	cmd.exe	sc.exe
PID 1584 wrote to memory of 2040	1584	cmd.exe	sc.exe
PID 1584 wrote to memory of 2040	1584	cmd.exe	sc.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe
PID 1340 wrote to memory of 960	1340	1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe
"C:\Users\Admin\AppData\Local\Temp\1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
3⤵
- Launches sc.exe
PID:1976

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
3⤵
- Launches sc.exe
PID:2040

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Users\Admin\AppData\Roaming\mssert\1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
C:\Users\Admin\AppData\Roaming\mssert\1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:960

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3845472200-3839195424-595303356-1000\0f5007522459c86e95ffcc62f32308f1_7725c12a-7257-458e-a47f-7029d9191548
Filesize
1KB

MD5
297e68e7674dcf66894f1f52eecd6386

SHA1
42746dab2d30ad372ff44e761375089426abf404

SHA256
f5cac881338e57209f8b60d8e19459655b3129835ffc482011495e32bf93e578

SHA512
25318bb927fdf70734cf41a3436fdf5644a2009e8941e0e3b28db8f18c9f81522871d11191e80476a75e426187646f6cc5350d0e3cf1ee81d0db05dc9e959874

Download Submit
C:\Users\Admin\AppData\Roaming\mssert\1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
Filesize
299KB

MD5
fa04235f2c1acd6e551ec5ffecdcf71b

SHA1
3b7d78b3cf06f6b0caa20b7b8ae9dc395548a723

SHA256
1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534

SHA512
6d1ee393551222413f3f07252ef7201b51047ef4b76dd8cdc74e2477e3be784dd2866d17da2481c79945b9bb9574bf2a4a6a923c43d9cb4432dd6a814cf73c67

Download Submit
\Users\Admin\AppData\Roaming\mssert\1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
Filesize
299KB

MD5
fa04235f2c1acd6e551ec5ffecdcf71b

SHA1
3b7d78b3cf06f6b0caa20b7b8ae9dc395548a723

SHA256
1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534

SHA512
6d1ee393551222413f3f07252ef7201b51047ef4b76dd8cdc74e2477e3be784dd2866d17da2481c79945b9bb9574bf2a4a6a923c43d9cb4432dd6a814cf73c67

Download Submit
\Users\Admin\AppData\Roaming\mssert\1e1cd9e03241b216e26e403ad23c6db784188c677ebd99ff776a1ec214f8e634.exe
Filesize
299KB

MD5
fa04235f2c1acd6e551ec5ffecdcf71b

SHA1
3b7d78b3cf06f6b0caa20b7b8ae9dc395548a723

SHA256
1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534

SHA512
6d1ee393551222413f3f07252ef7201b51047ef4b76dd8cdc74e2477e3be784dd2866d17da2481c79945b9bb9574bf2a4a6a923c43d9cb4432dd6a814cf73c67

Download Submit
memory/960-74-0x0000000000000000-mapping.dmp

Download
memory/960-76-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/996-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/996-66-0x00000000004A0000-0x00000000004DD000-memory.dmp

Filesize
244KB

Download
memory/1340-83-0x00000000004A0000-0x00000000004DD000-memory.dmp

Filesize
244KB

Download
memory/1340-71-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1340-60-0x0000000000000000-mapping.dmp

Download
memory/1436-57-0x0000000000000000-mapping.dmp

Download
memory/1520-55-0x0000000000000000-mapping.dmp

Download
memory/1584-56-0x0000000000000000-mapping.dmp

Download
memory/1764-62-0x0000000000000000-mapping.dmp

Download
memory/1764-67-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1764-82-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-63-0x0000000000000000-mapping.dmp

Download
memory/2040-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads