trickbot | c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 16:27

Target

c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe
Size

300KB
MD5

e1d6ff39a5c4388044f4e8b40ff53e1c
SHA1

4b85c7f501ccba7a564f7d78d05620c034595832
SHA256

c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b
SHA512

80ce564cf165f14c917c59222b9a23a998716941f8753c4d0194739d299572ccc1037ef6a0b71e32f08fde470d6117b3081b99c7c71eb7b4bdf4cbb677445567
SSDEEP

6144:lnx9RtQLCgTCK44RFSrIPcLLCLohzSE8v6ejjFI0Pl/DG1V9sbPeC3YU+d6IUg:lcPcvlp/ejRd1WbiTIdw

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1028-55-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral1/memory/1028-56-0x0000000000460000-0x000000000048B000-memory.dmp	trickbot_loader32
behavioral1/memory/1028-57-0x0000000000460000-0x000000000048B000-memory.dmp	trickbot_loader32

C:\Users\Admin\AppData\Local\Temp\c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe
"C:\Users\Admin\AppData\Local\Temp\c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe"
1⤵
PID:1028

memory/1028-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1028-55-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1028-56-0x0000000000460000-0x000000000048B000-memory.dmp

Filesize
172KB

Download
memory/1028-57-0x0000000000460000-0x000000000048B000-memory.dmp

Filesize
172KB

Download