trickbot | c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b

General

Target

c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe
Size

300KB
MD5

e1d6ff39a5c4388044f4e8b40ff53e1c
SHA1

4b85c7f501ccba7a564f7d78d05620c034595832
SHA256

c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b
SHA512

80ce564cf165f14c917c59222b9a23a998716941f8753c4d0194739d299572ccc1037ef6a0b71e32f08fde470d6117b3081b99c7c71eb7b4bdf4cbb677445567
SSDEEP

6144:lnx9RtQLCgTCK44RFSrIPcLLCLohzSE8v6ejjFI0Pl/DG1V9sbPeC3YU+d6IUg:lcPcvlp/ejRd1WbiTIdw

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 14 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1656-132-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/1656-133-0x00000000001D0000-0x00000000001FB000-memory.dmp	trickbot_loader32
behavioral2/memory/1656-134-0x00000000001D0000-0x00000000001FB000-memory.dmp	trickbot_loader32
behavioral2/memory/1656-138-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/1656-139-0x00000000001D0000-0x00000000001FB000-memory.dmp	trickbot_loader32
behavioral2/memory/4532-141-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/4532-142-0x00000000006D0000-0x00000000006FB000-memory.dmp	trickbot_loader32
behavioral2/memory/4532-153-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/4532-154-0x00000000006D0000-0x00000000006FB000-memory.dmp	trickbot_loader32
behavioral2/memory/4528-157-0x0000000001380000-0x00000000013AB000-memory.dmp	trickbot_loader32
behavioral2/memory/4528-158-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/4528-159-0x0000000001380000-0x00000000013AB000-memory.dmp	trickbot_loader32
behavioral2/memory/4528-170-0x0000000000400000-0x000000000045F000-memory.dmp	trickbot_loader32
behavioral2/memory/4528-171-0x0000000001380000-0x00000000013AB000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exec887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

pid	process
4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

Drops file in System32 directory 1 IoCs

Processes:

c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\VBDsqz.xcf c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

description pid process

Token: SeTcbPrivilege 4528 c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\VBDsqz.xcf	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

description	pid	process
Token: SeTcbPrivilege	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exec887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exec887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe

description	pid	process	target process
PID 1656 wrote to memory of 4532	1656	c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
PID 1656 wrote to memory of 4532	1656	c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
PID 1656 wrote to memory of 4532	1656	c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4532 wrote to memory of 2280	4532	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe
PID 4528 wrote to memory of 3708	4528	c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe
"C:\Users\Admin\AppData\Local\Temp\c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Roaming\winnet\c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
C:\Users\Admin\AppData\Roaming\winnet\c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2280

C:\Users\Admin\AppData\Roaming\winnet\c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
C:\Users\Admin\AppData\Roaming\winnet\c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4246620582-653642754-1174164128-1000\0f5007522459c86e95ffcc62f32308f1_26355f79-4f6c-4ae9-abeb-84bfcbb996ec
Filesize
1KB

MD5
608ce6d14243c637c92e078a876464f9

SHA1
70d07a44ce9c3c683f8abdb41a612879810c4dae

SHA256
69ffe3ea2239d01f97fa514889ae9ba52fde950f7bf2b52e4f9fbd7bdf684773

SHA512
1016cd2b8930210750cdb764590650c5880ab4d8ba7124cf8a61ba46777c0c7bb8fbc6b8b6765aa4362c411b7a948c9e4896c358ab56947f33fe978751213c68

Download Submit
C:\Users\Admin\AppData\Roaming\winnet\c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
Filesize
300KB

MD5
e1d6ff39a5c4388044f4e8b40ff53e1c

SHA1
4b85c7f501ccba7a564f7d78d05620c034595832

SHA256
c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b

SHA512
80ce564cf165f14c917c59222b9a23a998716941f8753c4d0194739d299572ccc1037ef6a0b71e32f08fde470d6117b3081b99c7c71eb7b4bdf4cbb677445567

Download Submit
C:\Users\Admin\AppData\Roaming\winnet\c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
Filesize
300KB

MD5
e1d6ff39a5c4388044f4e8b40ff53e1c

SHA1
4b85c7f501ccba7a564f7d78d05620c034595832

SHA256
c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b

SHA512
80ce564cf165f14c917c59222b9a23a998716941f8753c4d0194739d299572ccc1037ef6a0b71e32f08fde470d6117b3081b99c7c71eb7b4bdf4cbb677445567

Download Submit
C:\Users\Admin\AppData\Roaming\winnet\c887b12d0ffc09ce8e988fef78890f2de70f23988897291c6d8a625c06a92d6b.exe
Filesize
300KB

MD5
e1d6ff39a5c4388044f4e8b40ff53e1c

SHA1
4b85c7f501ccba7a564f7d78d05620c034595832

SHA256
c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b

SHA512
80ce564cf165f14c917c59222b9a23a998716941f8753c4d0194739d299572ccc1037ef6a0b71e32f08fde470d6117b3081b99c7c71eb7b4bdf4cbb677445567

Download Submit
memory/1656-132-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1656-133-0x00000000001D0000-0x00000000001FB000-memory.dmp

Filesize
172KB

Download
memory/1656-134-0x00000000001D0000-0x00000000001FB000-memory.dmp

Filesize
172KB

Download
memory/1656-138-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1656-139-0x00000000001D0000-0x00000000001FB000-memory.dmp

Filesize
172KB

Download
memory/2280-147-0x0000000000000000-mapping.dmp

Download
memory/2280-149-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3708-164-0x0000000000000000-mapping.dmp

Download
memory/4528-158-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4528-156-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4528-157-0x0000000001380000-0x00000000013AB000-memory.dmp

Filesize
172KB

Download
memory/4528-159-0x0000000001380000-0x00000000013AB000-memory.dmp

Filesize
172KB

Download
memory/4528-170-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4528-171-0x0000000001380000-0x00000000013AB000-memory.dmp

Filesize
172KB

Download
memory/4532-141-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4532-153-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4532-154-0x00000000006D0000-0x00000000006FB000-memory.dmp

Filesize
172KB

Download
memory/4532-135-0x0000000000000000-mapping.dmp

Download
memory/4532-142-0x00000000006D0000-0x00000000006FB000-memory.dmp

Filesize
172KB

Download
memory/4532-144-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads