trickbot | 08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b

General

Target

08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe
Size

444KB
MD5

88fa0da5cb1ed84e577e0adff9a58f78
SHA1

a1f80a7aaa718f3a4aad3c91bc2bb0f08e173c4c
SHA256

08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b
SHA512

f7f5cba1c0a26057f3b09fa615dc5e4e5a3a09485f1ab594880138cf58bfdcfc4b803f36a3aa9d8372cdb83d9cf941b4acb4cbe68a6c56c29736a071a4d5a031
SSDEEP

6144:xnITDInkd0g0HHYAuWnMGde9fxNR08Qib:Zu2k2xnYMnMwe9JNR081

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 7 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1484-134-0x0000000004FA0000-0x0000000004FCB000-memory.dmp	trickbot_loader32
behavioral2/memory/1484-136-0x0000000004FA0000-0x0000000004FCB000-memory.dmp	trickbot_loader32
behavioral2/memory/1484-142-0x0000000004FA0000-0x0000000004FCB000-memory.dmp	trickbot_loader32
behavioral2/memory/4916-145-0x0000000004E60000-0x0000000004E8B000-memory.dmp	trickbot_loader32
behavioral2/memory/4916-156-0x0000000004E60000-0x0000000004E8B000-memory.dmp	trickbot_loader32
behavioral2/memory/2612-162-0x0000000002400000-0x000000000242B000-memory.dmp	trickbot_loader32
behavioral2/memory/2612-173-0x0000000002400000-0x000000000242B000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

pid	process
4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

description pid process

Token: SeTcbPrivilege 2612 09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

flow	ioc
36	api.ipify.org

description	pid	process
Token: SeTcbPrivilege	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

pid	process
1484	08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe
4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe

description	pid	process	target process
PID 1484 wrote to memory of 4916	1484	08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
PID 1484 wrote to memory of 4916	1484	08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
PID 1484 wrote to memory of 4916	1484	08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 4916 wrote to memory of 1100	4916	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe
PID 2612 wrote to memory of 1144	2612	09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe
"C:\Users\Admin\AppData\Local\Temp\08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484

C:\Users\Admin\AppData\Roaming\wnetwork\09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
C:\Users\Admin\AppData\Roaming\wnetwork\09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1100

C:\Users\Admin\AppData\Roaming\wnetwork\09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
C:\Users\Admin\AppData\Roaming\wnetwork\09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wnetwork\09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
Filesize
444KB

MD5
88fa0da5cb1ed84e577e0adff9a58f78

SHA1
a1f80a7aaa718f3a4aad3c91bc2bb0f08e173c4c

SHA256
08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b

SHA512
f7f5cba1c0a26057f3b09fa615dc5e4e5a3a09485f1ab594880138cf58bfdcfc4b803f36a3aa9d8372cdb83d9cf941b4acb4cbe68a6c56c29736a071a4d5a031

Download Submit
C:\Users\Admin\AppData\Roaming\wnetwork\09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
Filesize
444KB

MD5
88fa0da5cb1ed84e577e0adff9a58f78

SHA1
a1f80a7aaa718f3a4aad3c91bc2bb0f08e173c4c

SHA256
08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b

SHA512
f7f5cba1c0a26057f3b09fa615dc5e4e5a3a09485f1ab594880138cf58bfdcfc4b803f36a3aa9d8372cdb83d9cf941b4acb4cbe68a6c56c29736a071a4d5a031

Download Submit
C:\Users\Admin\AppData\Roaming\wnetwork\09da67775b095f30305037e069529a669993a5cb98c2bb231ee3dcf37657de8b.exe
Filesize
444KB

MD5
88fa0da5cb1ed84e577e0adff9a58f78

SHA1
a1f80a7aaa718f3a4aad3c91bc2bb0f08e173c4c

SHA256
08da56664b084f30304036e059428a558983a4cb87c2bb231ee3dcf36546de7b

SHA512
f7f5cba1c0a26057f3b09fa615dc5e4e5a3a09485f1ab594880138cf58bfdcfc4b803f36a3aa9d8372cdb83d9cf941b4acb4cbe68a6c56c29736a071a4d5a031

Download Submit
memory/1100-152-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1100-150-0x0000000000000000-mapping.dmp

Download
memory/1144-167-0x0000000000000000-mapping.dmp

Download
memory/1484-142-0x0000000004FA0000-0x0000000004FCB000-memory.dmp

Filesize
172KB

Download
memory/1484-134-0x0000000004FA0000-0x0000000004FCB000-memory.dmp

Filesize
172KB

Download
memory/1484-136-0x0000000004FA0000-0x0000000004FCB000-memory.dmp

Filesize
172KB

Download
memory/2612-162-0x0000000002400000-0x000000000242B000-memory.dmp

Filesize
172KB

Download
memory/2612-173-0x0000000002400000-0x000000000242B000-memory.dmp

Filesize
172KB

Download
memory/4916-137-0x0000000000000000-mapping.dmp

Download
memory/4916-145-0x0000000004E60000-0x0000000004E8B000-memory.dmp

Filesize
172KB

Download
memory/4916-147-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4916-156-0x0000000004E60000-0x0000000004E8B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads