trickbot | ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991

General

Target

ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe
Size

182KB
MD5

04124510fa8f2b45e7806a2c6f2a6b4d
SHA1

f7fb417da3e9b99a35a80cabbf338f920fa9bd40
SHA256

ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991
SHA512

381d12bf8ef63c96479e7fc9aac98697ece9c42090c28375623c7177e80ebb77f860f01fe4db4f632f30f52987fc1692824db4f38770f233277bd349262f0f22
SSDEEP

3072:yEbovWzHG9tdp7y6E2GCnf/dHhtMoD3l8i45d7zzbDmC5dV8M6BTMz5sWq:7OdpW2ZfF0oJ8i47zzPTdV8LJmo

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1976-55-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32
behavioral1/memory/1976-57-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32
behavioral1/memory/1992-64-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32
behavioral1/memory/1992-66-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe

pid process

1992 ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 2012 svchost.exe

pid	process
1992	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe

description	pid	process
Token: SeTcbPrivilege	2012	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exetaskeng.exeae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe

description	pid	process	target process
PID 1976 wrote to memory of 1524	1976	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 1976 wrote to memory of 1524	1976	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 1976 wrote to memory of 1524	1976	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 1976 wrote to memory of 1524	1976	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 1976 wrote to memory of 1524	1976	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 1976 wrote to memory of 1524	1976	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 1148 wrote to memory of 1992	1148	taskeng.exe	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
PID 1148 wrote to memory of 1992	1148	taskeng.exe	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
PID 1148 wrote to memory of 1992	1148	taskeng.exe	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
PID 1148 wrote to memory of 1992	1148	taskeng.exe	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
PID 1992 wrote to memory of 2012	1992	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 1992 wrote to memory of 2012	1992	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 1992 wrote to memory of 2012	1992	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 1992 wrote to memory of 2012	1992	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 1992 wrote to memory of 2012	1992	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 1992 wrote to memory of 2012	1992	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe
"C:\Users\Admin\AppData\Local\Temp\ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1524

C:\Windows\system32\taskeng.exe
taskeng.exe {BC5001AD-0C6E-4FD3-8033-91A890EAFC5E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
Filesize
182KB

MD5
04124510fa8f2b45e7806a2c6f2a6b4d

SHA1
f7fb417da3e9b99a35a80cabbf338f920fa9bd40

SHA256
ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991

SHA512
381d12bf8ef63c96479e7fc9aac98697ece9c42090c28375623c7177e80ebb77f860f01fe4db4f632f30f52987fc1692824db4f38770f233277bd349262f0f22

Download Submit
C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
Filesize
182KB

MD5
04124510fa8f2b45e7806a2c6f2a6b4d

SHA1
f7fb417da3e9b99a35a80cabbf338f920fa9bd40

SHA256
ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991

SHA512
381d12bf8ef63c96479e7fc9aac98697ece9c42090c28375623c7177e80ebb77f860f01fe4db4f632f30f52987fc1692824db4f38770f233277bd349262f0f22

Download Submit
memory/1524-59-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1524-56-0x0000000000000000-mapping.dmp

Download
memory/1524-58-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/1976-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1976-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1992-61-0x0000000000000000-mapping.dmp

Download
memory/1992-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1992-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1992-67-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/2012-65-0x0000000000000000-mapping.dmp

Download
memory/2012-68-0x00000000000E0000-0x0000000000100000-memory.dmp

Filesize
128KB

Download
memory/2012-69-0x00000000000E0000-0x0000000000100000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing