trickbot | ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991

Analysis

max time kernel
188s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe
Size

182KB
MD5

04124510fa8f2b45e7806a2c6f2a6b4d
SHA1

f7fb417da3e9b99a35a80cabbf338f920fa9bd40
SHA256

ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991
SHA512

381d12bf8ef63c96479e7fc9aac98697ece9c42090c28375623c7177e80ebb77f860f01fe4db4f632f30f52987fc1692824db4f38770f233277bd349262f0f22
SSDEEP

3072:yEbovWzHG9tdp7y6E2GCnf/dHhtMoD3l8i45d7zzbDmC5dV8M6BTMz5sWq:7OdpW2ZfF0oJ8i47zzPTdV8LJmo

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/4980-132-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32
behavioral2/memory/4980-134-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32
behavioral2/memory/3964-138-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32
behavioral2/memory/3964-141-0x0000000000400000-0x0000000000430000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe

pid process

3964 ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 2624 svchost.exe

pid	process
3964	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe

description	pid	process
Token: SeTcbPrivilege	2624	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exeae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe

description	pid	process	target process
PID 4980 wrote to memory of 4696	4980	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 4980 wrote to memory of 4696	4980	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 4980 wrote to memory of 4696	4980	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 4980 wrote to memory of 4696	4980	ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe	svchost.exe
PID 3964 wrote to memory of 2624	3964	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 3964 wrote to memory of 2624	3964	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 3964 wrote to memory of 2624	3964	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe
PID 3964 wrote to memory of 2624	3964	ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe
"C:\Users\Admin\AppData\Local\Temp\ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:4696

C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
Filesize
182KB

MD5
04124510fa8f2b45e7806a2c6f2a6b4d

SHA1
f7fb417da3e9b99a35a80cabbf338f920fa9bd40

SHA256
ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991

SHA512
381d12bf8ef63c96479e7fc9aac98697ece9c42090c28375623c7177e80ebb77f860f01fe4db4f632f30f52987fc1692824db4f38770f233277bd349262f0f22

Download Submit
C:\Users\Admin\AppData\Roaming\cmdcache\ae387ed8ce882bf9279d4b790cebaa0f944010ecd080f7f397c128990cf98991.exe
Filesize
182KB

MD5
04124510fa8f2b45e7806a2c6f2a6b4d

SHA1
f7fb417da3e9b99a35a80cabbf338f920fa9bd40

SHA256
ae365ed6ce662bf7259d4b590cebaa0f944010ecd060f5f375c128970cf78991

SHA512
381d12bf8ef63c96479e7fc9aac98697ece9c42090c28375623c7177e80ebb77f860f01fe4db4f632f30f52987fc1692824db4f38770f233277bd349262f0f22

Download Submit
memory/2624-144-0x000001C2B3050000-0x000001C2B3070000-memory.dmp

Filesize
128KB

Download
memory/2624-143-0x000001C2B3050000-0x000001C2B3070000-memory.dmp

Filesize
128KB

Download
memory/2624-140-0x0000000000000000-mapping.dmp

Download
memory/3964-141-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3964-138-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3964-142-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/4696-136-0x0000028B00160000-0x0000028B00180000-memory.dmp

Filesize
128KB

Download
memory/4696-135-0x0000028B00160000-0x0000028B00180000-memory.dmp

Filesize
128KB

Download
memory/4696-133-0x0000000000000000-mapping.dmp

Download
memory/4980-132-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4980-134-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download