trickbot | 7a5d773aa6ef4cf71a18234e4037788e635a3f8aeefef0e9898d69453bc53025

Resubmissions

28-12-2022 03:05

20-12-2022 19:37

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 19:37

Target

client/gpuhealth/syrecrt.exe
Size

636KB
MD5

b1ee1b5bcf9081a4556c9eca8ddee08b
SHA1

44ce0ffaa7e00619041d5c6a55b333cd68b34e9f
SHA256

7f35814a168b322a70dde6653134deed0771ae69860e1dcb3b464237c327357b
SHA512

cd56bbc7039cdba69ba475a9011511425cbe63d3ba6f59aa569c8a96089ee0df0a54b0b789be43d4d1af66c1b21d3d1c191240a40dc3692f39eebbd3be6a4a56
SSDEEP

6144:FsD8AG8s0dYIeyIJqteVmdVYk9Lx9WjVLDVElBik2RSRmf/XPXtPiMN7vTBAHn9:WP40drYqMmdVdpx9qylokuSRmf/XwMtc

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral11/memory/1808-57-0x0000000000290000-0x00000000002C1000-memory.dmp	trickbot_loader32
behavioral11/memory/1808-59-0x0000000000290000-0x00000000002C1000-memory.dmp	trickbot_loader32
behavioral11/memory/1808-61-0x0000000000290000-0x00000000002C1000-memory.dmp	trickbot_loader32

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

syrecrt.exe

pid process

1808 syrecrt.exe
1808 syrecrt.exe

pid	process
1808	syrecrt.exe
1808	syrecrt.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

syrecrt.exe

description	pid	process	target process
PID 1808 wrote to memory of 1696	1808	syrecrt.exe	svchost.exe
PID 1808 wrote to memory of 1696	1808	syrecrt.exe	svchost.exe
PID 1808 wrote to memory of 1696	1808	syrecrt.exe	svchost.exe
PID 1808 wrote to memory of 1696	1808	syrecrt.exe	svchost.exe
PID 1808 wrote to memory of 1696	1808	syrecrt.exe	svchost.exe
PID 1808 wrote to memory of 1696	1808	syrecrt.exe	svchost.exe

memory/1696-60-0x0000000000000000-mapping.dmp

Download
memory/1696-62-0x0000000000100000-0x0000000000122000-memory.dmp

Filesize
136KB

Download
memory/1808-57-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/1808-58-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1808-59-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/1808-61-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download