trickbot | 7a5d773aa6ef4cf71a18234e4037788e635a3f8aeefef0e9898d69453bc53025

Resubmissions

28-12-2022 03:05

221228-dk91fahc93 10

20-12-2022 19:37

221220-ycbswsea2x 10

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2022 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client/gpuhealth/GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
Size

524KB
MD5

8c9749ce27426c38f68f21f3dcf71b68
SHA1

68852ef36597d732c721b990328f0fc4d2d5e48a
SHA256

37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b
SHA512

d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb
SSDEEP

12288:aY+PntopVydpBB9H4dJX5az1et14MHB8e:b+15pBB9oazg6MH

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral12/memory/3708-135-0x00000000022C0000-0x00000000022F1000-memory.dmp	trickbot_loader32
behavioral12/memory/3708-136-0x0000000002290000-0x00000000022C0000-memory.dmp	trickbot_loader32
behavioral12/memory/3708-137-0x00000000022C1000-0x00000000022F1000-memory.dmp	trickbot_loader32
behavioral12/memory/3708-139-0x00000000022C1000-0x00000000022F1000-memory.dmp	trickbot_loader32
behavioral12/memory/816-145-0x0000000000E61000-0x0000000000E91000-memory.dmp	trickbot_loader32
behavioral12/memory/816-147-0x0000000000E61000-0x0000000000E91000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exeGƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

pid	process
3708	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
816	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 1412 svchost.exe

description	pid	process
Token: SeTcbPrivilege	1412	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exeIƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exeGƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

pid	process
2260	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
3708	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
816	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

description	pid	process	target process
PID 2260 wrote to memory of 3708	2260	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
PID 2260 wrote to memory of 3708	2260	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
PID 2260 wrote to memory of 3708	2260	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
PID 3708 wrote to memory of 4908	3708	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 3708 wrote to memory of 4908	3708	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 3708 wrote to memory of 4908	3708	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 3708 wrote to memory of 4908	3708	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 816 wrote to memory of 1412	816	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe
PID 816 wrote to memory of 1412	816	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe
PID 816 wrote to memory of 1412	816	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe
PID 816 wrote to memory of 1412	816	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\client\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
"C:\Users\Admin\AppData\Local\Temp\client\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260

C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
"C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4908

C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
"C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
memory/816-148-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/816-147-0x0000000000E61000-0x0000000000E91000-memory.dmp

Filesize
192KB

Download
memory/816-145-0x0000000000E61000-0x0000000000E91000-memory.dmp

Filesize
192KB

Download
memory/1412-149-0x00000274E7500000-0x00000274E7522000-memory.dmp

Filesize
136KB

Download
memory/1412-146-0x0000000000000000-mapping.dmp

Download
memory/3708-136-0x0000000002290000-0x00000000022C0000-memory.dmp

Filesize
192KB

Download
memory/3708-139-0x00000000022C1000-0x00000000022F1000-memory.dmp

Filesize
192KB

Download
memory/3708-137-0x00000000022C1000-0x00000000022F1000-memory.dmp

Filesize
192KB

Download
memory/3708-132-0x0000000000000000-mapping.dmp

Download
memory/3708-135-0x00000000022C0000-0x00000000022F1000-memory.dmp

Filesize
196KB

Download
memory/4908-141-0x000001EF6C990000-0x000001EF6C9B2000-memory.dmp

Filesize
136KB

Download
memory/4908-140-0x000001EF6C990000-0x000001EF6C9B2000-memory.dmp

Filesize
136KB

Download
memory/4908-138-0x0000000000000000-mapping.dmp

Download