trickbot | 7a5d773aa6ef4cf71a18234e4037788e635a3f8aeefef0e9898d69453bc53025

Resubmissions

28-12-2022 03:05

221228-dk91fahc93 10

20-12-2022 19:37

221220-ycbswsea2x 10

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2022 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client/2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe
Size

524KB
MD5

8c9749ce27426c38f68f21f3dcf71b68
SHA1

68852ef36597d732c721b990328f0fc4d2d5e48a
SHA256

37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b
SHA512

d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb
SSDEEP

12288:aY+PntopVydpBB9H4dJX5az1et14MHB8e:b+15pBB9oazg6MH

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral4/memory/2116-135-0x0000000002630000-0x0000000002661000-memory.dmp	trickbot_loader32
behavioral4/memory/2116-136-0x00000000022B0000-0x00000000022E0000-memory.dmp	trickbot_loader32
behavioral4/memory/2116-137-0x0000000002631000-0x0000000002661000-memory.dmp	trickbot_loader32
behavioral4/memory/2116-139-0x0000000002631000-0x0000000002661000-memory.dmp	trickbot_loader32
behavioral4/memory/1200-145-0x0000000000E21000-0x0000000000E51000-memory.dmp	trickbot_loader32
behavioral4/memory/1200-147-0x0000000000E21000-0x0000000000E51000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exeGƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

pid	process
2116	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
1200	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 3088 svchost.exe

description	pid	process
Token: SeTcbPrivilege	3088	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exeIƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exeGƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

pid	process
4280	2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe
2116	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
1200	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

description	pid	process	target process
PID 4280 wrote to memory of 2116	4280	2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
PID 4280 wrote to memory of 2116	4280	2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
PID 4280 wrote to memory of 2116	4280	2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
PID 2116 wrote to memory of 2220	2116	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 2116 wrote to memory of 2220	2116	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 2116 wrote to memory of 2220	2116	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 2116 wrote to memory of 2220	2116	IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe	svchost.exe
PID 1200 wrote to memory of 3088	1200	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe
PID 1200 wrote to memory of 3088	1200	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe
PID 1200 wrote to memory of 3088	1200	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe
PID 1200 wrote to memory of 3088	1200	GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\client\2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe
"C:\Users\Admin\AppData\Local\Temp\client\2020-01-14-Trickbot-gtag-mor75-retrieved-by-Emotet-infected-host.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280

C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
"C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2220

C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
"C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
C:\ProgramData\IƆCCMX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв005645C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
C:\Users\Admin\AppData\Roaming\gpuhealth\GƆCCKX ↀↂ;;;;;;;;;;;;;;;;;;;ж;;;;;;;;;;;яЫФЦйвЫФв003423C.exe
Filesize
524KB

MD5
8c9749ce27426c38f68f21f3dcf71b68

SHA1
68852ef36597d732c721b990328f0fc4d2d5e48a

SHA256
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b

SHA512
d7d5c3909ddf45f22a267dab3db9908c8e29d931f51910b5bad0025db49b1f394de5ea6662480797a9eb808a832e6ae3ca7cff319ec407f57a624ad636c65efb

Download Submit
memory/1200-148-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/1200-147-0x0000000000E21000-0x0000000000E51000-memory.dmp

Filesize
192KB

Download
memory/1200-145-0x0000000000E21000-0x0000000000E51000-memory.dmp

Filesize
192KB

Download
memory/2116-136-0x00000000022B0000-0x00000000022E0000-memory.dmp

Filesize
192KB

Download
memory/2116-139-0x0000000002631000-0x0000000002661000-memory.dmp

Filesize
192KB

Download
memory/2116-137-0x0000000002631000-0x0000000002661000-memory.dmp

Filesize
192KB

Download
memory/2116-132-0x0000000000000000-mapping.dmp

Download
memory/2116-135-0x0000000002630000-0x0000000002661000-memory.dmp

Filesize
196KB

Download
memory/2220-140-0x000001D7B1010000-0x000001D7B1032000-memory.dmp

Filesize
136KB

Download
memory/2220-141-0x000001D7B1010000-0x000001D7B1032000-memory.dmp

Filesize
136KB

Download
memory/2220-138-0x0000000000000000-mapping.dmp

Download
memory/3088-146-0x0000000000000000-mapping.dmp

Download
memory/3088-149-0x000001EA6C380000-0x000001EA6C3A2000-memory.dmp

Filesize
136KB

Download
memory/3088-150-0x000001EA6C380000-0x000001EA6C3A2000-memory.dmp

Filesize
136KB

Download