trickbot | 70c26692569194f464cbcd7adb9a1768eae8b691c05d31e40bbe256d026ab65e

General

Target

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe
Size

368KB
MD5

8402ab33eafb84178069f8f490ca604d
SHA1

516c7a538e93f7cf4bff29196511f94e5fbb5a40
SHA256

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172
SHA512

ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97
SSDEEP

6144:jo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:jmSuOcHmnYhrDMTrban4qM

Score

10^/10

trickbot banker evasion trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 3 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1116-59-0x0000000000150000-0x0000000000179000-memory.dmp	trickbot_loader32
behavioral1/memory/1040-66-0x0000000000190000-0x00000000001B9000-memory.dmp	trickbot_loader32
behavioral1/memory/1040-74-0x0000000000190000-0x00000000001B9000-memory.dmp	trickbot_loader32

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 1 IoCs

Processes:

b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

pid process

1040 b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
Loads dropped DLL 1 IoCs

Processes:

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe

pid process

1116 b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe

pid	process
1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1652 sc.exe
520 sc.exe
1984 sc.exe
1776 sc.exe

pid	process
1652	sc.exe
520	sc.exe
1984	sc.exe
1776	sc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exeb8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exepowershell.exepowershell.exe

pid	process
1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe
1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe
1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe
1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
1492	powershell.exe
1716	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1492 powershell.exe
Token: SeDebugPrivilege 1716 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.execmd.execmd.execmd.exeb8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.execmd.exe

description	pid	process	target process
PID 1116 wrote to memory of 1904	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1904	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1904	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1904	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 2004	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 2004	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 2004	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 2004	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1680	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1680	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1680	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1680	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	cmd.exe
PID 1116 wrote to memory of 1040	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
PID 1116 wrote to memory of 1040	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
PID 1116 wrote to memory of 1040	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
PID 1116 wrote to memory of 1040	1116	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
PID 2004 wrote to memory of 520	2004	cmd.exe	sc.exe
PID 2004 wrote to memory of 520	2004	cmd.exe	sc.exe
PID 2004 wrote to memory of 520	2004	cmd.exe	sc.exe
PID 2004 wrote to memory of 520	2004	cmd.exe	sc.exe
PID 1904 wrote to memory of 1652	1904	cmd.exe	sc.exe
PID 1904 wrote to memory of 1652	1904	cmd.exe	sc.exe
PID 1904 wrote to memory of 1652	1904	cmd.exe	sc.exe
PID 1904 wrote to memory of 1652	1904	cmd.exe	sc.exe
PID 1680 wrote to memory of 1716	1680	cmd.exe	powershell.exe
PID 1680 wrote to memory of 1716	1680	cmd.exe	powershell.exe
PID 1680 wrote to memory of 1716	1680	cmd.exe	powershell.exe
PID 1680 wrote to memory of 1716	1680	cmd.exe	powershell.exe
PID 1040 wrote to memory of 1704	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1704	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1704	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1704	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1672	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1672	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1672	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1672	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1748	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1748	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1748	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 1748	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	cmd.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1040 wrote to memory of 2036	1040	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 1748 wrote to memory of 1492	1748	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe
"C:\Users\Admin\AppData\Local\Temp\b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
3⤵
- Launches sc.exe
PID:1652

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
3⤵
- Launches sc.exe
PID:520

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
3⤵
PID:1704

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
4⤵
- Launches sc.exe
PID:1776

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
3⤵
PID:1672

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
4⤵
- Launches sc.exe
PID:1984

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2036

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1914912747-3343861975-731272777-1000\0f5007522459c86e95ffcc62f32308f1_7cb1702c-0be5-45ad-8dac-6cdb371ef9cc
Filesize
1KB

MD5
996ae25582b956b3d31e988d53bc5f83

SHA1
7fa174bd94ecb0808368d182295733360cf0cb70

SHA256
36aff1996550516c721295a17272e6ea7c042f695969c075f97802a0d61046eb

SHA512
2b077ea9f47c3dd6e570ee6d0092ba1edadcaa6768e08642a1e55ef89863aaafaf9a4b97dbf3f9b9f77a89171fb1d39c49baae2ae0c5a275c4e722f02ccf9d54

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7GB9MMR7DHD2M4WC7VH0.temp
Filesize
7KB

MD5
4b2c3ac7998b5dcf4e8725bb1dbd12bf

SHA1
8a4e66075ca3dff9a3ebd47a0981c7b547444310

SHA256
b474fa872dc0bb4ebcaa7240df2704b5fd6a2c707e1682d8f498356f6a61a440

SHA512
d44edefd41b555b540ddf2a1c670dfbd37707d8e3bd44515b3dece770d5bf68fec2f07f385fe506581885d25edb4ff8b7ac9ec099ea892e616d8a3f04df90544

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
4b2c3ac7998b5dcf4e8725bb1dbd12bf

SHA1
8a4e66075ca3dff9a3ebd47a0981c7b547444310

SHA256
b474fa872dc0bb4ebcaa7240df2704b5fd6a2c707e1682d8f498356f6a61a440

SHA512
d44edefd41b555b540ddf2a1c670dfbd37707d8e3bd44515b3dece770d5bf68fec2f07f385fe506581885d25edb4ff8b7ac9ec099ea892e616d8a3f04df90544

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
Filesize
368KB

MD5
8402ab33eafb84178069f8f490ca604d

SHA1
516c7a538e93f7cf4bff29196511f94e5fbb5a40

SHA256
b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172

SHA512
ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97

Download Submit
\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
Filesize
368KB

MD5
8402ab33eafb84178069f8f490ca604d

SHA1
516c7a538e93f7cf4bff29196511f94e5fbb5a40

SHA256
b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172

SHA512
ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97

Download Submit
memory/1040-64-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1040-66-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/1040-74-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/1116-59-0x0000000000150000-0x0000000000179000-memory.dmp

Filesize
164KB

Download
memory/1492-82-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/2036-70-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2036-83-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads