trickbot | 70c26692569194f464cbcd7adb9a1768eae8b691c05d31e40bbe256d026ab65e

General

Target

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe
Size

368KB
MD5

8402ab33eafb84178069f8f490ca604d
SHA1

516c7a538e93f7cf4bff29196511f94e5fbb5a40
SHA256

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172
SHA512

ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97
SSDEEP

6144:jo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:jmSuOcHmnYhrDMTrban4qM

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/3776-134-0x00000000013D0000-0x00000000013F9000-memory.dmp	trickbot_loader32
behavioral2/memory/3776-141-0x00000000013D0000-0x00000000013F9000-memory.dmp	trickbot_loader32
behavioral2/memory/3920-154-0x00000000010D0000-0x00000000010F9000-memory.dmp	trickbot_loader32
behavioral2/memory/2756-171-0x0000000000C70000-0x0000000000C99000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exeb8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

pid	process
3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

description pid process

Token: SeTcbPrivilege 2756 b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

description	pid	process
Token: SeTcbPrivilege	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exeb8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exeb8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe

description	pid	process	target process
PID 3776 wrote to memory of 3920	3776	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
PID 3776 wrote to memory of 3920	3776	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
PID 3776 wrote to memory of 3920	3776	b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 3920 wrote to memory of 1844	3920	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe
PID 2756 wrote to memory of 3740	2756	b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe
"C:\Users\Admin\AppData\Local\Temp\b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1844

C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:3740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1675742406-747946869-1029867430-1000\0f5007522459c86e95ffcc62f32308f1_8d6935fa-0795-4a6f-bfd9-e755f1917fa0
Filesize
1KB

MD5
1cde4706ab26a863f9f45040db7da180

SHA1
442780fcda52193f860176ecd51077b4688be55f

SHA256
668cec2ad52b5ef7ff2ad55eaac7a86d553b9801abdaf2bb1446c5e1ad5fb39f

SHA512
1b080fe9630223560a3939f63fc5504ec81e41da58957b0533e322358fc5ea463956e94d6304f8695bd68df19d93079fda8809cf24a0fda2594c8ab6dd26aa30

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
Filesize
368KB

MD5
8402ab33eafb84178069f8f490ca604d

SHA1
516c7a538e93f7cf4bff29196511f94e5fbb5a40

SHA256
b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172

SHA512
ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
Filesize
368KB

MD5
8402ab33eafb84178069f8f490ca604d

SHA1
516c7a538e93f7cf4bff29196511f94e5fbb5a40

SHA256
b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172

SHA512
ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\b8cbc6e6dc192c9d99909cd74d37834abeb7bfac16e7efc2ebcc2c68264bf182.exe
Filesize
368KB

MD5
8402ab33eafb84178069f8f490ca604d

SHA1
516c7a538e93f7cf4bff29196511f94e5fbb5a40

SHA256
b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172

SHA512
ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97

Download Submit
memory/1844-155-0x0000028D67830000-0x0000028D67831000-memory.dmp

Filesize
4KB

Download
memory/1844-148-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2756-171-0x0000000000C70000-0x0000000000C99000-memory.dmp

Filesize
164KB

Download
memory/2756-170-0x0000000001560000-0x0000000001829000-memory.dmp

Filesize
2.8MB

Download
memory/2756-169-0x00000000014A0000-0x000000000155E000-memory.dmp

Filesize
760KB

Download
memory/3740-173-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/3776-141-0x00000000013D0000-0x00000000013F9000-memory.dmp

Filesize
164KB

Download
memory/3776-134-0x00000000013D0000-0x00000000013F9000-memory.dmp

Filesize
164KB

Download
memory/3920-154-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/3920-153-0x00000000030B0000-0x0000000003379000-memory.dmp

Filesize
2.8MB

Download
memory/3920-152-0x0000000001500000-0x00000000015BE000-memory.dmp

Filesize
760KB

Download
memory/3920-143-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads