trickbot | 9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

General

Target

70bf5ad01da89bexeexeexeex.exe
Size

518KB
MD5

70bf5ad01da89b22b925c8a2359dd1c9
SHA1

fab41ee13ab221510eeca72d268fe9e6cd41a224
SHA256

9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731
SHA512

5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a
SSDEEP

12288:Zx1Q61iHsXYvfVpMODDawkCurdEtttY+lE4Wg0uZKE6:ZXQUIsQpMsequrmGQ/T0sl6

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/2900-64-0x00000000002A0000-0x00000000002CE000-memory.dmp	trickbot_loader32
behavioral1/memory/2900-66-0x0000000000270000-0x000000000029C000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

аНаоすは래별.exeаНаоすは래별.exe

pid process

2900 аНаоすは래별.exe
828 аНаоすは래별.exe
Loads dropped DLL 2 IoCs

Processes:

70bf5ad01da89bexeexeexeex.exe

pid process

2824 70bf5ad01da89bexeexeexeex.exe
2824 70bf5ad01da89bexeexeexeex.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 756 svchost.exe

pid	process
2900	аНаоすは래별.exe
828	аНаоすは래별.exe

description	pid	process
Token: SeTcbPrivilege	756	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

70bf5ad01da89bexeexeexeex.exeаНаоすは래별.exeаНаоすは래별.exe

pid	process
2824	70bf5ad01da89bexeexeexeex.exe
2824	70bf5ad01da89bexeexeexeex.exe
2900	аНаоすは래별.exe
2900	аНаоすは래별.exe
828	аНаоすは래별.exe
828	аНаоすは래별.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

70bf5ad01da89bexeexeexeex.exeаНаоすは래별.exetaskeng.exeаНаоすは래별.exe

description	pid	process	target process
PID 2824 wrote to memory of 2900	2824	70bf5ad01da89bexeexeexeex.exe	аНаоすは래별.exe
PID 2824 wrote to memory of 2900	2824	70bf5ad01da89bexeexeexeex.exe	аНаоすは래별.exe
PID 2824 wrote to memory of 2900	2824	70bf5ad01da89bexeexeexeex.exe	аНаоすは래별.exe
PID 2824 wrote to memory of 2900	2824	70bf5ad01da89bexeexeexeex.exe	аНаоすは래별.exe
PID 2900 wrote to memory of 2056	2900	аНаоすは래별.exe	svchost.exe
PID 2900 wrote to memory of 2056	2900	аНаоすは래별.exe	svchost.exe
PID 2900 wrote to memory of 2056	2900	аНаоすは래별.exe	svchost.exe
PID 2900 wrote to memory of 2056	2900	аНаоすは래별.exe	svchost.exe
PID 2900 wrote to memory of 2056	2900	аНаоすは래별.exe	svchost.exe
PID 2900 wrote to memory of 2056	2900	аНаоすは래별.exe	svchost.exe
PID 1952 wrote to memory of 828	1952	taskeng.exe	аНаоすは래별.exe
PID 1952 wrote to memory of 828	1952	taskeng.exe	аНаоすは래별.exe
PID 1952 wrote to memory of 828	1952	taskeng.exe	аНаоすは래별.exe
PID 1952 wrote to memory of 828	1952	taskeng.exe	аНаоすは래별.exe
PID 828 wrote to memory of 756	828	аНаоすは래별.exe	svchost.exe
PID 828 wrote to memory of 756	828	аНаоすは래별.exe	svchost.exe
PID 828 wrote to memory of 756	828	аНаоすは래별.exe	svchost.exe
PID 828 wrote to memory of 756	828	аНаоすは래별.exe	svchost.exe
PID 828 wrote to memory of 756	828	аНаоすは래별.exe	svchost.exe
PID 828 wrote to memory of 756	828	аНаоすは래별.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\70bf5ad01da89bexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\70bf5ad01da89bexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824

C:\ProgramData\аНаоすは래별.exe
"C:\ProgramData\аНаоすは래별.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2056

C:\Windows\system32\taskeng.exe
taskeng.exe {9A2B364D-48BC-44D4-9E9A-F9B12E8C037C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
memory/756-76-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/756-75-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/2056-70-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/2056-68-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/2900-67-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/2900-66-0x0000000000270000-0x000000000029C000-memory.dmp

Filesize
176KB

Download
memory/2900-64-0x00000000002A0000-0x00000000002CE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads