trickbot | 9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

General

Target

70bf5ad01da89bexeexeexeex.exe
Size

518KB
MD5

70bf5ad01da89b22b925c8a2359dd1c9
SHA1

fab41ee13ab221510eeca72d268fe9e6cd41a224
SHA256

9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731
SHA512

5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a
SSDEEP

12288:Zx1Q61iHsXYvfVpMODDawkCurdEtttY+lE4Wg0uZKE6:ZXQUIsQpMsequrmGQ/T0sl6

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1084-144-0x00000000021A0000-0x00000000021CE000-memory.dmp	trickbot_loader32
behavioral2/memory/1084-146-0x0000000002170000-0x000000000219C000-memory.dmp	trickbot_loader32

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

70bf5ad01da89bexeexeexeex.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	70bf5ad01da89bexeexeexeex.exe

Executes dropped EXE 2 IoCs

Processes:

аНаоすは래별.exeаНаоすは래별.exe

pid process

1084 аНаоすは래별.exe
4320 аНаоすは래별.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 1544 svchost.exe

pid	process
1084	аНаоすは래별.exe
4320	аНаоすは래별.exe

description	pid	process
Token: SeTcbPrivilege	1544	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

70bf5ad01da89bexeexeexeex.exeаНаоすは래별.exeаНаоすは래별.exe

pid	process
540	70bf5ad01da89bexeexeexeex.exe
540	70bf5ad01da89bexeexeexeex.exe
1084	аНаоすは래별.exe
1084	аНаоすは래별.exe
4320	аНаоすは래별.exe
4320	аНаоすは래별.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

70bf5ad01da89bexeexeexeex.exeаНаоすは래별.exeаНаоすは래별.exe

description	pid	process	target process
PID 540 wrote to memory of 1084	540	70bf5ad01da89bexeexeexeex.exe	аНаоすは래별.exe
PID 540 wrote to memory of 1084	540	70bf5ad01da89bexeexeexeex.exe	аНаоすは래별.exe
PID 540 wrote to memory of 1084	540	70bf5ad01da89bexeexeexeex.exe	аНаоすは래별.exe
PID 1084 wrote to memory of 3576	1084	аНаоすは래별.exe	svchost.exe
PID 1084 wrote to memory of 3576	1084	аНаоすは래별.exe	svchost.exe
PID 1084 wrote to memory of 3576	1084	аНаоすは래별.exe	svchost.exe
PID 1084 wrote to memory of 3576	1084	аНаоすは래별.exe	svchost.exe
PID 4320 wrote to memory of 1544	4320	аНаоすは래별.exe	svchost.exe
PID 4320 wrote to memory of 1544	4320	аНаоすは래별.exe	svchost.exe
PID 4320 wrote to memory of 1544	4320	аНаоすは래별.exe	svchost.exe
PID 4320 wrote to memory of 1544	4320	аНаоすは래별.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\70bf5ad01da89bexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\70bf5ad01da89bexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540

C:\ProgramData\аНаоすは래별.exe
"C:\ProgramData\аНаоすは래별.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:3576

C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\ProgramData\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
Filesize
518KB

MD5
70bf5ad01da89b22b925c8a2359dd1c9

SHA1
fab41ee13ab221510eeca72d268fe9e6cd41a224

SHA256
9c3467347337d5edeae9fbef7b6a3de595a0349671cf27f686f94b182bcdb731

SHA512
5eb3819042050a15fadcdc5cbb039221180ea1141fa1950554ece52728693aa5b7c1edec7d0faa18462be8889d0cebb2433aa29596e8b8526de936ffe98d8d7a

Download Submit
memory/1084-144-0x00000000021A0000-0x00000000021CE000-memory.dmp

Filesize
184KB

Download
memory/1084-147-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/1084-146-0x0000000002170000-0x000000000219C000-memory.dmp

Filesize
176KB

Download
memory/1544-156-0x0000020EDD260000-0x0000020EDD27E000-memory.dmp

Filesize
120KB

Download
memory/1544-158-0x0000020EDD260000-0x0000020EDD27E000-memory.dmp

Filesize
120KB

Download
memory/1544-159-0x0000020EDD260000-0x0000020EDD27E000-memory.dmp

Filesize
120KB

Download
memory/3576-148-0x000001D85DB60000-0x000001D85DB7E000-memory.dmp

Filesize
120KB

Download
memory/3576-150-0x000001D85DB60000-0x000001D85DB7E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads