trickbot | 23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

Resubmissions

19-07-2023 06:20

230719-g3xdvagb67 10

09-07-2023 07:36

230709-jfjkksbb93 10

09-07-2023 07:21

230709-h61fcabh6t 10

Analysis

max time kernel
1782s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83817ff8228a54exeexeexeex.exe
Size

527KB
MD5

83817ff8228a54ebef4c323a770e5481
SHA1

8fbc2b17032af8a7ce7c3065305892854277cfa9
SHA256

23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee
SHA512

e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c
SSDEEP

12288:Zx1Q61iHsXYvfVpMODDawkCurdEtttY4jVHVEGGJL:ZXQUIsQpMsequrmGmVEjZ

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 10 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1796-144-0x0000000002230000-0x000000000225E000-memory.dmp	trickbot_loader32
behavioral2/memory/1796-145-0x0000000002170000-0x000000000219C000-memory.dmp	trickbot_loader32
behavioral2/memory/1796-147-0x0000000002230000-0x000000000225E000-memory.dmp	trickbot_loader32
behavioral2/memory/1796-150-0x0000000002230000-0x000000000225E000-memory.dmp	trickbot_loader32
behavioral2/memory/1512-159-0x0000000000E30000-0x0000000000E5E000-memory.dmp	trickbot_loader32
behavioral2/memory/1512-162-0x0000000000E30000-0x0000000000E5E000-memory.dmp	trickbot_loader32
behavioral2/memory/2132-170-0x0000000000E50000-0x0000000000E7E000-memory.dmp	trickbot_loader32
behavioral2/memory/2132-173-0x0000000000E50000-0x0000000000E7E000-memory.dmp	trickbot_loader32
behavioral2/memory/1696-181-0x0000000000E70000-0x0000000000E9E000-memory.dmp	trickbot_loader32
behavioral2/memory/1696-183-0x0000000000E70000-0x0000000000E9E000-memory.dmp	trickbot_loader32

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	83817ff8228a54exeexeexeex.exe

Executes dropped EXE 4 IoCs

pid	Process
1796	аНаоすは래별.exe
1512	аНаоすは래별.exe
2132	аНаоすは래별.exe
1696	аНаоすは래별.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	3356	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4172	83817ff8228a54exeexeexeex.exe
4172	83817ff8228a54exeexeexeex.exe
1796	аНаоすは래별.exe
1796	аНаоすは래별.exe
1512	аНаоすは래별.exe
1512	аНаоすは래별.exe
2132	аНаоすは래별.exe
2132	аНаоすは래별.exe
1696	аНаоすは래별.exe
1696	аНаоすは래별.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 1796	4172	83817ff8228a54exeexeexeex.exe	86
PID 4172 wrote to memory of 1796	4172	83817ff8228a54exeexeexeex.exe	86
PID 4172 wrote to memory of 1796	4172	83817ff8228a54exeexeexeex.exe	86
PID 1796 wrote to memory of 4160	1796	аНаоすは래별.exe	91
PID 1796 wrote to memory of 4160	1796	аНаоすは래별.exe	91
PID 1796 wrote to memory of 4160	1796	аНаоすは래별.exe	91
PID 1796 wrote to memory of 4160	1796	аНаоすは래별.exe	91
PID 1512 wrote to memory of 3356	1512	аНаоすは래별.exe	105
PID 1512 wrote to memory of 3356	1512	аНаоすは래별.exe	105
PID 1512 wrote to memory of 3356	1512	аНаоすは래별.exe	105
PID 1512 wrote to memory of 3356	1512	аНаоすは래별.exe	105
PID 2132 wrote to memory of 2588	2132	аНаоすは래별.exe	108
PID 2132 wrote to memory of 2588	2132	аНаоすは래별.exe	108
PID 2132 wrote to memory of 2588	2132	аНаоすは래별.exe	108
PID 2132 wrote to memory of 2588	2132	аНаоすは래별.exe	108
PID 1696 wrote to memory of 4532	1696	аНаоすは래별.exe	110
PID 1696 wrote to memory of 4532	1696	аНаоすは래별.exe	110
PID 1696 wrote to memory of 4532	1696	аНаоすは래별.exe	110
PID 1696 wrote to memory of 4532	1696	аНаоすは래별.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\83817ff8228a54exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\83817ff8228a54exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172
- C:\ProgramData\аНаоすは래별.exe
  "C:\ProgramData\аНаоすは래별.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4160

C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3356

C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2588

C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\a66bd7feb447f8b1699185a734437579_4dc48ea0-ec1c-4c48-ab6a-6232968c18bf

Filesize
50B

MD5
815494c1565d6f512e25d0d0ac396d0a

SHA1
f67b40b0c8972cc4f5e322044ae83d5a2d953559

SHA256
958afa4bfd0f9e5dba2992593cff21a948557305fd665c1daea09d22f5ba205e

SHA512
315f556dfc436a72112855ead04a0f348f99e656c6291fd604169cf7a4ee52f4fa94e2f97992116d52b366a21c1bc491c004b8275fb5c6ab8557aa4c9476e585

Download Submit
C:\ProgramData\аНаоすは래별.exe

Filesize
527KB

MD5
83817ff8228a54ebef4c323a770e5481

SHA1
8fbc2b17032af8a7ce7c3065305892854277cfa9

SHA256
23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

SHA512
e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c

Download Submit
C:\ProgramData\аНаоすは래별.exe

Filesize
527KB

MD5
83817ff8228a54ebef4c323a770e5481

SHA1
8fbc2b17032af8a7ce7c3065305892854277cfa9

SHA256
23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

SHA512
e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c

Download Submit
C:\ProgramData\аНаоすは래별.exe

Filesize
527KB

MD5
83817ff8228a54ebef4c323a770e5481

SHA1
8fbc2b17032af8a7ce7c3065305892854277cfa9

SHA256
23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

SHA512
e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\settings.ini

Filesize
17KB

MD5
ff930f8a47b91c7b024f1ff2949b5841

SHA1
aeaba4ab21ba76566f33cd7c9cd7272dea1ae172

SHA256
33f7cafbfa0f5fafc62f8733231f12a6a41f6a782118db6cd914e334586f30a9

SHA512
af507769be6e43ebf0c713ad91dc2c366b49b00e8d293c3a467ba21feb382de10ea7793d0699cf72a76d1c9723c4fc861c65b78cb6e8fbdcd5c219b94a32bc04

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe

Filesize
527KB

MD5
83817ff8228a54ebef4c323a770e5481

SHA1
8fbc2b17032af8a7ce7c3065305892854277cfa9

SHA256
23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

SHA512
e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe

Filesize
527KB

MD5
83817ff8228a54ebef4c323a770e5481

SHA1
8fbc2b17032af8a7ce7c3065305892854277cfa9

SHA256
23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

SHA512
e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe

Filesize
527KB

MD5
83817ff8228a54ebef4c323a770e5481

SHA1
8fbc2b17032af8a7ce7c3065305892854277cfa9

SHA256
23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

SHA512
e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c

Download Submit
C:\Users\Admin\AppData\Roaming\NuiGet\аНаоすは래별.exe

Filesize
527KB

MD5
83817ff8228a54ebef4c323a770e5481

SHA1
8fbc2b17032af8a7ce7c3065305892854277cfa9

SHA256
23b52343e9f52f72d0bb7b3d0ecc74a54c812f5b8f1143ef10daca23977858ee

SHA512
e1606094ebe36b18847b8e63c4e5bdc72827bc498261ed4f9356e143d6c6686187a7663b2b8b9b17f06d65df9f3e8084e74c9091dede372d018bd8ade547c45c

Download Submit
memory/1512-161-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/1512-159-0x0000000000E30000-0x0000000000E5E000-memory.dmp

Filesize
184KB

Download
memory/1512-160-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/1512-162-0x0000000000E30000-0x0000000000E5E000-memory.dmp

Filesize
184KB

Download
memory/1696-181-0x0000000000E70000-0x0000000000E9E000-memory.dmp

Filesize
184KB

Download
memory/1696-182-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/1696-183-0x0000000000E70000-0x0000000000E9E000-memory.dmp

Filesize
184KB

Download
memory/1796-150-0x0000000002230000-0x000000000225E000-memory.dmp

Filesize
184KB

Download
memory/1796-149-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/1796-144-0x0000000002230000-0x000000000225E000-memory.dmp

Filesize
184KB

Download
memory/1796-145-0x0000000002170000-0x000000000219C000-memory.dmp

Filesize
176KB

Download
memory/1796-147-0x0000000002230000-0x000000000225E000-memory.dmp

Filesize
184KB

Download
memory/1796-148-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/2132-170-0x0000000000E50000-0x0000000000E7E000-memory.dmp

Filesize
184KB

Download
memory/2132-172-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2132-173-0x0000000000E50000-0x0000000000E7E000-memory.dmp

Filesize
184KB

Download
memory/2132-171-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/2132-177-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2588-174-0x00000242581D0000-0x00000242581EE000-memory.dmp

Filesize
120KB

Download
memory/2588-176-0x00000242581D0000-0x00000242581EE000-memory.dmp

Filesize
120KB

Download
memory/3356-163-0x000001E18FA50000-0x000001E18FA6E000-memory.dmp

Filesize
120KB

Download
memory/3356-165-0x000001E18FA50000-0x000001E18FA6E000-memory.dmp

Filesize
120KB

Download
memory/4160-151-0x000002B4396D0000-0x000002B4396EE000-memory.dmp

Filesize
120KB

Download
memory/4160-153-0x000002B4396D0000-0x000002B4396EE000-memory.dmp

Filesize
120KB

Download
memory/4532-184-0x00000248518E0000-0x00000248518FE000-memory.dmp

Filesize
120KB

Download
memory/4532-185-0x00000248518E0000-0x00000248518FE000-memory.dmp

Filesize
120KB

Download