trickbot | 96311437bea32a92b838984c075facdf86beed77376eac5dcd81c2ed671823dc

Analysis

max time kernel
135s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df7d957c02423b804f18b71df13669e0_NEIKI.exe
Size

798KB
MD5

df7d957c02423b804f18b71df13669e0
SHA1

6b036e51d20995c61d83bba899ef10ae8cf557b5
SHA256

96311437bea32a92b838984c075facdf86beed77376eac5dcd81c2ed671823dc
SHA512

d5f40b234e3906c7ed18a8d83b893c3a6d27374c1b0afbdcee7f09dbdd2d9ba7c16267b84884fc92ad1da3f598bd154a681e108a02bc1a478b09c9c20eaa9a51
SSDEEP

12288:zJB0lh5aILwtFPCfmAUt3r4DwpRrKO1YYVhiiNdvrsymrs:zQ5aILMCfmAUhrSO1YNWdvKrs

Score

10^/10

trickbot banker evasion execution trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/2956-15-0x00000000003C0000-0x00000000003E9000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
2284	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
1012	df8d968c02423b904f19b81df13779e0_NFJLJ.exe

Loads dropped DLL 2 IoCs

pid	Process
2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe
2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2576	sc.exe
2512	sc.exe
2428	sc.exe
1800	sc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe
2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe
2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe
2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
2520	powershell.exe
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeTcbPrivilege	2284	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
Token: SeTcbPrivilege	1012	df8d968c02423b904f19b81df13779e0_NFJLJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe
2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
2284	df8d968c02423b904f19b81df13779e0_NFJLJ.exe
1012	df8d968c02423b904f19b81df13779e0_NFJLJ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2960	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	28
PID 2956 wrote to memory of 2960	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	28
PID 2956 wrote to memory of 2960	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	28
PID 2956 wrote to memory of 2960	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	28
PID 2956 wrote to memory of 2992	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	29
PID 2956 wrote to memory of 2992	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	29
PID 2956 wrote to memory of 2992	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	29
PID 2956 wrote to memory of 2992	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	29
PID 2956 wrote to memory of 2664	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	32
PID 2956 wrote to memory of 2664	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	32
PID 2956 wrote to memory of 2664	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	32
PID 2956 wrote to memory of 2664	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	32
PID 2956 wrote to memory of 2800	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	34
PID 2956 wrote to memory of 2800	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	34
PID 2956 wrote to memory of 2800	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	34
PID 2956 wrote to memory of 2800	2956	df7d957c02423b804f18b71df13669e0_NEIKI.exe	34
PID 2960 wrote to memory of 2512	2960	cmd.exe	36
PID 2960 wrote to memory of 2512	2960	cmd.exe	36
PID 2960 wrote to memory of 2512	2960	cmd.exe	36
PID 2960 wrote to memory of 2512	2960	cmd.exe	36
PID 2992 wrote to memory of 2576	2992	cmd.exe	37
PID 2992 wrote to memory of 2576	2992	cmd.exe	37
PID 2992 wrote to memory of 2576	2992	cmd.exe	37
PID 2992 wrote to memory of 2576	2992	cmd.exe	37
PID 2664 wrote to memory of 2520	2664	cmd.exe	38
PID 2664 wrote to memory of 2520	2664	cmd.exe	38
PID 2664 wrote to memory of 2520	2664	cmd.exe	38
PID 2664 wrote to memory of 2520	2664	cmd.exe	38
PID 2800 wrote to memory of 2600	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	35
PID 2800 wrote to memory of 2600	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	35
PID 2800 wrote to memory of 2600	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	35
PID 2800 wrote to memory of 2600	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	35
PID 2800 wrote to memory of 2468	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	39
PID 2800 wrote to memory of 2468	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	39
PID 2800 wrote to memory of 2468	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	39
PID 2800 wrote to memory of 2468	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	39
PID 2800 wrote to memory of 2476	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	40
PID 2800 wrote to memory of 2476	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	40
PID 2800 wrote to memory of 2476	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	40
PID 2800 wrote to memory of 2476	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	40
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41
PID 2800 wrote to memory of 2536	2800	df8d968c02423b904f19b81df13779e0_NFJLJ.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\df7d957c02423b804f18b71df13669e0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\df7d957c02423b804f18b71df13669e0_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- C:\Users\Admin\AppData\Roaming\WinSocket\df8d968c02423b904f19b81df13779e0_NFJLJ.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\df8d968c02423b904f19b81df13779e0_NFJLJ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    /c sc stop WinDefend
    3⤵
    PID:2600
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    /c sc delete WinDefend
    3⤵
    PID:2468
  - - C:\Windows\SysWOW64\sc.exe
      sc delete WinDefend
      4⤵
      Launches sc.exe
      PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    PID:2476
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2352
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2536

C:\Windows\system32\taskeng.exe
taskeng.exe {41E0D49E-E07A-4D54-B8C7-E3B226061E01} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1760
- C:\Users\Admin\AppData\Roaming\WinSocket\df8d968c02423b904f19b81df13779e0_NFJLJ.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\df8d968c02423b904f19b81df13779e0_NFJLJ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2284
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1836
- C:\Users\Admin\AppData\Roaming\WinSocket\df8d968c02423b904f19b81df13779e0_NFJLJ.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\df8d968c02423b904f19b81df13779e0_NFJLJ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1012
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
af097d7078829d4b9bebc78a1bf4953a

SHA1
4e4066cec10d1403402174c2ea18954153b595c3

SHA256
66a99b21f092daf48750cf8ff750fe6d6afbf798e067c77875951cee087c82c2

SHA512
5219e27c0859b82672a54a2bf603da0b2e0afab2e2991031d74f8505500acbe0f0e97624589b8e041c3da4e8c296e7c727df0da01dfe38a3d9307632bc5ba28e

Download Submit
\Users\Admin\AppData\Roaming\WinSocket\df8d968c02423b904f19b81df13779e0_NFJLJ.exe

Filesize
798KB

MD5
df7d957c02423b804f18b71df13669e0

SHA1
6b036e51d20995c61d83bba899ef10ae8cf557b5

SHA256
96311437bea32a92b838984c075facdf86beed77376eac5dcd81c2ed671823dc

SHA512
d5f40b234e3906c7ed18a8d83b893c3a6d27374c1b0afbdcee7f09dbdd2d9ba7c16267b84884fc92ad1da3f598bd154a681e108a02bc1a478b09c9c20eaa9a51

Download Submit
memory/1012-93-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1012-92-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2284-70-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-76-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-68-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-69-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-65-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-71-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-72-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-73-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-74-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-75-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-67-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2284-66-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2536-49-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2536-48-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2800-33-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-43-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2800-37-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-36-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-35-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-34-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-38-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-32-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-31-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-30-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-29-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-45-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2800-44-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2800-39-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2800-40-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2956-11-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-15-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/2956-8-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-9-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-10-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-17-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2956-12-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-7-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-2-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-3-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2956-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download