trickbot | e6d62be68e9905426cbf6320af06e22b8fd94badd68e985d4d47eeb5f660a8ea

Analysis

max time kernel
138s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe
Size

1.0MB
MD5

2bba5dfc012d4eacb69e411d4314ac30
SHA1

a41eef8e3c27032c172fe50ee0b6fdd3969a5188
SHA256

e6d62be68e9905426cbf6320af06e22b8fd94badd68e985d4d47eeb5f660a8ea
SHA512

1bae40db6bfa51445055b0621f77a4cd35841ea1073f880977628f9fc2adac7269e709e77a2f43fb56130a4fd5bdd99c35567bc9d93bd532a5a09ea801062bab
SSDEEP

24576:zQ5aILMCfmAUhrSO1YNWdvCzMPqdUD6dNXfpR:E5aIwC+AUBsWsXN

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1436-15-0x0000000002AD0000-0x0000000002AF9000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe

pid	process
2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe

description	pid	process
Token: SeTcbPrivilege	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
Token: SeTcbPrivilege	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe

pid	process
1436	2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe
2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1436 wrote to memory of 2020	1436	2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
PID 1436 wrote to memory of 2020	1436	2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
PID 1436 wrote to memory of 2020	1436	2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 2020 wrote to memory of 3808	2020	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 4324 wrote to memory of 4488	4324	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe
PID 3860 wrote to memory of 3100	3860	2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2bba5dfc012d4eacb69e411d4314ac30_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Roaming\WinSocket\2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3808

C:\Users\Admin\AppData\Roaming\WinSocket\2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4488

C:\Users\Admin\AppData\Roaming\WinSocket\2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\2bba6dfc012d4eacb79e411d4314ac30_NeikiAnalytict.exe

Filesize
1.0MB

MD5
2bba5dfc012d4eacb69e411d4314ac30

SHA1
a41eef8e3c27032c172fe50ee0b6fdd3969a5188

SHA256
e6d62be68e9905426cbf6320af06e22b8fd94badd68e985d4d47eeb5f660a8ea

SHA512
1bae40db6bfa51445055b0621f77a4cd35841ea1073f880977628f9fc2adac7269e709e77a2f43fb56130a4fd5bdd99c35567bc9d93bd532a5a09ea801062bab

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
55KB

MD5
4fbea9b3885f4c1fa875e80de5649d21

SHA1
d9128606bd91efcefc5bcca0dc261fa57212f555

SHA256
a804b0341dce35410ea8256819e714ed53c12f5eb3d143b0763a85f26e705d03

SHA512
d988664239ce5c79c07a2838e87d0d053df2e3e3139d2a476096c2c052056d2e431b4030f43b9b1d4bfd796785c3045a8a9e052d91aff8399916d7570fb15df9

Download Submit
memory/1436-15-0x0000000002AD0000-0x0000000002AF9000-memory.dmp

Filesize
164KB

Download
memory/1436-2-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-14-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-13-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1436-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1436-12-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-11-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-10-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-9-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-8-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-7-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-6-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-5-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-4-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1436-3-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2020-32-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-36-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-37-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2020-35-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-34-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-33-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-31-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-30-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-29-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-28-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-27-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-26-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2020-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2020-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2020-52-0x0000000003080000-0x000000000313E000-memory.dmp

Filesize
760KB

Download
memory/2020-53-0x0000000003140000-0x0000000003409000-memory.dmp

Filesize
2.8MB

Download
memory/3808-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3808-51-0x00000228BFEE0000-0x00000228BFEE1000-memory.dmp

Filesize
4KB

Download
memory/4324-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4324-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/4324-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download