trickbot | c6bcd9175bfa3c5deab49216a11fb6e3246462705eff509a07ac2c4237c81288

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe
Size

1.0MB
MD5

3d5674bd44f36a5d8ffbec8ea0d39c80
SHA1

40448b4ce64377f0898cec5d694b9dde69971c34
SHA256

c6bcd9175bfa3c5deab49216a11fb6e3246462705eff509a07ac2c4237c81288
SHA512

c67375f866df2840faa1a7a3fc219d8248a314a83d28e7dfc6cc8442b4e198ec5329c88d58572180808893ac1c6c51cbabfa853268a7a7595eb64075235eac88
SSDEEP

24576:zQ5aILMCfmAUhrSO1YNWdvCzMPqdUD6dNXfptllb5:E5aIwC+AUBsWsXRl

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/3280-15-0x0000000002470000-0x0000000002499000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe

pid	process
4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe

description	pid	process
Token: SeTcbPrivilege	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
Token: SeTcbPrivilege	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe

pid	process
3280	3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe
4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 3280 wrote to memory of 4768	3280	3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
PID 3280 wrote to memory of 4768	3280	3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
PID 3280 wrote to memory of 4768	3280	3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 4768 wrote to memory of 3612	4768	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 672 wrote to memory of 4760	672	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe
PID 404 wrote to memory of 3176	404	3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3d5674bd44f36a5d8ffbec8ea0d39c80_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Roaming\WinSocket\3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3612

C:\Users\Admin\AppData\Roaming\WinSocket\3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4760

C:\Users\Admin\AppData\Roaming\WinSocket\3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\3d6784bd44f37a6d9ffbec9ea0d39c90_NeikiAnalytict.exe

Filesize
1.0MB

MD5
3d5674bd44f36a5d8ffbec8ea0d39c80

SHA1
40448b4ce64377f0898cec5d694b9dde69971c34

SHA256
c6bcd9175bfa3c5deab49216a11fb6e3246462705eff509a07ac2c4237c81288

SHA512
c67375f866df2840faa1a7a3fc219d8248a314a83d28e7dfc6cc8442b4e198ec5329c88d58572180808893ac1c6c51cbabfa853268a7a7595eb64075235eac88

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
58KB

MD5
527105402e97aa98f7bafcc94cf05881

SHA1
00074a3affdb9f4af98d41671c2d9a01f78acea8

SHA256
206cb5c2b6100905a674bee41afda807b18ebc246a4d417e33fe9deab4e58cba

SHA512
3f716ccaade98fbf95e64330108168ede25442231e0437ce916b9b3ee7d0b0bdc49c004b11b1df646944a4fc296ae47e02f5875be6dc3fb21b27363c96f6b7e2

Download Submit
memory/672-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/672-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/672-58-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-59-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-60-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-61-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-62-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-63-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-65-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-66-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-67-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-68-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/672-69-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/3280-15-0x0000000002470000-0x0000000002499000-memory.dmp

Filesize
164KB

Download
memory/3280-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3280-4-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-14-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-13-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-12-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-11-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-10-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-9-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-8-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-7-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-6-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-3-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-2-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-5-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3280-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3612-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3612-53-0x0000015920500000-0x0000015920501000-memory.dmp

Filesize
4KB

Download
memory/3612-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4768-32-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-26-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-51-0x0000000003110000-0x00000000031CE000-memory.dmp

Filesize
760KB

Download
memory/4768-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4768-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4768-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-37-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4768-33-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-52-0x00000000031D0000-0x0000000003499000-memory.dmp

Filesize
2.8MB

Download
memory/4768-27-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-28-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-29-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-34-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-35-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4768-36-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download