trickbot | c9e4e1d05f05ecf088f37769b6c7b04b4d5f13f0f27755e2e7b1d192b153b978

General

Target

a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exe
Size

1.1MB
MD5

a4ebfe9aa6a2012b29e5cd2acee67bd0
SHA1

1025b663e13c8d8e0f8b41a070c0cfbceb779d03
SHA256

c9e4e1d05f05ecf088f37769b6c7b04b4d5f13f0f27755e2e7b1d192b153b978
SHA512

77907c6cfee08d021244eb6e9086b85212d0624354c7f231703e2fbe49a59590b3e77dd134900b059bc018d37474c914d2f930e39432ab87025d2e7659a05673
SSDEEP

24576:zQ5aILMCfmAUhrSO1YNWdvCzMPqdUD6dNXfpt7le:E5aIwC+AUBsWsXZY

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1364-15-0x0000000002A50000-0x0000000002A79000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

Processes:

a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe

pid	process
180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe

description	pid	process
Token: SeTcbPrivilege	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
Token: SeTcbPrivilege	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe

pid	process
1364	a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exe
180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exea4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe

description	pid	process	target process
PID 1364 wrote to memory of 180	1364	a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exe	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
PID 1364 wrote to memory of 180	1364	a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exe	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
PID 1364 wrote to memory of 180	1364	a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exe	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 180 wrote to memory of 3552	180	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 3692 wrote to memory of 1664	3692	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe
PID 880 wrote to memory of 1420	880	a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a4ebfe9aa6a2012b29e5cd2acee67bd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Roaming\WinSocket\a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:3552

C:\Users\Admin\AppData\Roaming\WinSocket\a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1664

C:\Users\Admin\AppData\Roaming\WinSocket\a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinSocket\a4ebfe9aa7a2012b29e6cd2acee78bd0_NeikiAnalytict.exe
Filesize
1.1MB

MD5
a4ebfe9aa6a2012b29e5cd2acee67bd0

SHA1
1025b663e13c8d8e0f8b41a070c0cfbceb779d03

SHA256
c9e4e1d05f05ecf088f37769b6c7b04b4d5f13f0f27755e2e7b1d192b153b978

SHA512
77907c6cfee08d021244eb6e9086b85212d0624354c7f231703e2fbe49a59590b3e77dd134900b059bc018d37474c914d2f930e39432ab87025d2e7659a05673

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Filesize
21KB

MD5
7e3b8cc5a10ad232690dd48abed4d49a

SHA1
485d80c708f862c6e1f0c607cfc8d926b5630df5

SHA256
7f484ff7cd6416fc04ac053891b8e8cf038dad4cc3054157a5915a43e8f49446

SHA512
6d48557ecb109e4444902cfbf0ef1552b8752fbedc30204749948529bf6b5db4586462e0fbd3c1e647715a2bba1c1877f437bd3e8037950fcd65c8e202859cf8

Download Submit
memory/180-27-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-30-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-40-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/180-41-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/180-42-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/180-26-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-35-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-28-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-29-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-52-0x0000000003090000-0x000000000314E000-memory.dmp

Filesize
760KB

Download
memory/180-31-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-32-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-33-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-34-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-53-0x0000000003150000-0x0000000003419000-memory.dmp

Filesize
2.8MB

Download
memory/180-37-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/180-36-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/1364-15-0x0000000002A50000-0x0000000002A79000-memory.dmp

Filesize
164KB

Download
memory/1364-12-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-17-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/1364-14-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-6-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-8-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-9-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1364-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1364-11-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3552-46-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3552-51-0x0000026AD90D0000-0x0000026AD90D1000-memory.dmp

Filesize
4KB

Download
memory/3552-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3692-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3692-72-0x0000000000421000-0x0000000000422000-memory.dmp

Filesize
4KB

Download
memory/3692-73-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3692-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads