trickbot | 3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f

Analysis

max time kernel
75s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe
Size 368KB
Sample240628-nh5caaxake
SHA256 3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f
MD5 4bb384ef166aa19a6a08f22accccca8e
SHA1 ef112992ffaf5b43e4a0235c5f3a7562c4fb6a85
SHA512 47bf71ac953348888fbdcd424252145c1263cce65f01ed6a8f74284455400d02c78e9841a6a787076f26b39a2b04611723f8faa2f77f77fd30f9c4cc95d21206
SSDEEP 6144:Ko5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:KmSuOcHmnYhrDMTrban4qM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1408-1-0x00000000012D0000-0x00000000012F9000-memory.dmp	trickbot_loader32
behavioral2/memory/1408-5-0x00000000012D0000-0x00000000012F9000-memory.dmp	trickbot_loader32
behavioral2/memory/1944-9-0x0000000000F30000-0x0000000000F59000-memory.dmp	trickbot_loader32
behavioral2/memory/1944-24-0x0000000000F30000-0x0000000000F59000-memory.dmp	trickbot_loader32
behavioral2/memory/3812-28-0x0000000000D20000-0x0000000000D49000-memory.dmp	trickbot_loader32
behavioral2/memory/3812-42-0x0000000000D20000-0x0000000000D49000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1944	1408	3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe	88
PID 1408 wrote to memory of 1944	1408	3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe	88
PID 1408 wrote to memory of 1944	1408	3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe	88
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe
"C:\Users\Admin\AppData\Local\Temp\3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
  C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
1⤵
PID:4968

C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f5007522459c86e95ffcc62f32308f1_d2547453-e731-4fdf-8f92-95f955a44aca

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\0f5007522459c86e95ffcc62f32308f1_d2547453-e731-4fdf-8f92-95f955a44aca
Size 1KB
SHA256 6b6d851bca867c0b8035ca2b063d5a97831b73c2bf7d0f1d0c3535b08ecc3495
MD5 afaf54ba7fbb1fd78b0db5948f6a5726
SHA1 fd5bb40e247e334ef52ca6b0b91fa7acaf9e9663
SHA512 1288e691a896ff0e1e855a527d5032536789986e05c5bb48cbf80ae183712afaab6a1524d39c70e369b15e906701111dfa5e8888d37c889370147ccb6f0f50a1
MD5 SHA1 SHA512

Submit Download

3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe

Path C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
Size 368KB
SHA256 3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f
MD5 4bb384ef166aa19a6a08f22accccca8e
SHA1 ef112992ffaf5b43e4a0235c5f3a7562c4fb6a85
SHA512 47bf71ac953348888fbdcd424252145c1263cce65f01ed6a8f74284455400d02c78e9841a6a787076f26b39a2b04611723f8faa2f77f77fd30f9c4cc95d21206
SSDEEP 6144:Ko5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:KmSuOcHmnYhrDMTrban4qM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1408-1-0x00000000012D0000-0x00000000012F9000-memory.dmp

Download

memory/1408-5-0x00000000012D0000-0x00000000012F9000-memory.dmp

Download

memory/1944-22-0x0000000002F00000-0x00000000031C9000-memory.dmp

Download

memory/1944-24-0x0000000000F30000-0x0000000000F59000-memory.dmp

Download

memory/1944-11-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/1944-15-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/1944-10-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/1944-21-0x0000000002E40000-0x0000000002EFE000-memory.dmp

Download

memory/1944-9-0x0000000000F30000-0x0000000000F59000-memory.dmp

Download

memory/2968-17-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/2968-23-0x000002B94FCC0000-0x000002B94FCC1000-memory.dmp

Download

memory/3812-28-0x0000000000D20000-0x0000000000D49000-memory.dmp

Download

memory/3812-39-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/3812-41-0x0000000001780000-0x0000000001A49000-memory.dmp

Download

memory/3812-40-0x00000000016C0000-0x000000000177E000-memory.dmp

Download

memory/3812-42-0x0000000000D20000-0x0000000000D49000-memory.dmp

Download

memory/3964-44-0x0000000010000000-0x000000001001F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads