trickbot | 3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f

Analysis

max time kernel
75s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe
Size

368KB
MD5

4bb384ef166aa19a6a08f22accccca8e
SHA1

ef112992ffaf5b43e4a0235c5f3a7562c4fb6a85
SHA256

3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f
SHA512

47bf71ac953348888fbdcd424252145c1263cce65f01ed6a8f74284455400d02c78e9841a6a787076f26b39a2b04611723f8faa2f77f77fd30f9c4cc95d21206
SSDEEP

6144:Ko5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:KmSuOcHmnYhrDMTrban4qM

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1408-1-0x00000000012D0000-0x00000000012F9000-memory.dmp	trickbot_loader32
behavioral2/memory/1408-5-0x00000000012D0000-0x00000000012F9000-memory.dmp	trickbot_loader32
behavioral2/memory/1944-9-0x0000000000F30000-0x0000000000F59000-memory.dmp	trickbot_loader32
behavioral2/memory/1944-24-0x0000000000F30000-0x0000000000F59000-memory.dmp	trickbot_loader32
behavioral2/memory/3812-28-0x0000000000D20000-0x0000000000D49000-memory.dmp	trickbot_loader32
behavioral2/memory/3812-42-0x0000000000D20000-0x0000000000D49000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1944	1408	3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe	88
PID 1408 wrote to memory of 1944	1408	3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe	88
PID 1408 wrote to memory of 1944	1408	3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe	88
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 1944 wrote to memory of 2968	1944	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	89
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101
PID 3812 wrote to memory of 3964	3812	3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe
"C:\Users\Admin\AppData\Local\Temp\3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
  C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
1⤵
PID:4968

C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\0f5007522459c86e95ffcc62f32308f1_d2547453-e731-4fdf-8f92-95f955a44aca

Filesize
1KB

MD5
afaf54ba7fbb1fd78b0db5948f6a5726

SHA1
fd5bb40e247e334ef52ca6b0b91fa7acaf9e9663

SHA256
6b6d851bca867c0b8035ca2b063d5a97831b73c2bf7d0f1d0c3535b08ecc3495

SHA512
1288e691a896ff0e1e855a527d5032536789986e05c5bb48cbf80ae183712afaab6a1524d39c70e369b15e906701111dfa5e8888d37c889370147ccb6f0f50a1

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\3ba99e304fe2979264214b1c029c3d791d82a89ca01b9d0c43c9d89f07e96c9f.exe

Filesize
368KB

MD5
4bb384ef166aa19a6a08f22accccca8e

SHA1
ef112992ffaf5b43e4a0235c5f3a7562c4fb6a85

SHA256
3ba98e304fe2868254214b1c028c3d691d72a79ca01b8d0c43c9d79f06e95c8f

SHA512
47bf71ac953348888fbdcd424252145c1263cce65f01ed6a8f74284455400d02c78e9841a6a787076f26b39a2b04611723f8faa2f77f77fd30f9c4cc95d21206

Download Submit
memory/1408-1-0x00000000012D0000-0x00000000012F9000-memory.dmp

Filesize
164KB

Download
memory/1408-5-0x00000000012D0000-0x00000000012F9000-memory.dmp

Filesize
164KB

Download
memory/1944-22-0x0000000002F00000-0x00000000031C9000-memory.dmp

Filesize
2.8MB

Download
memory/1944-24-0x0000000000F30000-0x0000000000F59000-memory.dmp

Filesize
164KB

Download
memory/1944-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1944-15-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/1944-10-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1944-21-0x0000000002E40000-0x0000000002EFE000-memory.dmp

Filesize
760KB

Download
memory/1944-9-0x0000000000F30000-0x0000000000F59000-memory.dmp

Filesize
164KB

Download
memory/2968-17-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2968-23-0x000002B94FCC0000-0x000002B94FCC1000-memory.dmp

Filesize
4KB

Download
memory/3812-28-0x0000000000D20000-0x0000000000D49000-memory.dmp

Filesize
164KB

Download
memory/3812-39-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/3812-41-0x0000000001780000-0x0000000001A49000-memory.dmp

Filesize
2.8MB

Download
memory/3812-40-0x00000000016C0000-0x000000000177E000-memory.dmp

Filesize
760KB

Download
memory/3812-42-0x0000000000D20000-0x0000000000D49000-memory.dmp

Filesize
164KB

Download
memory/3964-44-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download