trickbot | 0923b78ac186b8160a285213a0aa3452254bb0bddccf2797062a0533c825c8f8

General

Target

a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe
Size

368KB
MD5

47f1d885fac2c01cce8ba63245fc3f7c
SHA1

bf1c2aa2d3285f6632a10d56e65c0281032f7a0c
SHA256

a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e
SHA512

a3967d47ef3c9e4e4352055a5132ed4c8b1d4b5e4ce874a688eb780c1f213a36ff2a9ef44911a7c100af4f520c1003d0c07eb92aa73e551cf7d95a97f29a7719
SSDEEP

6144:Fo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4q6:FmSuOcHmnYhrDMTrban4q6

Score

10^/10

trickbot banker evasion execution trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/824-1-0x0000000000180000-0x00000000001A9000-memory.dmp	trickbot_loader32
behavioral1/memory/824-6-0x0000000000180000-0x00000000001A9000-memory.dmp	trickbot_loader32
behavioral1/memory/1744-10-0x0000000000200000-0x0000000000229000-memory.dmp	trickbot_loader32
behavioral1/memory/1744-21-0x0000000000200000-0x0000000000229000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

Processes:

a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exea7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

pid	process
1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
1268	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

Loads dropped DLL 1 IoCs

Processes:

a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe

pid process

824 a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

796 sc.exe
2808 sc.exe
2636 sc.exe
2740 sc.exe

pid	process
796	sc.exe
2808	sc.exe
2636	sc.exe
2740	sc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exea7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exepowershell.exepowershell.exe

pid	process
824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe
824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe
824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe
1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
2648	powershell.exe
2820	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exea7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

description	pid	process
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeTcbPrivilege	1268	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.execmd.exea7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.execmd.execmd.execmd.exe

description	pid	process	target process
PID 824 wrote to memory of 1764	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 1764	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 1764	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 1764	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 2216	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 2216	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 2216	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 2216	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 884	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 884	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 884	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 884	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	cmd.exe
PID 824 wrote to memory of 1744	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
PID 824 wrote to memory of 1744	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
PID 824 wrote to memory of 1744	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
PID 824 wrote to memory of 1744	824	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
PID 1764 wrote to memory of 796	1764	cmd.exe	sc.exe
PID 1764 wrote to memory of 796	1764	cmd.exe	sc.exe
PID 1764 wrote to memory of 796	1764	cmd.exe	sc.exe
PID 1764 wrote to memory of 796	1764	cmd.exe	sc.exe
PID 1744 wrote to memory of 3008	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 3008	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 3008	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 3008	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2852	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2852	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2852	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2852	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2824	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2824	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2824	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 1744 wrote to memory of 2824	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	cmd.exe
PID 2216 wrote to memory of 2808	2216	cmd.exe	sc.exe
PID 2216 wrote to memory of 2808	2216	cmd.exe	sc.exe
PID 2216 wrote to memory of 2808	2216	cmd.exe	sc.exe
PID 2216 wrote to memory of 2808	2216	cmd.exe	sc.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 884 wrote to memory of 2820	884	cmd.exe	powershell.exe
PID 884 wrote to memory of 2820	884	cmd.exe	powershell.exe
PID 884 wrote to memory of 2820	884	cmd.exe	powershell.exe
PID 884 wrote to memory of 2820	884	cmd.exe	powershell.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 1744 wrote to memory of 2608	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	svchost.exe
PID 3008 wrote to memory of 2636	3008	cmd.exe	sc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe
"C:\Users\Admin\AppData\Local\Temp\a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
3⤵
- Launches sc.exe
PID:796

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
3⤵
- Launches sc.exe
PID:2808

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
4⤵
- Launches sc.exe
PID:2636

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
3⤵
PID:2852

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
4⤵
- Launches sc.exe
PID:2740

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
PID:2824

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2608

C:\Windows\system32\taskeng.exe
taskeng.exe {2612F171-E762-4831-A728-35983C287F49} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:484

C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

Filesize
1KB

MD5
06d6699042f14b56b13f442ee525ea17

SHA1
17046fb36de269fd8a84b1bff1e3dea148b4a170

SHA256
e5e9da6f18d7903ea832cf17860aaba859c7b2d7c97072cba8f530b17b3a2196

SHA512
314b8f148806cdef1d47ab9abe6f2a14ca19d9bf79bb8f55f34f0e682bab65e2b2392e962fd3e7905ba579c36657055002f6058dcfcb054be2cabf787006a4f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
de46260b39c51efebdebdfb29a915daa

SHA1
2eb62191bfa9b9707c5cd74af136375237d8b392

SHA256
a0a681aeac02ed6ae61ab6d29e524a521de0e7ac6d24943a01d839c258641705

SHA512
1720e4f5e8f97faf118bef77de3638a8657b46082c45b96fd0a37947b167381908e3af1bde56ac408db560eb84c6e144a2187dacaf789388fa2d47681f62f777

Download Submit
\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

Filesize
368KB

MD5
47f1d885fac2c01cce8ba63245fc3f7c

SHA1
bf1c2aa2d3285f6632a10d56e65c0281032f7a0c

SHA256
a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e

SHA512
a3967d47ef3c9e4e4352055a5132ed4c8b1d4b5e4ce874a688eb780c1f213a36ff2a9ef44911a7c100af4f520c1003d0c07eb92aa73e551cf7d95a97f29a7719

Download Submit
memory/824-1-0x0000000000180000-0x00000000001A9000-memory.dmp

Filesize
164KB

Download
memory/824-6-0x0000000000180000-0x00000000001A9000-memory.dmp

Filesize
164KB

Download
memory/1744-12-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1744-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1744-10-0x0000000000200000-0x0000000000229000-memory.dmp

Filesize
164KB

Download
memory/1744-21-0x0000000000200000-0x0000000000229000-memory.dmp

Filesize
164KB

Download
memory/2608-17-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2608-22-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2608-16-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads