trickbot | 0923b78ac186b8160a285213a0aa3452254bb0bddccf2797062a0533c825c8f8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe
Size

368KB
MD5

47f1d885fac2c01cce8ba63245fc3f7c
SHA1

bf1c2aa2d3285f6632a10d56e65c0281032f7a0c
SHA256

a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e
SHA512

a3967d47ef3c9e4e4352055a5132ed4c8b1d4b5e4ce874a688eb780c1f213a36ff2a9ef44911a7c100af4f520c1003d0c07eb92aa73e551cf7d95a97f29a7719
SSDEEP

6144:Fo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4q6:FmSuOcHmnYhrDMTrban4q6

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3508-1-0x0000000001410000-0x0000000001439000-memory.dmp	trickbot_loader32
behavioral2/memory/3508-6-0x0000000001410000-0x0000000001439000-memory.dmp	trickbot_loader32
behavioral2/memory/1056-9-0x0000000001440000-0x0000000001469000-memory.dmp	trickbot_loader32
behavioral2/memory/1056-24-0x0000000001440000-0x0000000001469000-memory.dmp	trickbot_loader32
behavioral2/memory/1744-28-0x00000000009B0000-0x00000000009D9000-memory.dmp	trickbot_loader32
behavioral2/memory/1744-42-0x00000000009B0000-0x00000000009D9000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1056	3508	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	85
PID 3508 wrote to memory of 1056	3508	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	85
PID 3508 wrote to memory of 1056	3508	a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe	85
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1056 wrote to memory of 1640	1056	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	86
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93
PID 1744 wrote to memory of 868	1744	a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe
"C:\Users\Admin\AppData\Local\Temp\a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
  C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1640

C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1750093773-264148664-1320403265-1000\0f5007522459c86e95ffcc62f32308f1_46967d70-72aa-405b-b21a-7603bc5aaaad

Filesize
1KB

MD5
d9df93627a996687174379880f170b67

SHA1
7ce545dad2cc3c3f7fc2203fffcb6a82bf294fe6

SHA256
0e3cb4819c99dd5a3a39f46607976aef86ccf4190ee3c12104e13395e0c17a21

SHA512
6c8cc55ad7e879b3a36b6400565a06085824080e361affc62ebded0c4406399d1eb1a76d015a51248190578e78f341bb81ef0fb0235e33ab8fe7e4cd28e72f0f

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\a7ca9893cd3827863c9b79a4ebc0cc0a6d703920efd7de823209e7aacbff074e.exe

Filesize
368KB

MD5
47f1d885fac2c01cce8ba63245fc3f7c

SHA1
bf1c2aa2d3285f6632a10d56e65c0281032f7a0c

SHA256
a6ca9783cd3726753c9b69a4ebc0cc0a5d603920efd6de723209e6aacbff064e

SHA512
a3967d47ef3c9e4e4352055a5132ed4c8b1d4b5e4ce874a688eb780c1f213a36ff2a9ef44911a7c100af4f520c1003d0c07eb92aa73e551cf7d95a97f29a7719

Download Submit
memory/868-44-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1056-15-0x00000000017A0000-0x00000000017A1000-memory.dmp

Filesize
4KB

Download
memory/1056-21-0x00000000032F0000-0x00000000033AE000-memory.dmp

Filesize
760KB

Download
memory/1056-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1056-22-0x00000000033B0000-0x0000000003679000-memory.dmp

Filesize
2.8MB

Download
memory/1056-9-0x0000000001440000-0x0000000001469000-memory.dmp

Filesize
164KB

Download
memory/1056-24-0x0000000001440000-0x0000000001469000-memory.dmp

Filesize
164KB

Download
memory/1640-16-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1640-23-0x0000029F71450000-0x0000029F71451000-memory.dmp

Filesize
4KB

Download
memory/1640-17-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1744-28-0x00000000009B0000-0x00000000009D9000-memory.dmp

Filesize
164KB

Download
memory/1744-41-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1744-39-0x00000000015D0000-0x000000000168E000-memory.dmp

Filesize
760KB

Download
memory/1744-40-0x0000000001690000-0x0000000001959000-memory.dmp

Filesize
2.8MB

Download
memory/1744-42-0x00000000009B0000-0x00000000009D9000-memory.dmp

Filesize
164KB

Download
memory/3508-1-0x0000000001410000-0x0000000001439000-memory.dmp

Filesize
164KB

Download
memory/3508-6-0x0000000001410000-0x0000000001439000-memory.dmp

Filesize
164KB

Download