Analysis

  • max time kernel
    112s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2024 07:45

General

  • Target

    31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe

  • Size

    690KB

  • MD5

    79ae01e5eef805e95de9f8de445e0970

  • SHA1

    d971be5391a387ef962644254cf64e25128285b2

  • SHA256

    31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9

  • SHA512

    a35b7cf3841355d3283bcea01c2d368d821992e807df1fd5179f576d1034b38d13345b1d917dda598255e38bb206ecbd7700ef11ba84b67039319d3e667aa7cf

  • SSDEEP

    12288:zJB0lh5aILwtFPCfmAUt3r4DwpRrKO1YYVhiiSw9:zQ5aILMCfmAUhrSO1YNq9

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe
    "C:\Users\Admin\AppData\Local\Temp\31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:4836
    • C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:2024

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe

        Filesize

        690KB

        MD5

        79ae01e5eef805e95de9f8de445e0970

        SHA1

        d971be5391a387ef962644254cf64e25128285b2

        SHA256

        31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9

        SHA512

        a35b7cf3841355d3283bcea01c2d368d821992e807df1fd5179f576d1034b38d13345b1d917dda598255e38bb206ecbd7700ef11ba84b67039319d3e667aa7cf

      • memory/3572-18-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/3572-13-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-3-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-12-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-11-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-10-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-9-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-8-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-7-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-6-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-5-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-2-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-16-0x0000000002BC0000-0x0000000002BE9000-memory.dmp

        Filesize

        164KB

      • memory/3572-15-0x0000000000421000-0x0000000000422000-memory.dmp

        Filesize

        4KB

      • memory/3572-4-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/3572-14-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

        Filesize

        4KB

      • memory/4008-70-0x0000000000421000-0x0000000000422000-memory.dmp

        Filesize

        4KB

      • memory/4008-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

        Filesize

        4KB

      • memory/4008-71-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/4600-36-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-33-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-26-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-29-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-52-0x0000000002B70000-0x0000000002C2E000-memory.dmp

        Filesize

        760KB

      • memory/4600-53-0x0000000003170000-0x0000000003439000-memory.dmp

        Filesize

        2.8MB

      • memory/4600-41-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/4600-42-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/4600-40-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/4600-30-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-34-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-35-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-37-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-31-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-32-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-27-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4600-28-0x0000000002140000-0x0000000002141000-memory.dmp

        Filesize

        4KB

      • memory/4836-46-0x0000000010000000-0x000000001001E000-memory.dmp

        Filesize

        120KB

      • memory/4836-47-0x0000000010000000-0x000000001001E000-memory.dmp

        Filesize

        120KB

      • memory/4836-51-0x000001CD1B9E0000-0x000001CD1B9E1000-memory.dmp

        Filesize

        4KB