trickbot | 6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-09-2024 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe
Size

368KB
MD5

6452209126ede158ba01e86225835350
SHA1

16441c96e85e9d96353209ceb4b2a3970e067bcb
SHA256

6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13
SHA512

f73b9a9514388c619fb6873f8c1695b7accc00bf0151c96b6507f704fdd7f816bbf3fccd1f53e24ff005d553e6de4e5e8a010cfd180aa6148f5fd117f6499827
SSDEEP

6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qP:emSuOcHmnYhrDMTrban4qP

Score

10^/10

trickbot banker discovery evasion execution trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/2736-1-0x00000000000F0000-0x0000000000119000-memory.dmp	trickbot_loader32
behavioral1/memory/2736-6-0x00000000000F0000-0x0000000000119000-memory.dmp	trickbot_loader32
behavioral1/memory/2564-10-0x0000000000260000-0x0000000000289000-memory.dmp	trickbot_loader32
behavioral1/memory/2564-20-0x0000000000260000-0x0000000000289000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
2116	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe

Loads dropped DLL 1 IoCs

pid	Process
2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2644	powershell.exe
2808	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2240	sc.exe
2668	sc.exe
536	sc.exe
880	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe
2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe
2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe
2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
2808	powershell.exe
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeTcbPrivilege	2116	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2720	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	30
PID 2736 wrote to memory of 2720	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	30
PID 2736 wrote to memory of 2720	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	30
PID 2736 wrote to memory of 2720	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	30
PID 2736 wrote to memory of 2688	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	31
PID 2736 wrote to memory of 2688	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	31
PID 2736 wrote to memory of 2688	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	31
PID 2736 wrote to memory of 2688	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	31
PID 2736 wrote to memory of 2776	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	32
PID 2736 wrote to memory of 2776	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	32
PID 2736 wrote to memory of 2776	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	32
PID 2736 wrote to memory of 2776	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	32
PID 2736 wrote to memory of 2564	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	36
PID 2736 wrote to memory of 2564	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	36
PID 2736 wrote to memory of 2564	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	36
PID 2736 wrote to memory of 2564	2736	6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe	36
PID 2776 wrote to memory of 2644	2776	cmd.exe	39
PID 2776 wrote to memory of 2644	2776	cmd.exe	39
PID 2776 wrote to memory of 2644	2776	cmd.exe	39
PID 2776 wrote to memory of 2644	2776	cmd.exe	39
PID 2688 wrote to memory of 2668	2688	cmd.exe	37
PID 2688 wrote to memory of 2668	2688	cmd.exe	37
PID 2688 wrote to memory of 2668	2688	cmd.exe	37
PID 2688 wrote to memory of 2668	2688	cmd.exe	37
PID 2564 wrote to memory of 2528	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	40
PID 2564 wrote to memory of 2528	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	40
PID 2564 wrote to memory of 2528	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	40
PID 2564 wrote to memory of 2528	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	40
PID 2720 wrote to memory of 2240	2720	cmd.exe	38
PID 2720 wrote to memory of 2240	2720	cmd.exe	38
PID 2720 wrote to memory of 2240	2720	cmd.exe	38
PID 2720 wrote to memory of 2240	2720	cmd.exe	38
PID 2564 wrote to memory of 2540	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	41
PID 2564 wrote to memory of 2540	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	41
PID 2564 wrote to memory of 2540	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	41
PID 2564 wrote to memory of 2540	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	41
PID 2564 wrote to memory of 2548	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	42
PID 2564 wrote to memory of 2548	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	42
PID 2564 wrote to memory of 2548	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	42
PID 2564 wrote to memory of 2548	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	42
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2564 wrote to memory of 2016	2564	7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe	44
PID 2540 wrote to memory of 536	2540	cmd.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe
"C:\Users\Admin\AppData\Local\Temp\6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\Users\Admin\AppData\Roaming\WNetval\7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
  C:\Users\Admin\AppData\Roaming\WNetval\7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    /c sc stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2528
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:880
- - C:\Windows\SysWOW64\cmd.exe
    /c sc delete WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\SysWOW64\sc.exe
      sc delete WinDefend
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:536
- - C:\Windows\SysWOW64\cmd.exe
    /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2548
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2016

C:\Windows\system32\taskeng.exe
taskeng.exe {D90BC3E2-6737-45EB-BF64-2FF1ECB156E9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1704
- C:\Users\Admin\AppData\Roaming\WNetval\7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
  C:\Users\Admin\AppData\Roaming\WNetval\7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55

Filesize
1KB

MD5
c90df9d425b8835e7bec4fb5944403fe

SHA1
8afc3d0ad3b4457e306c718c730328deadbde0d8

SHA256
f55efa4feb8f420cc25e0737ea287c426aa698c11690d27371f834b489bde7d1

SHA512
5467401a9b6efe8a25a595ea3ffeb965e01d36fa08985c75fd11b73d5f1b128fd410317eac1cfd28d735544d0fdeafb8cd5f5c034dab9ff41f180f1089d354e4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
3f0b11492a848ff5a1be66fa11a6a151

SHA1
748828dab37457a4bcec507581fa3200ff4023d2

SHA256
429c304afa49c3480c09d80cd90e6e6e1b7138d51ebe1654489e2847f7d6c7ed

SHA512
cff80c1ecc56c670184aec4bff278bcc8d50af2ec646bb7c515f0c031e2c463fb136efc57f052dfafdf4a875ab491b2390a5bf227eaeacf4da07936549616116

Download Submit
\Users\Admin\AppData\Roaming\WNetval\7db102eed1f6db1be39c03badad088403233999ac8fa8b9fa818d6c79919da13N.exe

Filesize
368KB

MD5
6452209126ede158ba01e86225835350

SHA1
16441c96e85e9d96353209ceb4b2a3970e067bcb

SHA256
6db102eed1f5db1be38c03badad077403233889ac7fa7b8fa717d5c69818da13

SHA512
f73b9a9514388c619fb6873f8c1695b7accc00bf0151c96b6507f704fdd7f816bbf3fccd1f53e24ff005d553e6de4e5e8a010cfd180aa6148f5fd117f6499827

Download Submit
memory/2016-16-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2016-15-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2564-10-0x0000000000260000-0x0000000000289000-memory.dmp

Filesize
164KB

Download
memory/2564-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2564-20-0x0000000000260000-0x0000000000289000-memory.dmp

Filesize
164KB

Download
memory/2564-12-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2736-1-0x00000000000F0000-0x0000000000119000-memory.dmp

Filesize
164KB

Download
memory/2736-6-0x00000000000F0000-0x0000000000119000-memory.dmp

Filesize
164KB

Download