Analysis

  • max time kernel
    112s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2024 01:19

General

  • Target

    89c781b880bc397884b03e877205616178e69584b12804296ec031c82547b0a7N.exe

  • Size

    368KB

  • MD5

    07d1fbe8618e1d42bd735c58ffa20540

  • SHA1

    6ec8c8fe9c50609182e23b6056f9e8fb1198479f

  • SHA256

    89c781b880bc397884b03e877205616178e69584b12804296ec031c82547b0a7

  • SHA512

    dbed22a6351f6a004effd57f0807ab6fe8d131ad5bbd10f8ba4dc4193a33b9f50c27fed078da7536c5462c1c2ec3536aa60ad56118ac75be191e36394cd9aee5

  • SSDEEP

    6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qb:emSuOcHmnYhrDMTrban4qb

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 6 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\89c781b880bc397884b03e877205616178e69584b12804296ec031c82547b0a7N.exe
    "C:\Users\Admin\AppData\Local\Temp\89c781b880bc397884b03e877205616178e69584b12804296ec031c82547b0a7N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Roaming\WNetval\99c891b990bc398994b03e988206717189e79694b12904297ec031c92648b0a8N.exe
      C:\Users\Admin\AppData\Roaming\WNetval\99c891b990bc398994b03e988206717189e79694b12904297ec031c92648b0a8N.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:412
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:4336
    • C:\Users\Admin\AppData\Roaming\WNetval\99c891b990bc398994b03e988206717189e79694b12904297ec031c92648b0a8N.exe
      C:\Users\Admin\AppData\Roaming\WNetval\99c891b990bc398994b03e988206717189e79694b12904297ec031c92648b0a8N.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:3252

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823

        Filesize

        1KB

        MD5

        7a3de9ad226cbf2b5e6390f2e2ade4a9

        SHA1

        036beec190aecaa602e0d3f6e710df81c25202cd

        SHA256

        c5c698e7e7aa57a75eab5d79ecbba859033d54a9c03c8c0e99da89a21a59850b

        SHA512

        c339668e9c4de647abac7222fc67f0bf1c6687ec83b08f44bc7f56ea4730d354088e730d059770f3c273c2bfd519375f786cdf26c9f7b602dd41356001bc9426

      • C:\Users\Admin\AppData\Roaming\WNetval\99c891b990bc398994b03e988206717189e79694b12904297ec031c92648b0a8N.exe

        Filesize

        368KB

        MD5

        07d1fbe8618e1d42bd735c58ffa20540

        SHA1

        6ec8c8fe9c50609182e23b6056f9e8fb1198479f

        SHA256

        89c781b880bc397884b03e877205616178e69584b12804296ec031c82547b0a7

        SHA512

        dbed22a6351f6a004effd57f0807ab6fe8d131ad5bbd10f8ba4dc4193a33b9f50c27fed078da7536c5462c1c2ec3536aa60ad56118ac75be191e36394cd9aee5

      • memory/412-10-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/412-20-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

        Filesize

        4KB

      • memory/412-9-0x0000000000C20000-0x0000000000C49000-memory.dmp

        Filesize

        164KB

      • memory/412-11-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/412-23-0x0000000002BB0000-0x0000000002E79000-memory.dmp

        Filesize

        2.8MB

      • memory/412-24-0x0000000000C20000-0x0000000000C49000-memory.dmp

        Filesize

        164KB

      • memory/412-22-0x0000000002AB0000-0x0000000002B6E000-memory.dmp

        Filesize

        760KB

      • memory/1344-41-0x0000000001800000-0x0000000001AC9000-memory.dmp

        Filesize

        2.8MB

      • memory/1344-28-0x0000000000AD0000-0x0000000000AF9000-memory.dmp

        Filesize

        164KB

      • memory/1344-42-0x0000000000AD0000-0x0000000000AF9000-memory.dmp

        Filesize

        164KB

      • memory/1344-40-0x0000000001740000-0x00000000017FE000-memory.dmp

        Filesize

        760KB

      • memory/1344-34-0x0000000001100000-0x0000000001101000-memory.dmp

        Filesize

        4KB

      • memory/3252-44-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/3412-1-0x0000000000390000-0x00000000003B9000-memory.dmp

        Filesize

        164KB

      • memory/3412-6-0x0000000000390000-0x00000000003B9000-memory.dmp

        Filesize

        164KB

      • memory/4336-21-0x0000018269070000-0x0000018269071000-memory.dmp

        Filesize

        4KB

      • memory/4336-16-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/4336-15-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB