trickbot | 1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920d

Analysis

max time kernel
112s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe
Size

368KB
MD5

0299c604638cc6ff16f297ca88c4bd20
SHA1

efd6e32d0d89596018539abb0a905e676d9f4ef5
SHA256

1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920d
SHA512

27dae8fe235b24d2aff0161018568015f891ea2fabc3c4495768f079bc50f4fb6ef164ec2fbe9d316619e282ba27afbe6bccc56a415cf40ae2634126fb5c1bc7
SSDEEP

6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qA:emSuOcHmnYhrDMTrban4qA

Score

10^/10

trickbot banker discovery trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Trickbot family
trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4400-1-0x0000000001010000-0x0000000001039000-memory.dmp	trickbot_loader32
behavioral2/memory/4400-6-0x0000000001010000-0x0000000001039000-memory.dmp	trickbot_loader32
behavioral2/memory/3928-9-0x0000000000BC0000-0x0000000000BE9000-memory.dmp	trickbot_loader32
behavioral2/memory/3928-24-0x0000000000BC0000-0x0000000000BE9000-memory.dmp	trickbot_loader32
behavioral2/memory/4692-28-0x0000000000ED0000-0x0000000000EF9000-memory.dmp	trickbot_loader32
behavioral2/memory/4692-42-0x0000000000ED0000-0x0000000000EF9000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3928	4400	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe	84
PID 4400 wrote to memory of 3928	4400	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe	84
PID 4400 wrote to memory of 3928	4400	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe	84
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 3928 wrote to memory of 2772	3928	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	86
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108
PID 4692 wrote to memory of 3260	4692	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe
"C:\Users\Admin\AppData\Local\Temp\1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
  C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2772

C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2437139445-1151884604-3026847218-1000\0f5007522459c86e95ffcc62f32308f1_4304acb9-c3f6-452a-9860-eb4e85d38d4e

Filesize
1KB

MD5
aa6a46e1b2dcf0512ea87f2448648de7

SHA1
ed8df49e2c4aa709189f6a3375a7e755f6776f5d

SHA256
00061ea057d24c99be2914bb273ff5135cd832e4ce6a94f9613cba4b49128302

SHA512
90b3b3b7ae68e1e850c0d925d6a86cbcb0e719c9d5368c566ddd463677ca000e81ad2342425e068175635bdca474ef8fffe9876192e1fb3f983fb750e5312413

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

Filesize
368KB

MD5
0299c604638cc6ff16f297ca88c4bd20

SHA1
efd6e32d0d89596018539abb0a905e676d9f4ef5

SHA256
1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920d

SHA512
27dae8fe235b24d2aff0161018568015f891ea2fabc3c4495768f079bc50f4fb6ef164ec2fbe9d316619e282ba27afbe6bccc56a415cf40ae2634126fb5c1bc7

Download Submit
memory/2772-17-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2772-21-0x000001CE3A6B0000-0x000001CE3A6B1000-memory.dmp

Filesize
4KB

Download
memory/2772-16-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/3260-44-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/3928-10-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3928-23-0x0000000002850000-0x0000000002B19000-memory.dmp

Filesize
2.8MB

Download
memory/3928-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3928-9-0x0000000000BC0000-0x0000000000BE9000-memory.dmp

Filesize
164KB

Download
memory/3928-15-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/3928-22-0x0000000002750000-0x000000000280E000-memory.dmp

Filesize
760KB

Download
memory/3928-24-0x0000000000BC0000-0x0000000000BE9000-memory.dmp

Filesize
164KB

Download
memory/4400-1-0x0000000001010000-0x0000000001039000-memory.dmp

Filesize
164KB

Download
memory/4400-6-0x0000000001010000-0x0000000001039000-memory.dmp

Filesize
164KB

Download
memory/4692-28-0x0000000000ED0000-0x0000000000EF9000-memory.dmp

Filesize
164KB

Download
memory/4692-34-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/4692-40-0x0000000001740000-0x00000000017FE000-memory.dmp

Filesize
760KB

Download
memory/4692-41-0x0000000001800000-0x0000000001AC9000-memory.dmp

Filesize
2.8MB

Download
memory/4692-42-0x0000000000ED0000-0x0000000000EF9000-memory.dmp

Filesize
164KB

Download