trickbot | 1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe
Size

368KB
MD5

0299c604638cc6ff16f297ca88c4bd20
SHA1

efd6e32d0d89596018539abb0a905e676d9f4ef5
SHA256

1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920d
SHA512

27dae8fe235b24d2aff0161018568015f891ea2fabc3c4495768f079bc50f4fb6ef164ec2fbe9d316619e282ba27afbe6bccc56a415cf40ae2634126fb5c1bc7
SSDEEP

6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qA:emSuOcHmnYhrDMTrban4qA

Score

10^/10

trickbot banker discovery trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Trickbot family
trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3836-1-0x00000000012A0000-0x00000000012C9000-memory.dmp	trickbot_loader32
behavioral2/memory/4940-9-0x0000000001310000-0x0000000001339000-memory.dmp	trickbot_loader32
behavioral2/memory/3836-8-0x00000000012A0000-0x00000000012C9000-memory.dmp	trickbot_loader32
behavioral2/memory/4940-24-0x0000000001310000-0x0000000001339000-memory.dmp	trickbot_loader32
behavioral2/memory/1400-28-0x0000000001120000-0x0000000001149000-memory.dmp	trickbot_loader32
behavioral2/memory/1400-42-0x0000000001120000-0x0000000001149000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 4940	3836	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe	84
PID 3836 wrote to memory of 4940	3836	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe	84
PID 3836 wrote to memory of 4940	3836	1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe	84
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 4940 wrote to memory of 116	4940	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	85
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107
PID 1400 wrote to memory of 4940	1400	1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe
"C:\Users\Admin\AppData\Local\Temp\1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920dN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
  C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:116

C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2437139445-1151884604-3026847218-1000\0f5007522459c86e95ffcc62f32308f1_4304acb9-c3f6-452a-9860-eb4e85d38d4e

Filesize
1KB

MD5
975ad38091464bfbd3ef20f6e25d9f4a

SHA1
42520d818bb6a5795da2bdb935d7f603b7b1a0fb

SHA256
0612681df5780cec41631224dfb70b15dcb0993bdc0ab445f85391c1ad9035a9

SHA512
d8db34dafa333e7006a273dd1b4db9bbb6fb2d9a143766832434f17e8da8ef98acdf66202250e4396f3cb47813cfa5f39c0d3fa95fa5ee27ab00d707ee7262d3

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\1b28f0b60dd6d28f49443fe0bb9f94d8d1f1ceb1402f401899d7e0d96932920dN.exe

Filesize
368KB

MD5
0299c604638cc6ff16f297ca88c4bd20

SHA1
efd6e32d0d89596018539abb0a905e676d9f4ef5

SHA256
1b27f0b50dd5d27f48443fe0bb8f94d7d1f1ceb1402f401799d6e0d95832920d

SHA512
27dae8fe235b24d2aff0161018568015f891ea2fabc3c4495768f079bc50f4fb6ef164ec2fbe9d316619e282ba27afbe6bccc56a415cf40ae2634126fb5c1bc7

Download Submit
memory/116-16-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/116-21-0x000002B7C83F0000-0x000002B7C83F1000-memory.dmp

Filesize
4KB

Download
memory/1400-42-0x0000000001120000-0x0000000001149000-memory.dmp

Filesize
164KB

Download
memory/1400-41-0x0000000001CD0000-0x0000000001F99000-memory.dmp

Filesize
2.8MB

Download
memory/1400-40-0x0000000001C10000-0x0000000001CCE000-memory.dmp

Filesize
760KB

Download
memory/1400-34-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download
memory/1400-28-0x0000000001120000-0x0000000001149000-memory.dmp

Filesize
164KB

Download
memory/3836-8-0x00000000012A0000-0x00000000012C9000-memory.dmp

Filesize
164KB

Download
memory/3836-1-0x00000000012A0000-0x00000000012C9000-memory.dmp

Filesize
164KB

Download
memory/4940-22-0x0000000002FF0000-0x00000000030AE000-memory.dmp

Filesize
760KB

Download
memory/4940-24-0x0000000001310000-0x0000000001339000-memory.dmp

Filesize
164KB

Download
memory/4940-23-0x00000000030B0000-0x0000000003379000-memory.dmp

Filesize
2.8MB

Download
memory/4940-15-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/4940-10-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4940-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4940-9-0x0000000001310000-0x0000000001339000-memory.dmp

Filesize
164KB

Download
memory/4940-44-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download