Analysis
-
max time kernel
41s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 20:39
Static task
static1
1 signatures
General
-
Target
HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.7z
-
Size
335KB
-
MD5
d2d18e7e35cce588bf6779594f937bcb
-
SHA1
f4ababc87154a0d123f9d48649fdeb45efeacb6e
-
SHA256
b643e2f6d21b98fbdfe6f92b99d46fcd9cbc2495db75f2c903ae974af32d9e2b
-
SHA512
3394cced8ef623bfcc3e62daeb781e7f677afbf4c87a3d4ec089597a816f79d676d04f9f77d8417089e433d456eb3b4edb80bcad69ae46519a28828be4d473a0
-
SSDEEP
6144:Z9wvdT+2uGWv2bsBf10dx328KFkp9zDbuZJXbPGIFyrDcK4tz/HlVwxezB1:mRud2bAf10dROFC/uruIFynclZN
Malware Config
Signatures
-
Trickbot family
-
Executes dropped EXE 2 IoCs
pid Process 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 3224 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3164 3376 WerFault.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1564 7zFM.exe 3392 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1564 7zFM.exe Token: 35 1564 7zFM.exe Token: SeSecurityPrivilege 1564 7zFM.exe Token: SeDebugPrivilege 3392 taskmgr.exe Token: SeSystemProfilePrivilege 3392 taskmgr.exe Token: SeCreateGlobalPrivilege 3392 taskmgr.exe Token: SeDebugPrivilege 4436 wermgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1564 7zFM.exe 1564 7zFM.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe 3392 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 3224 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 3224 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3376 wrote to memory of 4436 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 101 PID 3376 wrote to memory of 4436 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 101 PID 3376 wrote to memory of 3488 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 102 PID 3376 wrote to memory of 3488 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 102 PID 3376 wrote to memory of 4436 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 101 PID 3376 wrote to memory of 4436 3376 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 101 PID 3224 wrote to memory of 1200 3224 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 115 PID 3224 wrote to memory of 1200 3224 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 115 PID 3224 wrote to memory of 2260 3224 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 116 PID 3224 wrote to memory of 2260 3224 HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe 116
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1564
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3392
-
C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵PID:3488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 5602⤵
- Program crash
PID:3164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3376 -ip 33761⤵PID:1860
-
C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵PID:1200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win64.Trickster.gen-1e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d.exe
Filesize612KB
MD5a0b517568d226e3ebb915aab9ebe39bb
SHA16e686b86391271c942b11d7d936266a1fff56f05
SHA2561e1ade90e013ef2bfff89c4dc84e9258e35b7794105ed793370b81e778404d2d
SHA512688c93dc5140fd0a4e47c5aefd97b7dc1dc99e6469d00742749d3506b4e5fb92804f7a0e789bde157fc101babd061b11785ccb6f37e6f96e5c3c5a20d4be1c73