trickbot | 8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/03/2025, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe
Size

368KB
MD5

15fc662938c9c080b36dc7152e430a89
SHA1

f02053869e205a7f28c83b1ec33aa0977ff7e368
SHA256

8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1
SHA512

856aa7ff912530589668eea31668f72db7e0aa3693e625fa20a4f1867381bb28ec0b79d0e51b9796eb79c727c6ff184b29953b27f601427f454b31e070e0c87c
SSDEEP

6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qT:emSuOcHmnYhrDMTrban4qT

Score

10^/10

trickbot banker defense_evasion discovery evasion execution trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Trickbot family
trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/2444-1-0x00000000000F0000-0x0000000000119000-memory.dmp	trickbot_loader32
behavioral1/memory/2444-6-0x00000000000F0000-0x0000000000119000-memory.dmp	trickbot_loader32
behavioral1/memory/2752-10-0x0000000000080000-0x00000000000A9000-memory.dmp	trickbot_loader32
behavioral1/memory/2752-20-0x0000000000080000-0x00000000000A9000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe
2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe

Loads dropped DLL 1 IoCs

pid	Process
2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2596	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2848	sc.exe
2716	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe
2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe
2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe
2596	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeTcbPrivilege	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2448	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	30
PID 2444 wrote to memory of 2448	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	30
PID 2444 wrote to memory of 2448	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	30
PID 2444 wrote to memory of 2448	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	30
PID 2444 wrote to memory of 2748	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	31
PID 2444 wrote to memory of 2748	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	31
PID 2444 wrote to memory of 2748	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	31
PID 2444 wrote to memory of 2748	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	31
PID 2444 wrote to memory of 2884	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	34
PID 2444 wrote to memory of 2884	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	34
PID 2444 wrote to memory of 2884	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	34
PID 2444 wrote to memory of 2884	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	34
PID 2448 wrote to memory of 2848	2448	cmd.exe	37
PID 2448 wrote to memory of 2848	2448	cmd.exe	37
PID 2448 wrote to memory of 2848	2448	cmd.exe	37
PID 2448 wrote to memory of 2848	2448	cmd.exe	37
PID 2748 wrote to memory of 2716	2748	cmd.exe	36
PID 2748 wrote to memory of 2716	2748	cmd.exe	36
PID 2748 wrote to memory of 2716	2748	cmd.exe	36
PID 2748 wrote to memory of 2716	2748	cmd.exe	36
PID 2884 wrote to memory of 2596	2884	cmd.exe	38
PID 2884 wrote to memory of 2596	2884	cmd.exe	38
PID 2884 wrote to memory of 2596	2884	cmd.exe	38
PID 2884 wrote to memory of 2596	2884	cmd.exe	38
PID 2444 wrote to memory of 2752	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	39
PID 2444 wrote to memory of 2752	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	39
PID 2444 wrote to memory of 2752	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	39
PID 2444 wrote to memory of 2752	2444	8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe	39
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 2752 wrote to memory of 2756	2752	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	40
PID 960 wrote to memory of 2328	960	taskeng.exe	42
PID 960 wrote to memory of 2328	960	taskeng.exe	42
PID 960 wrote to memory of 2328	960	taskeng.exe	42
PID 960 wrote to memory of 2328	960	taskeng.exe	42
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43
PID 2328 wrote to memory of 328	2328	9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe
"C:\Users\Admin\AppData\Local\Temp\8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\Users\Admin\AppData\Roaming\WNetval\9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe
  C:\Users\Admin\AppData\Roaming\WNetval\9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2756

C:\Windows\system32\taskeng.exe
taskeng.exe {14A11B7E-F950-48DA-AB69-72B1640AE196} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Roaming\WNetval\9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe
  C:\Users\Admin\AppData\Roaming\WNetval\9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411

Filesize
1KB

MD5
5d36db0740203ca801377a001784b5f7

SHA1
0c89df01c35cadea44e5ab6fe818f2cdd10361fe

SHA256
dcca23d96ca88ee28f0fcbef4b1ca918bfb52b5f2d1919cec24c4aab775c24ab

SHA512
33b4ce616ae041a4be8d0060d3951065117e6dc777d6c91d02a4dfcbbcb6a2043f47536194cfbd47ead2db668e2a4725efb7becb3429f94851c889fd7f12b9a8

Download Submit
C:\Users\Admin\AppData\Roaming\WNetval\9ea99830f9b79047b9cbc67613cfe4bbbd4bec7e23f499319abc02a1b273e1c1.exe

Filesize
368KB

MD5
15fc662938c9c080b36dc7152e430a89

SHA1
f02053869e205a7f28c83b1ec33aa0977ff7e368

SHA256
8ea98730f9b69046b9cbc56513cfe4bbbd4bec6e23f488318abc02a1b263e1c1

SHA512
856aa7ff912530589668eea31668f72db7e0aa3693e625fa20a4f1867381bb28ec0b79d0e51b9796eb79c727c6ff184b29953b27f601427f454b31e070e0c87c

Download Submit
memory/2444-1-0x00000000000F0000-0x0000000000119000-memory.dmp

Filesize
164KB

Download
memory/2444-6-0x00000000000F0000-0x0000000000119000-memory.dmp

Filesize
164KB

Download
memory/2752-10-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/2752-12-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2752-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2752-20-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/2756-15-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2756-16-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download