Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 18:45
General
- Target 047575c876534a9bb46e417260a43b4b4a8057842a107c170a152a394c1f8544.exe
- Size 843KB
- Sample260601-xd4dvsey2j
- SHA256 047575c876534a9bb46e417260a43b4b4a8057842a107c170a152a394c1f8544
Malware Config
Signatures
- Family: Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
- Executes dropped EXE 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\047575c876534a9bb46e417260a43b4b4a8057842a107c170a152a394c1f8544.exe"C:\Users\Admin\AppData\Local\Temp\047575c876534a9bb46e417260a43b4b4a8057842a107c170a152a394c1f8544.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\WinNetCore\027373c874332a9bb24c217240a23b2b2a8037822a107c170a132a392c1d8322.exeC:\Users\Admin\AppData\Roaming\WinNetCore\027373c874332a9bb24c217240a23b2b2a8037822a107c170a132a392c1d8322.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\WinNetCore\027373c874332a9bb24c217240a23b2b2a8037822a107c170a132a392c1d8322.exeC:\Users\Admin\AppData\Roaming\WinNetCore\027373c874332a9bb24c217240a23b2b2a8037822a107c170a132a392c1d8322.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
027373c874332a9bb24c217240a23b2b2a8037822a107c170a132a392c1d8322.exe
CompleteCheckpoint.txt
memory/1400-16-0x000001F896870000-0x000001F896892000-memory.dmp
memory/1400-19-0x000001F896870000-0x000001F896892000-memory.dmp
memory/2684-2-0x0000000000C50000-0x0000000000C7F000-memory.dmp
memory/2684-3-0x0000000002320000-0x0000000002350000-memory.dmp
memory/2684-1-0x0000000002320000-0x0000000002350000-memory.dmp
memory/2684-4-0x0000000002390000-0x0000000002391000-memory.dmp
memory/2684-5-0x0000000010000000-0x0000000010005000-memory.dmp
memory/2684-7-0x0000000002320000-0x0000000002350000-memory.dmp
memory/2684-0-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/3940-9-0x000002087A500000-0x000002087A522000-memory.dmp
memory/3940-6-0x000002087A500000-0x000002087A522000-memory.dmp
memory/4976-14-0x0000000002300000-0x0000000002301000-memory.dmp
memory/4976-15-0x0000000010000000-0x0000000010005000-memory.dmp
memory/4976-17-0x0000000002350000-0x0000000002380000-memory.dmp
memory/4976-13-0x0000000002350000-0x0000000002380000-memory.dmp