trickbot | badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2.exe
Size 368KB
Sample260830-jwf5dshq5v
SHA256 badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2
MD5 57efed07d837d0c1efa111641bd7d9c6
SHA1 cd1f11c89837cfe5f67235abcb0663d9f5218794
SHA512 50b91b8fbbd1162a157b54ffb3481ef17452f93dbf50b9b73ca8e40bd7da593bc4295347a41c43488c26fae2fab309e9e743c481b5dec16384d748b7b99a80e1
SSDEEP 6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qc:emSuOcHmnYhrDMTrban4qc
TLSH
T10784A7FC56C61611B0ECCDB7C7129F6AF655BF535328B29A284C82BD702283F0259A77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery trickbot persistence trojan

Malware Config

Signatures

Family: Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/4636-1-0x0000000000C60000-0x0000000000C89000-memory.dmp	trickbot_loader32
behavioral1/memory/4080-9-0x00000000011C0000-0x00000000011E9000-memory.dmp	trickbot_loader32
behavioral1/memory/4080-24-0x00000000011C0000-0x00000000011E9000-memory.dmp	trickbot_loader32
behavioral1/memory/4636-8-0x0000000000C60000-0x0000000000C89000-memory.dmp	trickbot_loader32
behavioral1/memory/3584-28-0x0000000000660000-0x0000000000689000-memory.dmp	trickbot_loader32
behavioral1/memory/3584-42-0x0000000000660000-0x0000000000689000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4080	4636	badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2.exe	85
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 4080 wrote to memory of 5132	4080	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	86
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 3584 wrote to memory of 5772	3584	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	94
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106
PID 5088 wrote to memory of 2948	5088	badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2.exe
"C:\Users\Admin\AppData\Local\Temp\badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Roaming\WNetval\badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
  C:\Users\Admin\AppData\Roaming\WNetval\badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:5132

C:\Users\Admin\AppData\Roaming\WNetval\badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
C:\Users\Admin\AppData\Roaming\WNetval\badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:5772

C:\Users\Admin\AppData\Roaming\WNetval\badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
C:\Users\Admin\AppData\Roaming\WNetval\badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f5007522459c86e95ffcc62f32308f1_c3d0e1da-bcea-48f7-86a8-212b4e5f9c90

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3053180483-1881419501-3594244048-1000\0f5007522459c86e95ffcc62f32308f1_c3d0e1da-bcea-48f7-86a8-212b4e5f9c90
Size 1KB
SHA256 053786cd79fa8ea99ae05e2ccfcd72024ba27bfe35108f93efe33f45bdeb4629
MD5 7eab744cea3bbdf78135f9ba5530fb01
SHA1 08c5bc91d5afcfa496aaf81b01a98ca43c43ab5a
SHA512 a6a08bc0f2dd6e898b9b94c24b5d035178f9143bf40ff946b9c99f0bddfd6184dffbdafbaa303fccaf7a557ae08c9e7dbaac35fbba61330b25dbecf821209289
TLSH
T16411A54677E20521E0D2A7345E83866F18749434FA7B911D594FFA922B216604935F9C
MD5 SHA1 SHA512 TLSH

Submit Download

0f5007522459c86e95ffcc62f32308f1_c3d0e1da-bcea-48f7-86a8-212b4e5f9c90

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3053180483-1881419501-3594244048-1000\0f5007522459c86e95ffcc62f32308f1_c3d0e1da-bcea-48f7-86a8-212b4e5f9c90
Size 1KB
SHA256 2df1ac576d4fdfb46b582f4ce32d9602e30dc737bfa3611c4729f9b5d432e1af
MD5 4351059aa8ce65bb5d23f5815422fabc
SHA1 51a4333c12f1977b6e739c31e6b9e75b87b96b00
SHA512 ef32b40cbb8916ed51ff1b7e3224ad4afc55f3ab9ebe01b7d729074e1fa392715e26b87f56bb648d1f678d9b6cdd7bcf1f5910718e615ef744c663bc3876e85a
TLSH
T18A11A516F6756047E8DAC274994B3E1A00D6EED8F7A6C02C481FF31206B5A1350A2749
MD5 SHA1 SHA512 TLSH

Submit Download

badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe

Path C:\Users\Admin\AppData\Roaming\WNetval\badc69c94af919941f922884acc2084027aec9fd707a69efbb7b92c7cf1388e2.exe
Size 368KB
SHA256 badc58c84af819941f922774acc2074026aec9fd606a59efbb6b82c6cf1377e2
MD5 57efed07d837d0c1efa111641bd7d9c6
SHA1 cd1f11c89837cfe5f67235abcb0663d9f5218794
SHA512 50b91b8fbbd1162a157b54ffb3481ef17452f93dbf50b9b73ca8e40bd7da593bc4295347a41c43488c26fae2fab309e9e743c481b5dec16384d748b7b99a80e1
SSDEEP 6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qc:emSuOcHmnYhrDMTrban4qc
TLSH
T10784A7FC56C61611B0ECCDB7C7129F6AF655BF535328B29A284C82BD702283F0259A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkcs11.txt

Path C:\Users\Admin\AppData\Roaming\WNetval\pkcs11.txt
Size 22KB
SHA256 9ed7d889d47538a8d244ac0e264cbfd03b2339c26766c7244e45f35a7624c1a8
MD5 9b8a3e289fc6046a829725859327b266
SHA1 bc13f2a68f8637fc9660292a77c5321260e4b4f2
SHA512 e13256ec34ef1ec5c68f7eebf155b9766cdfaf11c6699d00d792f3ea4e7f78fd4c85a578fa19437d601a44f38af4cc5f39420969a700dd2a90722501f28c09d1
SSDEEP 192:/Y5wIk3kK+pz6Su5FcUUawc19h2mjp8H41tfL4s/sqZSob6:g5wz3kAV3wc1LTtkIr/4o+
TLSH
T140A2E68EDB897894C01201F3CA8B568816FD6F44C9435DAFD7DC7952EE58A878C07BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3584-41-0x0000000002690000-0x0000000002959000-memory.dmp

Download

memory/3584-42-0x0000000000660000-0x0000000000689000-memory.dmp

Download

memory/3584-40-0x00000000025D0000-0x000000000268E000-memory.dmp

Download

memory/3584-34-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/3584-29-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/3584-28-0x0000000000660000-0x0000000000689000-memory.dmp

Download

memory/4080-22-0x00000000031C0000-0x000000000327E000-memory.dmp

Download

memory/4080-11-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4080-23-0x0000000003280000-0x0000000003549000-memory.dmp

Download

memory/4080-24-0x00000000011C0000-0x00000000011E9000-memory.dmp

Download

memory/4080-10-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4080-9-0x00000000011C0000-0x00000000011E9000-memory.dmp

Download

memory/4080-20-0x00000000016B0000-0x00000000016B1000-memory.dmp

Download

memory/4636-1-0x0000000000C60000-0x0000000000C89000-memory.dmp

Download

memory/4636-8-0x0000000000C60000-0x0000000000C89000-memory.dmp

Download

memory/5088-58-0x0000000001720000-0x00000000019E9000-memory.dmp

Download

memory/5088-57-0x0000000001660000-0x000000000171E000-memory.dmp

Download

memory/5132-16-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/5132-15-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/5132-21-0x000001FEE5440000-0x000001FEE5441000-memory.dmp

Download

memory/5772-44-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/5772-35-0x0000000010000000-0x000000001001F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads