trickbot | 4ba28759524c7642649cc9fd7f2d97782c51e31e7edf35b554aa0fd816b9ef5e

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ba28759524c7642649cc9fd7f2d97782c51e31e7edf35b554aa0fd816b9ef5e.exe
Size 154KB
Sample260910-vldr3avyev
SHA256 4ba28759524c7642649cc9fd7f2d97782c51e31e7edf35b554aa0fd816b9ef5e
MD5 6ebe4f7839a92875cc70f881ef6a1582
SHA1 24126ffddcfb23ae16f80b1293bfa4045c5e503c
SHA512 1439818baee72da96ef9ea906aa67a367e62b2c8e0db62b7e924f55e5184a5a8257d649dd448fcd21f76eb71c4b0347e429d775466b6be16eb9c7a391b9a1eb4
SSDEEP 3072:AGNwmFB7ESmDaecIGpv60eTXy5BYZgkIHIr0LYBll5dbVzVQpxWvviG0n:AswmFfrB00eT6BYZgkIHM6sddb7mG0
TLSH
T175F313FC34308B6EF838B03B67F429496CFD4359ED5A40FAEEA05258E85576B98C6181
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery trickbot trojan

Malware Config

Signatures

Family: Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 2 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/3464-0-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral1/memory/3464-1-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	3464	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ba28759524c7642649cc9fd7f2d97782c51e31e7edf35b554aa0fd816b9ef5e.exe

C:\Users\Admin\AppData\Local\Temp\4ba28759524c7642649cc9fd7f2d97782c51e31e7edf35b554aa0fd816b9ef5e.exe
"C:\Users\Admin\AppData\Local\Temp\4ba28759524c7642649cc9fd7f2d97782c51e31e7edf35b554aa0fd816b9ef5e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 224
  2⤵
  - Program crash
  PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3464 -ip 3464
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3464-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3464-1-0x0000000000400000-0x0000000000429000-memory.dmp