6e25a2f2af3466370503b75f31440d1d48e10b89376f224bd1f4090ba8062710 | Triage

Sharing

General

Target

428f9a2b4cbc33879806996a030c02f0e60521b9
Size

860KB
Sample

191018-xkfwrmh4f2
MD5

8b880439e017f241cc93790d9e08d630
SHA1

428f9a2b4cbc33879806996a030c02f0e60521b9
SHA256

6e25a2f2af3466370503b75f31440d1d48e10b89376f224bd1f4090ba8062710
SHA512

0aab47ed967ae3d018100bcde36ff875e46c5e2bbe871f94f69b0b911a65a5cbcfa1fe676a4d9b54fd7092e3110c79045e0dcee0e0cb45c507ae3af7cec08a0c

Score

10^/10

Malware Config

Targets

- Target
  
  428f9a2b4cbc33879806996a030c02f0e60521b9
- Size
  
  860KB
- MD5
  
  8b880439e017f241cc93790d9e08d630
- SHA1
  
  428f9a2b4cbc33879806996a030c02f0e60521b9
- SHA256
  
  6e25a2f2af3466370503b75f31440d1d48e10b89376f224bd1f4090ba8062710
- SHA512
  
  0aab47ed967ae3d018100bcde36ff875e46c5e2bbe871f94f69b0b911a65a5cbcfa1fe676a4d9b54fd7092e3110c79045e0dcee0e0cb45c507ae3af7cec08a0c
Score

10^/10
- Trickbot persistence files
  trojan banker
- trickbot family
  family
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies system certificate store
  evasion spyware trojan
- Checks system information in the registry (likely anti-VM)
- Modifies service
  persistence
task1 task2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

task1

task2