Overview

overview

10

Static

static

127661.exe

windows7_x64

10

127661.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    127661.exe

  • Size

    375KB

  • Sample

    200824-e2db7ay2tx

  • MD5

    309c240336952e3a6afe08f91581aa76

  • SHA1

    7cc257d1dc641c5fc312c7694a1a7be7ce31cb46

  • SHA256

    621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391

  • SHA512

    a7e68157c9d9e6a317fa5a898cf1b96bd884132e4634fecd495af74d5e40b72f54a85446730a0a0ac8379039146f1840229e420c5b7dd64b1eca8be0b09fb104

Score
10/10
trickbotmac1bankerevasiontrojan

Malware Config

Extracted

Family

trickbot

Version

1000098

Botnet

mac1

C2

79.106.41.9:449

94.250.252.146:443

62.109.18.206:443

62.109.26.193:443

78.24.223.50:443

94.250.252.162:443

92.53.78.209:443

92.53.66.115:443

62.109.16.70:443

62.109.23.229:443

62.109.17.100:443

82.146.47.221:443

195.133.144.43:443

194.87.92.217:443

95.213.194.234:443

195.133.147.44:443

194.87.238.149:443

78.155.206.154:443

185.80.130.195:443

94.250.252.168:443
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      127661.exe

    • Size

      375KB

    • MD5

      309c240336952e3a6afe08f91581aa76

    • SHA1

      7cc257d1dc641c5fc312c7694a1a7be7ce31cb46

    • SHA256

      621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391

    • SHA512

      a7e68157c9d9e6a317fa5a898cf1b96bd884132e4634fecd495af74d5e40b72f54a85446730a0a0ac8379039146f1840229e420c5b7dd64b1eca8be0b09fb104

    Score
    10/10
    evasiontrojanbankertrickbot

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks