Overview

overview

10

Static

static

Sandra

windows10_x64

1

Eternity

windows7_x64

10

Resubmissions

19-11-2020 11:14

201119-jeevdpfjmn 10

19-11-2020 08:01

201119-n68xa6bhz2 10

19-11-2020 07:57

201119-tg2k1bvx6n 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    openme.exe

  • Size

    756KB

  • Sample

    201119-n68xa6bhz2

  • MD5

    d6408ae6bf86b97eadfb3f15bbfd7933

  • SHA1

    dd877b59c9acd80535ad22bdc07525d536a41139

  • SHA256

    4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21

  • SHA512

    f97da566db808c31ef9813124a7555ce35d3ead23238911935aa85845374dead962587cb252b7fda05c94c9b54b4555ec953e2d31316d2495c73aab148e88dec

Score
10/10
trickbotrob6bankerpersistencespywaretrojan

Malware Config

Extracted

Family

trickbot

Version

100003

Botnet

rob6

C2

102.164.206.129:449

103.131.156.21:449

103.131.157.102:449

103.131.157.161:449

103.146.232.5:449

103.150.68.124:449

103.156.126.232:449

103.30.85.157:449

103.52.47.20:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      openme.exe

    • Size

      756KB

    • MD5

      d6408ae6bf86b97eadfb3f15bbfd7933

    • SHA1

      dd877b59c9acd80535ad22bdc07525d536a41139

    • SHA256

      4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21

    • SHA512

      f97da566db808c31ef9813124a7555ce35d3ead23238911935aa85845374dead962587cb252b7fda05c94c9b54b4555ec953e2d31316d2495c73aab148e88dec

    Score
    10/10
    trickbotrob6bankerpersistencespywaretrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Blacklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops file in System32 directory

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks