Overview

overview

10

Static

static

Forever

windows7_x64

10

Eternity

windows7_x64

10

Resubmissions

21-01-2021 12:49

210121-vyx2jls6hn 10

21-01-2021 12:43

210121-edx8qfxjt2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    uploads[1].png.0.dr

  • Size

    1.3MB

  • Sample

    210121-vyx2jls6hn

  • MD5

    b9ab9ac3b5335fdca292acb7ca85eb14

  • SHA1

    26847a08f6e0504aff926b6278b2b8efdc90036a

  • SHA256

    d8773bf354256f487554f23646d4dc38fe4fd54ab4e3936d60e9f507da35feea

  • SHA512

    b0ed0d2a1291dc20a4a8b080c95fcdd34413cce70e95ea554675fb57a327e9b33cb79844278eb3d32398d2d2457e409ca4736ef2c24633ed8306809df7d197b1

Score
10/10
trickbotrob1bankerpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

2000022

Botnet

rob1

C2

85.204.116.83:443

91.200.100.143:443

83.151.14.13:443

107.191.61.39:443

113.160.129.15:443

139.162.182.54:443

139.162.44.152:443

144.202.106.23:443

158.247.219.186:443

172.105.107.25:443

172.105.190.51:443

172.105.196.53:443

172.105.25.190:443

178.79.138.253:443

192.46.229.48:443

207.246.92.48:443

216.128.130.16:443

45.79.126.97:443

45.79.155.9:443

45.79.212.97:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      uploads[1].png.0.dr

    • Size

      1.3MB

    • MD5

      b9ab9ac3b5335fdca292acb7ca85eb14

    • SHA1

      26847a08f6e0504aff926b6278b2b8efdc90036a

    • SHA256

      d8773bf354256f487554f23646d4dc38fe4fd54ab4e3936d60e9f507da35feea

    • SHA512

      b0ed0d2a1291dc20a4a8b080c95fcdd34413cce70e95ea554675fb57a327e9b33cb79844278eb3d32398d2d2457e409ca4736ef2c24633ed8306809df7d197b1

    Score
    10/10
    trickbotrob1bankerpersistencetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks