Overview

overview

10

Static

static

rwysfwueyp.exe

windows7_x64

10

rwysfwueyp.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rwysfwueyp.exe

  • Size

    1.2MB

  • Sample

    210121-x4ncp6qbba

  • MD5

    add4d58d5bd00250c2203653129fb71b

  • SHA1

    a74fea06c8e67447176f7a508899ba546316f77c

  • SHA256

    1a5d1d3d58f829e1447df95583770da8106382f32ebced394eccda36a921bdf5

  • SHA512

    229f5ef900bca3505a9e95e55305006c33dca9c421d4fbe7d403a40c6eee780fa13d5fd87402243ddd2aa1f9a7f1a76bd0cf6f8d8973ce4ca4063da620c29ca5

Score
10/10
trickbotmor1bankerpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

2000022

Botnet

mor1

C2

85.204.116.83:443

91.200.100.143:443

83.151.14.13:443

107.191.61.39:443

113.160.129.15:443

139.162.182.54:443

139.162.44.152:443

144.202.106.23:443

158.247.219.186:443

172.105.107.25:443

172.105.190.51:443

172.105.196.53:443

172.105.25.190:443

178.79.138.253:443

192.46.229.48:443

207.246.92.48:443

216.128.130.16:443

45.79.126.97:443

45.79.155.9:443

45.79.212.97:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      rwysfwueyp.exe

    • Size

      1.2MB

    • MD5

      add4d58d5bd00250c2203653129fb71b

    • SHA1

      a74fea06c8e67447176f7a508899ba546316f77c

    • SHA256

      1a5d1d3d58f829e1447df95583770da8106382f32ebced394eccda36a921bdf5

    • SHA512

      229f5ef900bca3505a9e95e55305006c33dca9c421d4fbe7d403a40c6eee780fa13d5fd87402243ddd2aa1f9a7f1a76bd0cf6f8d8973ce4ca4063da620c29ca5

    Score
    10/10
    trickbotmor1bankerpersistencetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks