Overview

overview

10

Static

static

Users/cldi...CC.exe

windows7_x64

10

Users/cldi...CC.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f21373bd-aea3-4ad2-972b-139e1987a205.zip

  • Size

    349KB

  • Sample

    210226-5q4c5w68ta

  • MD5

    4294bd0c366e527ac0c6ea07f45f7b53

  • SHA1

    6f02676a7a7a8fae3440165bc89a036ab8605404

  • SHA256

    0dcabed4f80e953f94af32b0ad7d040fc64ca261f91aed7521b92458b1e7b2d3

  • SHA512

    6c535d33f93ccb59cb5106260e84fa69c45fa9345ffd0f3f0cbd0421762f796c3ee1292fef018cbdc0e8e63ae30bb2105c9ccf33d35e8cfa2a89cbe2cef22943

Score
10/10
trickbotwecan25bankerdavetrojan

Malware Config

Extracted

Family

trickbot

Version

1000498

Botnet

wecan25

C2

5.182.210.226:443

82.146.62.52:443

164.68.120.56:443

185.11.146.86:443

5.2.78.70:443

185.65.202.240:443

193.26.217.243:443

81.177.180.254:443

5.34.177.40:443

185.186.77.222:443

188.227.84.209:443

185.45.193.76:443

46.229.213.27:443

88.99.112.87:443

51.254.164.240:443

45.148.120.13:443

5.2.78.77:443

64.44.51.125:443

107.172.165.149:443

45.148.120.14:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      Users/cldieckmann/AppData/Roaming/windirect/ьяшмBCCC.exe

    • Size

      507KB

    • MD5

      2e3926b7123e1ec3cd57d7ffd7072bd3

    • SHA1

      9077c965165d91d62023cbfb238bfe42a9720b6c

    • SHA256

      f1f026eb520ff82fdae1b939b7f440d94dad05935717360763f924b239448c06

    • SHA512

      be5fc9b5b4fa50a3fb2a5efd343c240478547e32c7dfe6389a6b39ee7a8fb8ae7053197c6c5c53b36154280938bf9f9a358c0e0d2fb1ec042223a58d2578de27

    Score
    10/10
    trickbotwecan25bankerdavetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Dave packer

      Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

      dave

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks