Overview

overview

10

Static

static

120 seconds - Win. 10

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    upl_confirm.xls

  • Size

    995KB

  • Sample

    210302-rm23f9xkwn

  • MD5

    81d961fd1967f6ded990fefbd7366ad0

  • SHA1

    bf7168f9f7bfa16c1d98c72c44e2c0782dd66896

  • SHA256

    5249e43b972f40a78393ddc43b32e444c5ff30bd068078e63112a9da85abfcd5

  • SHA512

    12424620354c054659ef473432ebc0d44712810aacd0a2050c7bf0319d139d833ec03fb0ecb2b20a03777d3ba11b93dc5e6884777187ddd8d9644988f2ba5b3c

Score
10/10
trickbotrob21bankerbootkitransomwaretrojan

Malware Config

Extracted

Family

trickbot

Version

2000026

Botnet

rob21

C2

154.79.252.132:449

179.191.108.58:449

200.6.169.124:443

103.76.20.226:443

80.78.77.116:449

80.78.75.246:443

45.234.248.66:449

187.190.116.59:443

185.234.72.84:443

36.94.202.131:443

103.91.244.102:449

168.232.188.88:449

103.73.101.98:449

173.81.4.147:449

202.142.151.190:449

118.67.216.238:449

108.170.20.72:443

85.159.214.61:443

36.92.93.5:449

79.122.166.236:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      upl_confirm.xls

    • Size

      995KB

    • MD5

      81d961fd1967f6ded990fefbd7366ad0

    • SHA1

      bf7168f9f7bfa16c1d98c72c44e2c0782dd66896

    • SHA256

      5249e43b972f40a78393ddc43b32e444c5ff30bd068078e63112a9da85abfcd5

    • SHA512

      12424620354c054659ef473432ebc0d44712810aacd0a2050c7bf0319d139d833ec03fb0ecb2b20a03777d3ba11b93dc5e6884777187ddd8d9644988f2ba5b3c

    Score
    10/10
    trickbotrob21bankerbootkitransomwaretrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks