Overview

overview

10

Static

static

20f08d83a3...ba.exe

windows7_x64

10

20f08d83a3...ba.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20f08d83a3ef82811a7b4506c8561989d527a2704a0cda64e10ddcd08784feba

  • Size

    428KB

  • Sample

    220612-l63r9agdfn

  • MD5

    b63af3e2ce713b1a8fa79ee1158ba246

  • SHA1

    3f25337d0bc667eb5965cbb9b70244dc01d4af84

  • SHA256

    20f08d83a3ef82811a7b4506c8561989d527a2704a0cda64e10ddcd08784feba

  • SHA512

    f1f6a16f0caa3a0efc6827479014a8590318ed7f8f994602b7ac23aeaed1ce17bb8ba572a8e31a12513877c853bcdd3ac525e1c098e7c255d03045a92d00bd3b

Score
10/10
trickbotser0716bankerevasionpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

1000228

Botnet

ser0716

C2

138.34.32.218:443

178.78.202.189:443

85.9.212.117:443

93.109.242.134:443

118.91.178.101:443

158.58.131.54:443

70.114.186.116:443

118.200.151.113:443

89.117.107.13:443

109.86.227.152:443

200.2.126.98:443

96.31.109.51:443

90.69.224.122:443

194.68.23.182:443

182.253.210.130:449

77.89.86.93:443

70.79.178.120:449

138.34.32.74:443

185.129.193.221:443

184.68.167.42:443
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      20f08d83a3ef82811a7b4506c8561989d527a2704a0cda64e10ddcd08784feba

    • Size

      428KB

    • MD5

      b63af3e2ce713b1a8fa79ee1158ba246

    • SHA1

      3f25337d0bc667eb5965cbb9b70244dc01d4af84

    • SHA256

      20f08d83a3ef82811a7b4506c8561989d527a2704a0cda64e10ddcd08784feba

    • SHA512

      f1f6a16f0caa3a0efc6827479014a8590318ed7f8f994602b7ac23aeaed1ce17bb8ba572a8e31a12513877c853bcdd3ac525e1c098e7c255d03045a92d00bd3b

    Score
    10/10
    trickbotser0716bankerevasiontrojanpersistence

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks