Overview

overview

10

Static

static

374ef83de2...05.exe

windows7_x64

10

374ef83de2...05.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05

  • Size

    456KB

  • Sample

    220625-3rdm9aggej

  • MD5

    b855b1b7b59668ad991cf0501e4ff4cb

  • SHA1

    581283899259e80b7da5d8be25f6ed1de58fdfac

  • SHA256

    374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05

  • SHA512

    71e59b09678df1dca36caca3280687723406c2ccf638e2d7e57a34ea099fb269646730966c96d89dcaab23914f1915664fac4491f09bb17216ed3f3c6acb64c6

Score
10/10
trickbotbankerevasiontrojan

Malware Config

Targets

    • Target

      374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05

    • Size

      456KB

    • MD5

      b855b1b7b59668ad991cf0501e4ff4cb

    • SHA1

      581283899259e80b7da5d8be25f6ed1de58fdfac

    • SHA256

      374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05

    • SHA512

      71e59b09678df1dca36caca3280687723406c2ccf638e2d7e57a34ea099fb269646730966c96d89dcaab23914f1915664fac4491f09bb17216ed3f3c6acb64c6

    Score
    10/10
    trickbotbankerevasiontrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks