trickbot | aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

General

Target

aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe
Size

424KB
MD5

a28604cbd7a845fe3bae400f76ae4046
SHA1

2bb828db31142a0d03b1f646375b688e130f6ee0
SHA256

aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71
SHA512

804e9d6076cc6cb886cb529897ec7c38314d658463ccc6567c0af7fbed61d2df770baf18886432b0e95c89fe0408b8816023a89a874630098190170f3de0f655

Score

10^/10

trickbot wmd38 banker dave trojan

Malware Config

Extracted

Family

trickbot

Version

1000498

Botnet

wmd38

C2

5.182.210.226:443

82.146.62.52:443

164.68.120.56:443

185.11.146.86:443

5.2.78.70:443

185.65.202.240:443

193.26.217.243:443

81.177.180.254:443

5.34.177.40:443

185.186.77.222:443

188.227.84.209:443

185.45.193.76:443

46.229.213.27:443

88.99.112.87:443

51.254.164.240:443

45.148.120.13:443

5.2.78.77:443

64.44.51.125:443

107.172.165.149:443

45.148.120.14:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 3 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
behavioral1/memory/1892-55-0x0000000001CB0000-0x0000000001CE5000-memory.dmp	dave
behavioral1/memory/1892-60-0x0000000000320000-0x0000000000352000-memory.dmp	dave
behavioral1/memory/1136-65-0x0000000001E10000-0x0000000001E45000-memory.dmp	dave

Executes dropped EXE 1 IoCs

Processes:

قا嗶δηнг.exe

pid process

1136 قا嗶δηнг.exe

pid	process
1136	قا嗶δηнг.exe

Loads dropped DLL 2 IoCs

Processes:

aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe

pid	process
1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe
1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exeقا嗶δηнг.exe

pid	process
1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe
1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe
1136	قا嗶δηнг.exe
1136	قا嗶δηнг.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe

description	pid	process	target process
PID 1892 wrote to memory of 1136	1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe	قا嗶δηнг.exe
PID 1892 wrote to memory of 1136	1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe	قا嗶δηнг.exe
PID 1892 wrote to memory of 1136	1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe	قا嗶δηнг.exe
PID 1892 wrote to memory of 1136	1892	aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe	قا嗶δηнг.exe

C:\Users\Admin\AppData\Local\Temp\aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe
"C:\Users\Admin\AppData\Local\Temp\aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892

C:\ProgramData\قا嗶δηнг.exe
"C:\ProgramData\قا嗶δηнг.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1136

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\قا嗶δηнг.exe
Filesize
424KB

MD5
a28604cbd7a845fe3bae400f76ae4046

SHA1
2bb828db31142a0d03b1f646375b688e130f6ee0

SHA256
aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

SHA512
804e9d6076cc6cb886cb529897ec7c38314d658463ccc6567c0af7fbed61d2df770baf18886432b0e95c89fe0408b8816023a89a874630098190170f3de0f655

Download Submit
C:\ProgramData\قا嗶δηнг.exe
Filesize
424KB

MD5
a28604cbd7a845fe3bae400f76ae4046

SHA1
2bb828db31142a0d03b1f646375b688e130f6ee0

SHA256
aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

SHA512
804e9d6076cc6cb886cb529897ec7c38314d658463ccc6567c0af7fbed61d2df770baf18886432b0e95c89fe0408b8816023a89a874630098190170f3de0f655

Download Submit
\ProgramData\قا嗶δηнг.exe
Filesize
424KB

MD5
a28604cbd7a845fe3bae400f76ae4046

SHA1
2bb828db31142a0d03b1f646375b688e130f6ee0

SHA256
aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

SHA512
804e9d6076cc6cb886cb529897ec7c38314d658463ccc6567c0af7fbed61d2df770baf18886432b0e95c89fe0408b8816023a89a874630098190170f3de0f655

Download Submit
\ProgramData\قا嗶δηнг.exe
Filesize
424KB

MD5
a28604cbd7a845fe3bae400f76ae4046

SHA1
2bb828db31142a0d03b1f646375b688e130f6ee0

SHA256
aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

SHA512
804e9d6076cc6cb886cb529897ec7c38314d658463ccc6567c0af7fbed61d2df770baf18886432b0e95c89fe0408b8816023a89a874630098190170f3de0f655

Download Submit
memory/1136-62-0x0000000000000000-mapping.dmp

Download
memory/1136-65-0x0000000001E10000-0x0000000001E45000-memory.dmp

Filesize
212KB

Download
memory/1136-70-0x0000000002000000-0x0000000002031000-memory.dmp

Filesize
196KB

Download
memory/1136-71-0x0000000001FC0000-0x0000000001FF1000-memory.dmp

Filesize
196KB

Download
memory/1136-72-0x0000000002001000-0x0000000002031000-memory.dmp

Filesize
192KB

Download
memory/1892-54-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1892-55-0x0000000001CB0000-0x0000000001CE5000-memory.dmp

Filesize
212KB

Download
memory/1892-60-0x0000000000320000-0x0000000000352000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads