Overview

overview

10

Static

static

36e3ca4947...d5.exe

windows7_x64

10

36e3ca4947...d5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36e3ca4947f1a83aa59247ff120d09d3746e69795c759d6e02bd7a9b3fe967d5

  • Size

    221KB

  • Sample

    220626-bhd4wabcbr

  • MD5

    edccfe5ef48de6b0f3bbf53cc1012533

  • SHA1

    9eb4232a55276936ff822c27996d70e7597550be

  • SHA256

    36e3ca4947f1a83aa59247ff120d09d3746e69795c759d6e02bd7a9b3fe967d5

  • SHA512

    41cbc62c5469c761f5bbf6b9ecffd4465c3fbe8ce562369a2a176d2e15fee4755ce6b244fb49a834e69906375347aca9519dac0f921afbd1d3c278d22eeba3d1

Score
10/10
trickbotser0524bankerpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

1000198

Botnet

ser0524

C2

208.75.117.70:449

92.55.251.211:449

118.91.178.139:449

94.112.52.197:449

138.34.29.172:443

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

46.20.207.204:443

68.96.73.154:449

185.42.192.194:449

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449

185.180.198.78:443
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      36e3ca4947f1a83aa59247ff120d09d3746e69795c759d6e02bd7a9b3fe967d5

    • Size

      221KB

    • MD5

      edccfe5ef48de6b0f3bbf53cc1012533

    • SHA1

      9eb4232a55276936ff822c27996d70e7597550be

    • SHA256

      36e3ca4947f1a83aa59247ff120d09d3746e69795c759d6e02bd7a9b3fe967d5

    • SHA512

      41cbc62c5469c761f5bbf6b9ecffd4465c3fbe8ce562369a2a176d2e15fee4755ce6b244fb49a834e69906375347aca9519dac0f921afbd1d3c278d22eeba3d1

    Score
    10/10
    trickbotser0524bankertrojanpersistence

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks