trickbot | 0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08

General

Target

0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe
Size

556KB
MD5

865369af4fc338efdc45d8aa59b90132
SHA1

d077fbcf5de5b452ce62c1bdc6d0b81c2d4b28f5
SHA256

0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08
SHA512

5e0c0d37889b5633de7deb01aea023c7431b3a116d1da3950e8c75a436633f3d22cbd10a642a813d4d4be5b410e5c1c9b567452f61745afb6513223bad84c9d5

Score

10^/10

trickbot qw6 banker dave trojan

Malware Config

Extracted

Family

trickbot

Version

1000503

Botnet

qw6

C2

5.182.210.226:443

192.210.226.106:443

51.254.164.244:443

45.148.120.153:443

195.123.239.67:443

194.5.250.150:443

217.12.209.200:443

185.99.2.221:443

51.254.164.245:443

185.62.188.159:443

46.17.107.65:443

185.20.185.76:443

185.203.118.37:443

146.185.253.178:443

185.14.31.252:443

185.99.2.115:443

172.245.156.138:443

51.89.73.158:443

190.214.13.2:449

181.140.173.186:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 3 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
behavioral1/memory/1048-55-0x00000000003B0000-0x00000000003E6000-memory.dmp	dave
behavioral1/memory/1048-59-0x00000000002A0000-0x00000000002E3000-memory.dmp	dave
behavioral1/memory/1260-65-0x00000000003C0000-0x00000000003F6000-memory.dmp	dave

Executes dropped EXE 1 IoCs

Processes:

ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe

pid process

1260 ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe

pid	process
1260	ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe

Loads dropped DLL 2 IoCs

Processes:

0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe

pid	process
1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe
1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exeↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe

pid	process
1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe
1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe
1260	ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
1260	ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe

description	pid	process	target process
PID 1048 wrote to memory of 1260	1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe	ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
PID 1048 wrote to memory of 1260	1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe	ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
PID 1048 wrote to memory of 1260	1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe	ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
PID 1048 wrote to memory of 1260	1048	0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe	ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe

C:\Users\Admin\AppData\Local\Temp\0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe
"C:\Users\Admin\AppData\Local\Temp\0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048

C:\ProgramData\ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
"C:\ProgramData\ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1260

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
Filesize
556KB

MD5
865369af4fc338efdc45d8aa59b90132

SHA1
d077fbcf5de5b452ce62c1bdc6d0b81c2d4b28f5

SHA256
0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08

SHA512
5e0c0d37889b5633de7deb01aea023c7431b3a116d1da3950e8c75a436633f3d22cbd10a642a813d4d4be5b410e5c1c9b567452f61745afb6513223bad84c9d5

Download Submit
C:\ProgramData\ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
Filesize
556KB

MD5
865369af4fc338efdc45d8aa59b90132

SHA1
d077fbcf5de5b452ce62c1bdc6d0b81c2d4b28f5

SHA256
0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08

SHA512
5e0c0d37889b5633de7deb01aea023c7431b3a116d1da3950e8c75a436633f3d22cbd10a642a813d4d4be5b410e5c1c9b567452f61745afb6513223bad84c9d5

Download Submit
\ProgramData\ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
Filesize
556KB

MD5
865369af4fc338efdc45d8aa59b90132

SHA1
d077fbcf5de5b452ce62c1bdc6d0b81c2d4b28f5

SHA256
0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08

SHA512
5e0c0d37889b5633de7deb01aea023c7431b3a116d1da3950e8c75a436633f3d22cbd10a642a813d4d4be5b410e5c1c9b567452f61745afb6513223bad84c9d5

Download Submit
\ProgramData\ↈↈCCIƆفيديVCموسيقىCموسيقىC;ↈ;ↈM;.exe
Filesize
556KB

MD5
865369af4fc338efdc45d8aa59b90132

SHA1
d077fbcf5de5b452ce62c1bdc6d0b81c2d4b28f5

SHA256
0cac69584eb63de53369675af304834119f7cf915054a950db20613acc4c4b08

SHA512
5e0c0d37889b5633de7deb01aea023c7431b3a116d1da3950e8c75a436633f3d22cbd10a642a813d4d4be5b410e5c1c9b567452f61745afb6513223bad84c9d5

Download Submit
memory/1048-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1048-55-0x00000000003B0000-0x00000000003E6000-memory.dmp

Filesize
216KB

Download
memory/1048-59-0x00000000002A0000-0x00000000002E3000-memory.dmp

Filesize
268KB

Download
memory/1260-62-0x0000000000000000-mapping.dmp

Download
memory/1260-65-0x00000000003C0000-0x00000000003F6000-memory.dmp

Filesize
216KB

Download
memory/1260-70-0x0000000000540000-0x0000000000572000-memory.dmp

Filesize
200KB

Download
memory/1260-71-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download
memory/1260-72-0x0000000000541000-0x0000000000572000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads