Overview

overview

10

Static

static

3707cbfe93...80.exe

windows7_x64

10

3707cbfe93...80.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480

  • Size

    505KB

  • Sample

    220701-ewgzgadeb2

  • MD5

    57cde74b65e113c5df45c1668100d4c5

  • SHA1

    0e8b1073bee392aa99eb9c4400a39219fba4c022

  • SHA256

    3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480

  • SHA512

    c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2

Score
10/10
trickbotwmd38bankerdavetrojan

Malware Config

Extracted

Family

trickbot

Version

1000497

Botnet

wmd38

C2

5.182.210.226:443

5.182.210.246:443

82.146.62.52:443

198.8.91.10:443

195.123.221.53:443

51.89.115.116:443

164.68.120.56:443

85.204.116.237:443

5.2.75.167:443

93.189.42.146:443

185.252.144.174:443

81.177.165.145:443

217.107.34.151:443

146.185.219.165:443

194.87.238.87:443

146.185.253.18:443

194.5.250.155:443

195.123.216.223:443

185.99.2.160:443

5.182.210.230:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480

    • Size

      505KB

    • MD5

      57cde74b65e113c5df45c1668100d4c5

    • SHA1

      0e8b1073bee392aa99eb9c4400a39219fba4c022

    • SHA256

      3707cbfe93439bc28a86c4e3e5acc878617372bd0baf69f78f990c672b6b5480

    • SHA512

      c5148df379aa0f4d2100f1530ea5b2a2568f1b055705e68d9085022b5df803271e4bb6fefa97c7b9a9899b6e99eb145613a4eb79836bc51739a6bc9ea0e33ae2

    Score
    10/10
    trickbotwmd38bankerdavetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks