Overview

overview

10

Static

static

53e87ca7d2...d1.exe

windows7-x64

10

53e87ca7d2...d1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53e87ca7d245cc1b486c2370a59c47113bf75b9d8a3bb1fc453bd089d15e5bd1

  • Size

    572KB

  • Sample

    220726-w95q5agab6

  • MD5

    fad68d7bcae15f01ac2e1b9d6580b5fe

  • SHA1

    ed78a34e8e9a3ee9c7b07bbd13bd146de428d534

  • SHA256

    53e87ca7d245cc1b486c2370a59c47113bf75b9d8a3bb1fc453bd089d15e5bd1

  • SHA512

    b3f279ed7110fe7d0cc9de3d4191937b94cb1147b6ed18e84cb84a30b98c56df24880965c21b8bbd63453218ef57d712c3d14be327bd7737fddc2eb0b54d9482

Score
10/10
trickbotser0910usbankerevasiontrojan

Malware Config

Extracted

Family

trickbot

Version

1000257

Botnet

ser0910us

C2

181.174.112.74:449

178.116.83.49:443

121.58.242.206:449

182.50.64.148:449

82.222.40.119:449

97.78.222.18:449

67.79.15.106:449

41.211.9.234:449

103.111.53.126:449

182.253.20.66:449

212.225.214.249:449

81.17.86.112:443

78.47.156.178:449

46.149.182.112:449

197.232.243.36:449

94.232.20.113:443

47.49.168.50:443

70.79.178.120:449

68.109.83.22:443

176.10.170.65:443
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      53e87ca7d245cc1b486c2370a59c47113bf75b9d8a3bb1fc453bd089d15e5bd1

    • Size

      572KB

    • MD5

      fad68d7bcae15f01ac2e1b9d6580b5fe

    • SHA1

      ed78a34e8e9a3ee9c7b07bbd13bd146de428d534

    • SHA256

      53e87ca7d245cc1b486c2370a59c47113bf75b9d8a3bb1fc453bd089d15e5bd1

    • SHA512

      b3f279ed7110fe7d0cc9de3d4191937b94cb1147b6ed18e84cb84a30b98c56df24880965c21b8bbd63453218ef57d712c3d14be327bd7737fddc2eb0b54d9482

    Score
    10/10
    trickbotbankerevasiontrojanser0910us

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks