Overview

overview

10

Static

static

53a0e9972a...84.exe

windows7-x64

10

53a0e9972a...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53a0e9972acab581264117bb1346cf1c78c440a42a809112033b253784d95884

  • Size

    300KB

  • Sample

    220727-a58fkagdbm

  • MD5

    a05fd97546d2b529f2b4fbb5917167b2

  • SHA1

    972123b36192c44fe542936d83652fc379b92bc5

  • SHA256

    53a0e9972acab581264117bb1346cf1c78c440a42a809112033b253784d95884

  • SHA512

    4b4197a469f8a3e6a29f9bc7df240c8e05aea777804d5525315caadd051ff973d723be914ca45e4c11736c4962ec164d6d87022f4dd53aef40c6c6414db149e5

Score
10/10
trickbotlib244bankerpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

1000210

Botnet

lib244

C2

188.124.167.132:449

93.109.242.134:443

41.211.9.226:443

158.58.131.54:443

36.74.100.211:449

87.255.24.238:449

200.111.167.227:449

109.86.227.152:443

85.172.38.59:449

190.4.189.129:443

65.30.201.40:443

66.232.212.59:443

80.53.57.146:443

182.253.210.130:449

155.133.31.21:449

94.112.52.197:449

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

185.42.192.194:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      53a0e9972acab581264117bb1346cf1c78c440a42a809112033b253784d95884

    • Size

      300KB

    • MD5

      a05fd97546d2b529f2b4fbb5917167b2

    • SHA1

      972123b36192c44fe542936d83652fc379b92bc5

    • SHA256

      53a0e9972acab581264117bb1346cf1c78c440a42a809112033b253784d95884

    • SHA512

      4b4197a469f8a3e6a29f9bc7df240c8e05aea777804d5525315caadd051ff973d723be914ca45e4c11736c4962ec164d6d87022f4dd53aef40c6c6414db149e5

    Score
    10/10
    trickbotlib244bankertrojanpersistence

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks