trickbot | 5ed6f27ab039c0fcb2221dd18092af1eab9558427d2a4a31048371dc419d4ff5 | Triage

Submit
Reports

Overview

overview

Static

static

5ed6f27ab0...f5.exe

windows7-x64

5ed6f27ab0...f5.exe

windows10-2004-x64

Sharing

General

Target

5ed6f27ab039c0fcb2221dd18092af1eab9558427d2a4a31048371dc419d4ff5
Size

388KB
Sample

220731-xq8jcadebl
MD5

a09f55e86608b24cf635e60e56e6d763
SHA1

28a1cf064d988b85e09e68b1076097a8cfceb996
SHA256

5ed6f27ab039c0fcb2221dd18092af1eab9558427d2a4a31048371dc419d4ff5
SHA512

0ac795e374a1e44ede1d718a8a1791b6ac055235170f7ac931fb759619e6cd80f2aa63df07b3aa109f6def1fe6e9ad019d514f0c2068dc4e34c13b616757fa4e

Score

10^/10

trickbot lib358 banker evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

5ed6f27ab039c0fcb2221dd18092af1eab9558427d2a4a31048371dc419d4ff5.exe

Resource

win7-20220718-en

trickbot lib358 banker evasion trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

5ed6f27ab039c0fcb2221dd18092af1eab9558427d2a4a31048371dc419d4ff5.exe

Resource

win10v2004-20220721-en

trickbot lib358 banker persistence trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

trickbot

Version

1000304

Botnet

lib358

C2

188.68.208.240:443

24.247.181.155:449

174.105.235.178:449

185.80.148.162:443

181.113.17.230:449

174.105.233.82:449

71.14.129.8:449

216.183.62.43:449

42.115.91.177:443

137.74.151.18:443

71.94.101.25:443

206.130.141.255:449

92.38.163.39:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

24.119.69.70:449

213.183.63.245:443

103.110.91.118:449

68.4.173.10:443

72.189.124.41:449

74.134.5.113:449

105.27.171.234:449

182.253.20.66:449

172.222.97.179:449

46.149.182.112:449

213.32.122.246:443

199.227.126.250:449

24.113.161.184:449

197.232.50.85:443

94.232.20.113:443

190.145.74.84:449

47.49.168.50:443

64.128.175.37:449

24.227.222.4:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  5ed6f27ab039c0fcb2221dd18092af1eab9558427d2a4a31048371dc419d4ff5
- Size
  
  388KB
- MD5
  
  a09f55e86608b24cf635e60e56e6d763
- SHA1
  
  28a1cf064d988b85e09e68b1076097a8cfceb996
- SHA256
  
  5ed6f27ab039c0fcb2221dd18092af1eab9558427d2a4a31048371dc419d4ff5
- SHA512
  
  0ac795e374a1e44ede1d718a8a1791b6ac055235170f7ac931fb759619e6cd80f2aa63df07b3aa109f6def1fe6e9ad019d514f0c2068dc4e34c13b616757fa4e
Score

10^/10

trickbot lib358 banker evasion trojan persistence
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Executes dropped EXE
- Stops running service(s)
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

Tasks

static1

behavioral1

trickbotlib358bankerevasiontrojan

behavioral2

trickbotlib358bankerpersistencetrojan

© 2018-2024

Terms | Privacy