trickbot | 1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe | Triage

Submit
Reports

Overview

overview

Static

static

1850caf8fe...fe.exe

windows7-x64

1850caf8fe...fe.exe

windows10-2004-x64

Sharing

General

Target

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
Size

504KB
Sample

221130-tgj8lseb98
MD5

a379f491b8da10b9c3ae56c96aaa53f9
SHA1

408f4d2ba1f36528345420922bca21c1ddfbde72
SHA256

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
SHA512

e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715
SSDEEP

6144:MHjoPGLwAy0nHjoPGLwEtiqs4iPuvJS1NHCDf/qZOPS893cQmU/lNU:0joelTjoeSWJSziDf/qY6g3cINU

Score

10^/10

trickbot jim321 banker evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe

Resource

win7-20221111-en

trickbot jim321 banker evasion trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe.exe

Resource

win10v2004-20221111-en

trickbot jim321 banker persistence trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

trickbot

Version

1000270

Botnet

jim321

C2

154.16.137.73:443

94.181.47.198:449

81.21.121.138:449

23.94.41.215:443

181.113.17.230:449

212.23.70.149:443

54.37.134.207:443

170.81.32.66:449

42.115.91.177:443

107.173.102.231:443

121.58.242.206:449

167.114.13.91:443

192.252.209.44:443

182.50.64.148:449

187.190.249.230:443

107.175.127.147:443

82.222.40.119:449

198.100.157.163:443

23.226.138.169:443

103.110.91.118:449

31.179.162.86:443

128.201.92.41:449

70.48.101.54:443

103.111.53.126:449

105.27.171.234:449

182.253.20.66:449

71.13.140.89:443

179.127.254.196:443

169.1.39.89:443

46.149.182.112:449

81.17.86.112:443

62.141.94.107:443

115.78.3.170:443

197.232.50.85:449

94.232.20.113:443

190.145.74.84:449

47.49.168.50:443

116.212.152.12:449

68.109.83.22:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Targets

- Target
  
  1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
- Size
  
  504KB
- MD5
  
  a379f491b8da10b9c3ae56c96aaa53f9
- SHA1
  
  408f4d2ba1f36528345420922bca21c1ddfbde72
- SHA256
  
  1850caf8fe55cb202bf5bae0b6a425b2b04043571425efff9ad80577d11e3afe
- SHA512
  
  e9316488cbda04ff776addfce0220aab84c5026f7b929bb4e65d60541005f7878ccc2f8d2500a4f2977e1989fe3886575ce74f74dd5906daa2733ec659732715
- SSDEEP
  
  6144:MHjoPGLwAy0nHjoPGLwEtiqs4iPuvJS1NHCDf/qZOPS893cQmU/lNU:0joelTjoeSWJSziDf/qY6g3cINU
Score

10^/10

trickbot jim321 banker evasion trojan persistence
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Executes dropped EXE
- Stops running service(s)
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

Tasks

static1

behavioral1

trickbotjim321bankerevasiontrojan

behavioral2

trickbotjim321bankerpersistencetrojan

© 2018-2024

Terms | Privacy