trickbot | ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4 | Triage

Sharing

General

Target

ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
Size

392KB
Sample

221130-w9f3rseb56
MD5

34cf3e2d6540a766ece89e5940ad69aa
SHA1

83d1317d59ca952c8dd634013fbcd78f56a8332f
SHA256

ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
SHA512

57ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
SSDEEP

6144:ttVAy6rtb3bkx/6y4HbQQJz0kv1Wxorv7uGY6/S3X43oBAA2J:tyhbkx/6y47QSZUxorCn3Uos

Score

10^/10

trickbot jim364 banker evasion persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000310

Botnet

jim364

C2

82.202.212.172:443

24.247.181.155:449

24.247.182.39:449

213.183.63.16:443

74.132.133.246:449

24.247.182.7:449

71.14.129.8:449

198.46.131.164:443

74.132.135.120:449

198.46.160.217:443

71.94.101.25:443

206.130.141.255:449

192.3.52.107:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

108.160.196.130:449

23.94.187.116:443

103.110.91.118:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
- Size
  
  392KB
- MD5
  
  34cf3e2d6540a766ece89e5940ad69aa
- SHA1
  
  83d1317d59ca952c8dd634013fbcd78f56a8332f
- SHA256
  
  ed9492ad5e165e642e407c48831c964cd01646921ca84913b42c596ca19103e4
- SHA512
  
  57ef93b7680f860e8e0079cabd5b109c99fe4cb214fa06b81af832aee022a47c83e54b5225a10e47b63134f40f558ebc60aefb93dbe7cd58d73cda6eee691f39
- SSDEEP
  
  6144:ttVAy6rtb3bkx/6y4HbQQJz0kv1Wxorv7uGY6/S3X43oBAA2J:tyhbkx/6y47QSZUxorCn3Uos
Score

10^/10

trickbot jim364 banker evasion trojan persistence
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Executes dropped EXE
- Stops running service(s)
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

Tasks

static1

behavioral1

trickbotjim364bankerevasiontrojan

behavioral2

trickbotjim364bankerpersistencetrojan