Overview

overview

10

Static

static

3

b7cbc5e5dc...72.exe

windows7-x64

10

b7cbc5e5dc...72.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba0442170c6b3efa2fc1fae06239895dc13384945a02b56a51c5d4b601d93c87

  • Size

    192KB

  • Sample

    240417-qxxxvsbe6v

  • MD5

    70b23be0dbe057e2c249fc02103886b0

  • SHA1

    193b89d738a17cce35548dcaf94bc5bc491436a1

  • SHA256

    ba0442170c6b3efa2fc1fae06239895dc13384945a02b56a51c5d4b601d93c87

  • SHA512

    644aab10b007435b9cf7ca7705554496c60f4f37c837c5c6f484461123d9ecae5ff05ace8c79359e15503c97effb9cdebe78efda0bc53e8dbae33fade4c80c16

  • SSDEEP

    3072:7c9V3AkngbVSeKy4crK5SgevdwEmMsqcpYfvJbsx8zR3fYFJ2p7WXoyLxtIze22q:9LZPrQyiMUpY3JQgR3MJ2p7HyczbECxn

Score
10/10
trickbotbankerevasiontrojan

Malware Config

Targets

    • Target

      b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172.exe

    • Size

      368KB

    • MD5

      8402ab33eafb84178069f8f490ca604d

    • SHA1

      516c7a538e93f7cf4bff29196511f94e5fbb5a40

    • SHA256

      b7cbc5e5dc182c8d99809cd64d36734abeb6bfac15e6efc2ebcc2c57254bf172

    • SHA512

      ef0953826940f1eb6a596ed312d908b1e373e61972d8efbd2336425a7f13e6846c0f7341be2c78ac47c7786bacbe94336dcc51d0b270f8aaaa4842256da9ab97

    • SSDEEP

      6144:jo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qM:jmSuOcHmnYhrDMTrban4qM

    Score
    10/10
    trickbotbankerevasiontrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks