Overview

overview

10

Static

static

3

213f7ad750...18.exe

windows7-x64

10

213f7ad750...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    213f7ad750d19a54261036b1af0d4d47_JaffaCakes118

  • Size

    412KB

  • Sample

    240507-xhx3msac2y

  • MD5

    213f7ad750d19a54261036b1af0d4d47

  • SHA1

    d476f107e55c90c063b7a49ca63292cd0402f5d7

  • SHA256

    5372e8b0e4f6faefe0da17b4e81fb0eb1554c0b5e2d3ce5500d70d1e6511f436

  • SHA512

    d65b01b82b294a07f3eed069ad7836c401493819670f60b29c02b5e5dbe18ceffa2f57176e8e6989505ea3213deb493a794b7692bb802e172ce7a990099075a0

  • SSDEEP

    6144:vhltaynk6tHuwvi2MQYP+kS764me2Z3yrD6VFhvpLb:vUKk6tHuQiRJPjwmeY+6FJb

Score
10/10
trickbottot271bankerevasionexecutionpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

1000231

Botnet

tot271

C2

138.34.32.218:443

178.78.202.189:443

85.9.212.117:443

93.109.242.134:443

103.210.30.201:443

158.58.131.54:443

87.117.146.63:443

118.200.151.113:443

89.117.107.13:443

109.86.227.152:443

200.2.126.98:443

31.29.62.112:443

83.167.164.81:443

194.68.23.182:443

182.253.210.130:449

77.89.86.93:443

70.79.178.120:449

68.109.83.22:443

185.129.193.221:443

184.68.167.42:443
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      213f7ad750d19a54261036b1af0d4d47_JaffaCakes118

    • Size

      412KB

    • MD5

      213f7ad750d19a54261036b1af0d4d47

    • SHA1

      d476f107e55c90c063b7a49ca63292cd0402f5d7

    • SHA256

      5372e8b0e4f6faefe0da17b4e81fb0eb1554c0b5e2d3ce5500d70d1e6511f436

    • SHA512

      d65b01b82b294a07f3eed069ad7836c401493819670f60b29c02b5e5dbe18ceffa2f57176e8e6989505ea3213deb493a794b7692bb802e172ce7a990099075a0

    • SSDEEP

      6144:vhltaynk6tHuwvi2MQYP+kS764me2Z3yrD6VFhvpLb:vUKk6tHuQiRJPjwmeY+6FJb

    Score
    10/10
    trickbottot271bankerevasionexecutiontrojanpersistence

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks