Overview

overview

10

Static

static

3

a469be02ff...18.exe

windows7-x64

10

a469be02ff...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a469be02ff61bc09f6b6ddf0288912c7_JaffaCakes118

  • Size

    332KB

  • Sample

    240613-h9ggmsyhjf

  • MD5

    a469be02ff61bc09f6b6ddf0288912c7

  • SHA1

    a759aec454148e287ed64e10b5d52a4c52029a16

  • SHA256

    ee625df63c3b9d4f44d817d4de993f8baac0e6392326a2a0e41cc67da828720e

  • SHA512

    1b2195df4ac6b2c0c3d3f0d71fe51a6bcb90721773f71f8fba46193ef70de9cc9141829824fb40fd40669cadf21fa9f885c8b4d585441af3f166682df31f1a0a

  • SSDEEP

    6144:tWXQ+SLJ7v0cH9yRZiTAUbwp++0qZy1wSJR5rMpmez8iiXe:thNZ04oRpUbwtk1wSJR5rMh8C

Score
10/10
trickbotser0625bankerevasionexecutionpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

1000214

Botnet

ser0625

C2

138.34.32.218:443

86.61.177.139:443

47.40.90.210:443

93.109.242.134:443

62.31.150.202:443

158.58.131.54:443

36.74.100.211:449

66.229.97.133:443

200.111.167.227:449

109.86.227.152:443

85.172.38.59:449

67.162.236.158:443

66.232.212.59:443

173.26.243.116:443

182.253.210.130:449

67.159.157.150:443

119.2.47.14:443

209.121.142.202:449

138.34.32.74:443

209.121.142.214:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      a469be02ff61bc09f6b6ddf0288912c7_JaffaCakes118

    • Size

      332KB

    • MD5

      a469be02ff61bc09f6b6ddf0288912c7

    • SHA1

      a759aec454148e287ed64e10b5d52a4c52029a16

    • SHA256

      ee625df63c3b9d4f44d817d4de993f8baac0e6392326a2a0e41cc67da828720e

    • SHA512

      1b2195df4ac6b2c0c3d3f0d71fe51a6bcb90721773f71f8fba46193ef70de9cc9141829824fb40fd40669cadf21fa9f885c8b4d585441af3f166682df31f1a0a

    • SSDEEP

      6144:tWXQ+SLJ7v0cH9yRZiTAUbwp++0qZy1wSJR5rMpmez8iiXe:thNZ04oRpUbwtk1wSJR5rMh8C

    Score
    10/10
    trickbotser0625bankerevasionexecutiontrojanpersistence

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks