Overview

overview

10

Static

static

3

b6d7de5ac4...18.exe

windows7-x64

10

b6d7de5ac4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6d7de5ac47c20455438240fe1d2dda0_JaffaCakes118

  • Size

    552KB

  • Sample

    240617-ff4nzaygrj

  • MD5

    b6d7de5ac47c20455438240fe1d2dda0

  • SHA1

    702df932d53385c0c961e37648a7fac9eb6c7a76

  • SHA256

    8f6027f7d19f89f40870ec8d56469fdb357c426374cc7d36fe34f956b1c90082

  • SHA512

    8df0ab6cf8081cc0e41abbadeb4ada5bd286408e928405634449f2a7fa524cfb6e5f60c8d29d461696236b142a6633f136ea7aed77a8410fa1211a5d1d356e25

  • SSDEEP

    6144:6zPHbUV4/5/XSEH0uzrBP4crsx0t0Ld2CyIgs0/f6e7mY+pwdmL:HE5/lUUF/A0OoCUv5xd

Score
10/10
trickbotser0830usbankerevasionexecutiontrojan

Malware Config

Extracted

Family

trickbot

Version

1000253

Botnet

ser0830us

C2

195.54.163.150:443

168.167.51.10:443

178.116.83.49:443

176.114.66.20:449

162.212.112.175:449

158.58.131.54:443

104.254.10.200:449

118.200.151.113:443

41.211.9.234:449

81.227.16.44:443

109.173.104.236:449

212.225.214.249:449

81.17.86.112:443

41.189.173.18:443

46.149.182.112:449

197.232.243.36:449

94.232.20.113:443

47.49.168.50:443

70.79.178.120:449

68.109.83.22:443
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      b6d7de5ac47c20455438240fe1d2dda0_JaffaCakes118

    • Size

      552KB

    • MD5

      b6d7de5ac47c20455438240fe1d2dda0

    • SHA1

      702df932d53385c0c961e37648a7fac9eb6c7a76

    • SHA256

      8f6027f7d19f89f40870ec8d56469fdb357c426374cc7d36fe34f956b1c90082

    • SHA512

      8df0ab6cf8081cc0e41abbadeb4ada5bd286408e928405634449f2a7fa524cfb6e5f60c8d29d461696236b142a6633f136ea7aed77a8410fa1211a5d1d356e25

    • SSDEEP

      6144:6zPHbUV4/5/XSEH0uzrBP4crsx0t0Ld2CyIgs0/f6e7mY+pwdmL:HE5/lUUF/A0OoCUv5xd

    Score
    10/10
    trickbotbankerevasionexecutiontrojanser0830us

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks