🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075
SHA3-384 hash: b7906fa07f8484903acda8a9e86ef0b7f7edcad3194460726b48780089592281ae312139363a0ae901a7f40efa038430
SHA1 hash: afb6253e491e109ebe2445ab4935f37120420b5c
MD5 hash: 133f935f9bc1c919af18db30f9db657d
humanhash: magazine-jig-white-jupiter
File name:Documents.tmp
Download: download sample
Signature TrickBot
Create hunting rule
File size:1'816'576 bytes
First seen:2021-10-20 17:11:49 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 07695c81da8ca3f6eeb7be880986f8b1 (2 x TrickBot)
ssdeep 49152:7OkkXuEs0GpGwx4JaTD6ydQD1xR88sxq57nN:UXuEUX4
TLSH T1A5853B8AF9B38083EB95ACF92716179045831D791527A133BAEEF5E8A3BB531CC53350
Reporter ffforward
Tags:dll leg1 tmp TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
309
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198883/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61704de4db358dd15ec87352/reports/5545beac-962b-418b-b6da-e9492ddb646d/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f3170721-988b-4589-95c8-8055b75726fe
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/874068
Signature
Allocates memory in foreign processes
Found detection on Joe Sandbox Cloud Basic with higher score
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 506496 Sample: Documents.dll Startdate: 20/10/2021 Architecture: WINDOWS Score: 84 54 Found malware configuration 2->54 56 Yara detected Trickbot 2->56 58 Found detection on Joe Sandbox Cloud Basic with higher score 2->58 60 Initial sample is a PE file and has a suspicious name 2->60 8 loaddll32.exe 1 2->8         started        process3 signatures4 66 Writes to foreign memory regions 8->66 68 Allocates memory in foreign processes 8->68 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        16 iexplore.exe 1 74 8->16         started        18 5 other processes 8->18 process5 signatures6 20 rundll32.exe 11->20         started        70 Writes to foreign memory regions 13->70 72 Allocates memory in foreign processes 13->72 23 wermgr.exe 13->23         started        26 cmd.exe 13->26         started        28 iexplore.exe 2 153 16->28         started        30 WerFault.exe 23 9 18->30         started        process7 dnsIp8 62 Writes to foreign memory regions 20->62 64 Allocates memory in foreign processes 20->64 32 wermgr.exe 20->32         started        36 cmd.exe 20->36         started        40 216.166.148.187, 443, 49837, 49995 CYBERNET1US United States 23->40 42 dart.l.doubleclick.net 172.217.168.38, 443, 49829, 49830 GOOGLEUS United States 28->42 44 geolocation.onetrust.com 104.20.184.68, 443, 49805, 49806 CLOUDFLARENETUS United States 28->44 48 10 other IPs or domains 28->48 46 192.168.2.1 unknown unknown 30->46 signatures9 process10 dnsIp11 38 65.152.201.203, 443, 49838, 49994 CENTURYLINK-US-LEGACY-QWESTUS United States 32->38 50 Tries to detect virtualization through RDTSC time measurements 32->50 52 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 32->52 signatures12
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-20 17:12:04 UTC
AV detection:
7 of 27 (25.93%)
Threat level:
  1/5
Verdict:
malicious
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:leg1 banker suricata trojan
Link:
https://tria.ge/reports/211020-vqvldaacdj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
34d143a5dc0c48b6eb8700aafeb3ac7d61aea982d5dd5886a19d87993bf6c7a0
MD5 hash:
44f8999ef78715cd30ab88ef6238e10e
SHA1 hash:
682b350c0d57a6ad840fb01390972f512ff57a45
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/2501005e-46e5-4339-bbe1-032717a51e47/
Parent samples :
0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075
7a297e62cd649ae1763acd89bcf2135eebf6b3a910ca60621d84e004b078beb7
SH256 hash:
5162d1dc70a60a102f1f97e67c7824bce1225ad6c090becab059755c617c40eb
MD5 hash:
5f622e4727b66f230387349300763e77
SHA1 hash:
14435db402572842cb5e436a7936e437d941ba5a
Link:
https://www.unpac.me/results/2501005e-46e5-4339-bbe1-032717a51e47/
SH256 hash:
0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075
MD5 hash:
133f935f9bc1c919af18db30f9db657d
SHA1 hash:
afb6253e491e109ebe2445ab4935f37120420b5c
Link:
https://www.unpac.me/results/2501005e-46e5-4339-bbe1-032717a51e47/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0648bdad8a59/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/198883/

Comments