MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe
SHA3-384 hash: f3afc838da13b1fcc8581693a3b215c682a5849c56d2b0cd8deb990ed34683e4625662d10e1e2aedfcc5309c167f5773
SHA1 hash: cca1d33437022eae2c55f01774372b805043130b
MD5 hash: cbf9d8f27702f1845413a9be784cd616
humanhash: solar-georgia-five-hawaii
File name:redplane.png
Download: download sample
Signature TrickBot
Create hunting rule
File size:704'512 bytes
First seen:2021-10-14 18:07:42 UTC
Last seen:2021-10-14 18:55:11 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash c3999372aa5e8132ef67e26a98a6ced3 (4 x TrickBot)
ssdeep 12288:mUOGe6UVreQJtjqiI1DxynlwwxqXIwW2FUwoOvWmM/:i6UVr9oiuxqlwwhT2TbW3/
Threatray 4'253 similar samples on MalwareBazaar
TLSH T1CBE4BF02F2D1C036C1AE16345E166B55A3EDFD905E79C687FB88AB4F1E31AC19A35323
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:dll sof1 TrickBot


Avatar
abuse_ch
TrickBot payload URL:
http://195.133.192.101/images/redplane.png

TrickBot C2s:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Intelligence

File Origin
# of uploads :
2
# of downloads :
334
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197599/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.28008.18835.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/61687204fd35fe780c40a916/reports/ae4f7d0e-0647-4254-909a-4d13c538236f/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29ebc5db-8459-4501-9013-a6836aa2c382
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/870697
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 503124 Sample: redplane.png Startdate: 14/10/2021 Architecture: WINDOWS Score: 88 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Found malware configuration 2->46 48 Yara detected Trickbot 2->48 8 loaddll32.exe 1 2->8         started        10 rundll32.exe 2->10         started        process3 process4 12 rundll32.exe 8->12         started        15 cmd.exe 1 8->15         started        17 rundll32.exe 8->17         started        signatures5 60 Writes to foreign memory regions 12->60 62 Allocates memory in foreign processes 12->62 64 Queues an APC in another process (thread injection) 12->64 19 wermgr.exe 12->19         started        23 cmd.exe 12->23         started        25 rundll32.exe 15->25         started        27 wermgr.exe 17->27         started        29 cmd.exe 17->29         started        process6 dnsIp7 36 185.56.175.122, 443, 49752, 49803 VIRTUAOPERATOR-ASPL Poland 19->36 50 May check the online IP address of the machine 19->50 52 Tries to detect virtualization through RDTSC time measurements 19->52 54 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 19->54 56 Writes to foreign memory regions 25->56 58 Allocates memory in foreign processes 25->58 31 wermgr.exe 25->31         started        34 cmd.exe 25->34         started        signatures8 process9 dnsIp10 38 46.99.175.217, 443, 49753, 49755 IPKO-ASAL Albania 31->38 40 194.146.249.137, 443, 49761, 49814 VIRTUAOPERATOR-ASPL Poland 31->40 42 6 other IPs or domains 31->42
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252
TrickBot
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
TrickBot
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
TrickBot
26a6d15bb16939076bf726e4e573b2519f7fa222c35a3b5361d9c208a10b284b
TrickBot
4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919
TrickBot
5787c6b7af7d648a2dd1caae5a73e9c92c38c061edb282d4189e51d5e2a79c49
TrickBot
61d1417ece7c1bbd2fd4ca685fc92c5239fa8ced521b90cd92cebc983d4fcc5e
TrickBot
6cdc36e5c8774b62bbeeaa2141af5fd3c9c5ca33e0197e6301f76f23e59e9e22
TrickBot
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
+ 4'243 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:sof1 banker suricata trojan
Link:
https://tria.ge/reports/211014-wqwdcaahbn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
295979d0d4eae3debf6f78a7b971de28f0671d7efcac845da9bb97a342b11b7a
MD5 hash:
41b4d09c270421d2049ce0bb752ba1f3
SHA1 hash:
c26e42c3257db3c071f4b2ecf60c5e8865240afb
Link:
https://www.unpac.me/results/76242ea7-1e7b-4384-9d88-4b604347c2cf/
SH256 hash:
72c477c7ce3f96e9a6e5f3fe03045cee10c7eaaeead986afe686c224d09a4e5c
MD5 hash:
4e078636f76753ac6167653ac9e1b958
SHA1 hash:
8b5bca5b710024780de36b60b3431003f9f81325
Link:
https://www.unpac.me/results/76242ea7-1e7b-4384-9d88-4b604347c2cf/
SH256 hash:
8d88a5e9d338e6e3c84f5af97fa79889930ad4f2cbe12528347a2dc0c0b17bab
MD5 hash:
101d25118f0670f12d98d3b47aba9d44
SHA1 hash:
233b6b55a2492a0112a05072d728efde28c662cf
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/76242ea7-1e7b-4384-9d88-4b604347c2cf/
Parent samples :
14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe
9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2
be6f52a5ec95249cc20be5224a6c1e759e06a447c7996b98d063308d3077a2d0
8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3
SH256 hash:
e2de4de3147a386f1e9b2d020438e1dcf42219c562541b81b5e056a8d616e9aa
MD5 hash:
b02f4cf6da8ae9f18d9a71f3e0291549
SHA1 hash:
18b8e4881b51ba8117b1760f02247a007a7f6669
Link:
https://www.unpac.me/results/76242ea7-1e7b-4384-9d88-4b604347c2cf/
SH256 hash:
14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe
MD5 hash:
cbf9d8f27702f1845413a9be784cd616
SHA1 hash:
cca1d33437022eae2c55f01774372b805043130b
Link:
https://www.unpac.me/results/76242ea7-1e7b-4384-9d88-4b604347c2cf/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/14da4c490e00/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

TrickBot

Excel file xlsm 6cdc36e5c8774b62bbeeaa2141af5fd3c9c5ca33e0197e6301f76f23e59e9e22

TrickBot

DLL dll 14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1678225/
  
Dropped by
MD5 bb9509e3a758f80aba854fbf3f1fb7be
  
Dropped by
SHA256 6cdc36e5c8774b62bbeeaa2141af5fd3c9c5ca33e0197e6301f76f23e59e9e22
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/197599/

Comments