🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e24fd0e2d521e98cb0a68d0bdb434e45d02a0f636ac3ce9ad99c061a17e23b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e24fd0e2d521e98cb0a68d0bdb434e45d02a0f636ac3ce9ad99c061a17e23b3
SHA3-384 hash: 76c3540b962c67c0020e9db3c97c3deb0d35dd1d3b618be78d0db9a330fc9158e978d163d75cd619ea16839253a7aa46
SHA1 hash: 365abe99ea717f529330ed9c60c72bc9b9eb66ef
MD5 hash: e00231bd4d68fc72b496a9fbf9f42ac6
humanhash: december-nuts-fish-ten
File name:triage_dropped_file
Download: download sample
Signature TrickBot
Create hunting rule
File size:429'203 bytes
First seen:2021-10-12 17:16:20 UTC
Last seen:2021-10-12 18:20:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dc56e072f32d1e6dbbad8cbe6ec04fdb (2 x TrickBot)
ssdeep 12288:YQNr8R0/3yMMUeT5LYvIof0KEBcTLdJqjsIiq:U0/3yMMZhYvIo3YiLlIF
Threatray 1'117 similar samples on MalwareBazaar
TLSH T1BE94DF1233D0C071D26F3679086697B12B6A7C309BB6C74F3F907A7E5E706919E2835A
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter malwarelabnet
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197009/
Detection(s):
SecuriteInfo.com.UDS.Trojan.Win32.Trickpak.gen.12338.21889.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/6165c310fd35fe780c3b19ac/reports/1529470f-4b5f-49b5-b1ad-1c1f68321593/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7f133b51-3a12-422a-b19e-6dbe3bd040b9
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/868909
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Machine Learning detection for sample
Queues an APC in another process (thread injection)
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 501333 Sample: triage_dropped_file Startdate: 12/10/2021 Architecture: WINDOWS Score: 100 82 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->82 84 Found malware configuration 2->84 86 Yara detected Trickbot 2->86 88 3 other signatures 2->88 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        13 regsvr32.exe 2->13         started        process3 signatures4 92 Writes to foreign memory regions 8->92 94 Allocates memory in foreign processes 8->94 15 rundll32.exe 8->15         started        18 regsvr32.exe 8->18         started        20 cmd.exe 1 8->20         started        22 2 other processes 8->22 process5 dnsIp6 108 Hijacks the control flow in another process 15->108 110 Writes to foreign memory regions 15->110 112 Allocates memory in foreign processes 15->112 25 wermgr.exe 15->25         started        114 Queues an APC in another process (thread injection) 18->114 29 wermgr.exe 18->29         started        116 Early bird code injection technique detected 20->116 31 rundll32.exe 20->31         started        62 wtfismyip.com 54.39.106.25, 49871, 80 OVHFR Canada 22->62 64 106.243.129.116, 443, 50033, 52200 LGDACOMLGDACOMCorporationKR Korea Republic of 22->64 66 3 other IPs or domains 22->66 33 iexplore.exe 2 154 22->33         started        signatures7 process8 dnsIp9 68 186.235.48.8, 443, 50032, 50464 InorpelIndNordestinadeProdEletricosLtdaBR Brazil 25->68 70 103.9.188.78, 443, 49824, 49845 EZECOM-AS-APEZECOMlimitedKH Cambodia 25->70 76 3 other IPs or domains 25->76 96 Hijacks the control flow in another process 25->96 98 Writes to foreign memory regions 25->98 35 svchost.exe 25->35         started        40 svchost.exe 25->40         started        72 103.146.232.154, 443, 49793, 49836 WIDENET-AS-INWideNetcomIndiaIN unknown 29->72 78 6 other IPs or domains 29->78 100 Tries to detect virtualization through RDTSC time measurements 29->100 102 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 29->102 42 svchost.exe 29->42         started        104 Allocates memory in foreign processes 31->104 106 Delayed program exit found 31->106 44 wermgr.exe 31->44         started        74 pixel-origin.mathtag.com 185.29.134.244, 443, 49818, 49819 MEDIAMATH-INCUS United Kingdom 33->74 80 26 other IPs or domains 33->80 signatures10 process11 dnsIp12 54 109.87.143.67, 443, 50049, 50060 TRIOLANUA Ukraine 35->54 56 178.151.205.154, 443, 50043, 50054 TRIOLANUA Ukraine 35->56 60 9 other IPs or domains 35->60 46 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 35->46 dropped 48 C:\Users\user\AppData\...\Login Data.bak, SQLite 35->48 dropped 50 C:\Users\user\AppData\Local\...\History.bak, SQLite 35->50 dropped 52 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 35->52 dropped 90 Tries to harvest and steal browser information (history, passwords, etc) 35->90 58 45.115.172.105, 443, 49787, 50037 MNET-ASMukandInfotelPvtLtdIN India 44->58 file13 signatures14
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1e24fd0e2d521e98cb0a68d0bdb434e45d02a0f636ac3ce9ad99c061a17e23b3/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-12 17:19:31 UTC
AV detection:
9 of 28 (32.14%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
295a8418d504dd81e1066eab3e78924fb107e3f74301f56be89544e942c19b9b
TrickBot
3b01e80fb0fb3746e3b75d29977f48cb476143bf46e8148359f5731efd880eb1
TrickBot
5787c6b7af7d648a2dd1caae5a73e9c92c38c061edb282d4189e51d5e2a79c49
TrickBot
7d588ba83fa25ee7e7911f192df709b8a19872de243ffbfc4c56428d903702e7
TrickBot
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
TrickBot
a46307e0930d4ef8071bcb0a0e2837abfb5ca74f6c767eb06854cfa3f6ee066e
TrickBot
abcd70d150c7f460719491d31d5e1278e43ba75c69c4b1a84de9de00f5d13af4
TrickBot
b278fa8838fbba987d404016dc4e83c5177d64ebe4e9e230eeb7a5e6bbb51dee
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
+ 1'107 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev4 banker trojan
Link:
https://tria.ge/reports/211012-vtpjjacfdm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
9e4ca0a49843292a6307c683bfaa652f67d66301b80e7f1ca6b50fbf4284419d
MD5 hash:
b513d0ad93b92c98df2faa890274a139
SHA1 hash:
d69557e410d7c116f2ee3936c9938ca54c05a111
Link:
https://www.unpac.me/results/4042bf33-63d2-4354-8222-66c6d2fa2022/
SH256 hash:
5db55b3446062457cfb322ec7dd19601713bea0c06ddb89cc175b962ca0d4d05
MD5 hash:
efcbd32e2672fc1863a9af27613959fa
SHA1 hash:
6addae189f2f9ee23595d2162ac9871d69471b21
Link:
https://www.unpac.me/results/4042bf33-63d2-4354-8222-66c6d2fa2022/
SH256 hash:
8813283453b7d796aa506156370542f2e7a326917d78d0c40430e686d197c613
MD5 hash:
bf4ac5189550ba2a13737b248bebbe61
SHA1 hash:
6921870a6d8c13221fab14c1be239c7b92f0aa96
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/4042bf33-63d2-4354-8222-66c6d2fa2022/
SH256 hash:
80ecbd78b8fd2b4246cf2626acc2c7ae4bacb3a12fbfa3a4aae17bcf57ae433d
MD5 hash:
d83701e84d8e555818e952e858bbf038
SHA1 hash:
62d3268fda389bd6b1a382157400df159beabf52
Link:
https://www.unpac.me/results/4042bf33-63d2-4354-8222-66c6d2fa2022/
SH256 hash:
1e24fd0e2d521e98cb0a68d0bdb434e45d02a0f636ac3ce9ad99c061a17e23b3
MD5 hash:
e00231bd4d68fc72b496a9fbf9f42ac6
SHA1 hash:
365abe99ea717f529330ed9c60c72bc9b9eb66ef
Link:
https://www.unpac.me/results/4042bf33-63d2-4354-8222-66c6d2fa2022/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1e24fd0e2d52/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e24fd0e2d521e98cb0a68d0bdb434e45d02a0f636ac3ce9ad99c061a17e23b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/197009/

Comments