🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a297e62cd649ae1763acd89bcf2135eebf6b3a910ca60621d84e004b078beb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a297e62cd649ae1763acd89bcf2135eebf6b3a910ca60621d84e004b078beb7
SHA3-384 hash: e1c866cb0c3695f1889468b5dc785af0bce08a5ea50178bfa23c22fc5e7c71f449805c6a455ba47b627696c8c5c3231d
SHA1 hash: ddaed871b9f95a758b89c856a6d4ccf7751b8103
MD5 hash: ac1d4a51b8c1f7f98a1033e5bc2e1de7
humanhash: nitrogen-asparagus-three-romeo
File name:Documents.tmp
Download: download sample
Signature TrickBot
Create hunting rule
File size:1'406'464 bytes
First seen:2021-10-21 06:18:32 UTC
Last seen:2021-10-21 07:20:29 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 07695c81da8ca3f6eeb7be880986f8b1 (2 x TrickBot)
ssdeep 12288:9gV0iJJdhpMzAQkFkFrRJ20on1vRlueNkEN72ol11dqzVonjtQ25ux2K3hTIf:xFs6H6iwkG72ozPqz8hXQ2Us
Threatray 1 similar samples on MalwareBazaar
TLSH T101554D96BDF3C0C3FB90FCB117262790854769796523A176EBABB9A092FB531C817301
Reporter JAMESWT_WT
Tags:dll leg1 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
318
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/198988/
Detection(s):
SecuriteInfo.com.Suspicious.Win32.Save.a.5092.7655.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61710659a9d585e6d5312f9e/reports/a452c169-7301-432f-9ca0-042e0dc1573a/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b5610274-b818-4d08-b332-3f51754e492f
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/874348
Signature
Allocates memory in foreign processes
Found detection on Joe Sandbox Cloud Basic with higher score
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 506772 Sample: Documents.dll Startdate: 21/10/2021 Architecture: WINDOWS Score: 92 50 Found malware configuration 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Yara detected Trickbot 2->54 56 2 other signatures 2->56 8 loaddll32.exe 1 2->8         started        process3 signatures4 62 Writes to foreign memory regions 8->62 64 Allocates memory in foreign processes 8->64 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        16 iexplore.exe 2 86 8->16         started        18 5 other processes 8->18 process5 signatures6 20 rundll32.exe 11->20         started        66 Writes to foreign memory regions 13->66 68 Allocates memory in foreign processes 13->68 23 cmd.exe 13->23         started        25 wermgr.exe 13->25         started        27 iexplore.exe 7 150 16->27         started        30 WerFault.exe 23 9 18->30         started        process7 dnsIp8 58 Writes to foreign memory regions 20->58 60 Allocates memory in foreign processes 20->60 32 wermgr.exe 20->32         started        36 cmd.exe 20->36         started        40 dart.l.doubleclick.net 172.217.168.38, 443, 49823, 49824 GOOGLEUS United States 27->40 42 geolocation.onetrust.com 104.20.184.68, 443, 49782, 49783 CLOUDFLARENETUS United States 27->42 44 10 other IPs or domains 27->44 signatures9 process10 dnsIp11 38 46.99.175.149, 443, 49829, 49999 IPKO-ASAL Albania 32->38 46 Tries to detect virtualization through RDTSC time measurements 32->46 48 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 32->48 signatures12
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7a297e62cd649ae1763acd89bcf2135eebf6b3a910ca60621d84e004b078beb7/
Threat name:
Win32.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2021-10-20 19:39:12 UTC
AV detection:
8 of 28 (28.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:leg1 banker trojan
Link:
https://tria.ge/reports/211021-g267nahhf9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
34d143a5dc0c48b6eb8700aafeb3ac7d61aea982d5dd5886a19d87993bf6c7a0
MD5 hash:
44f8999ef78715cd30ab88ef6238e10e
SHA1 hash:
682b350c0d57a6ad840fb01390972f512ff57a45
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/3bcaf2c5-7537-4076-ab1c-b7791fc84f85/
Parent samples :
0648bdad8a597280f65f4db2448ba1524d6508841933156f4dfef9d1fe2e5075
7a297e62cd649ae1763acd89bcf2135eebf6b3a910ca60621d84e004b078beb7
SH256 hash:
5162d1dc70a60a102f1f97e67c7824bce1225ad6c090becab059755c617c40eb
MD5 hash:
5f622e4727b66f230387349300763e77
SHA1 hash:
14435db402572842cb5e436a7936e437d941ba5a
Link:
https://www.unpac.me/results/3bcaf2c5-7537-4076-ab1c-b7791fc84f85/
SH256 hash:
7a297e62cd649ae1763acd89bcf2135eebf6b3a910ca60621d84e004b078beb7
MD5 hash:
ac1d4a51b8c1f7f98a1033e5bc2e1de7
SHA1 hash:
ddaed871b9f95a758b89c856a6d4ccf7751b8103
Link:
https://www.unpac.me/results/3bcaf2c5-7537-4076-ab1c-b7791fc84f85/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7a297e62cd64/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/198988/

Comments