🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bedc5de10401cf085dbcc630e5e90effcef8f91bc641814c26617dfe4068583e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bedc5de10401cf085dbcc630e5e90effcef8f91bc641814c26617dfe4068583e
SHA3-384 hash: f9b8669f4895cdda3d79e7a764c4dce1657f3de991f1dec65324a8b3132cacd36675f2d932432d1f9660969b2cff588a
SHA1 hash: 8387a2c1575b82edafff48f6685453a64e7f7483
MD5 hash: ad71736a0833f599dc0f8cc1d6617746
humanhash: burger-vegan-north-mike
File name:ad71736a0833f599dc0f8cc1d6617746.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:493'056 bytes
First seen:2021-04-23 06:14:27 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash fe54aa4914f46efb2484d8839e21efc3 (4 x TrickBot)
ssdeep 12288:IUD6rqv9FL3FPasBZjYRVxeiia5Cuym4G8rhC:HDFSpn0ix5Cuym5Ih
TLSH C1A4BE03F2085258ECA790BB2D883FCAC25407ED2F06663FFA5C99C647894BB65D9747
Reporter abuse_ch
Tags:dll net1 TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/143783/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46158276.7018.20063.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/694687
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses Windows timers to delay execution
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 396269 Sample: WOWpHmAaJD.dll Startdate: 23/04/2021 Architecture: WINDOWS Score: 100 38 Found malware configuration 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected Trickbot 2->42 44 Yara detected Trickbot 2->44 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 rundll32.exe 8->15         started        signatures5 46 Writes to foreign memory regions 10->46 48 Allocates memory in foreign processes 10->48 50 Uses Windows timers to delay execution 10->50 52 Delayed program exit found 10->52 17 wermgr.exe 10->17         started        20 rundll32.exe 13->20         started        22 wermgr.exe 15->22         started        process6 signatures7 26 Found potential dummy code loops (likely to delay analysis) 17->26 28 Tries to detect virtualization through RDTSC time measurements 17->28 30 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 17->30 32 Writes to foreign memory regions 20->32 34 Allocates memory in foreign processes 20->34 36 Uses Windows timers to delay execution 20->36 24 wermgr.exe 20->24         started        process8
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bedc5de10401cf085dbcc630e5e90effcef8f91bc641814c26617dfe4068583e/
Threat name:
Win32.Trojan.BankerX
Create hunting rule
Status:
Malicious
First seen:
2021-04-22 06:53:00 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3of3yieahhqqxn4yyyol2io77hpr6i3yzayctbgmf674qdila7a._file
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:net1 banker trojan
Link:
https://tria.ge/reports/210423-n6np99pvgj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.66.72.217:443
117.252.68.211:443
103.124.173.35:443
115.73.211.230:443
117.54.250.246:443
131.0.112.122:443
102.176.221.78:443
181.176.161.143:443
154.79.251.172:443
103.111.199.76:443
103.54.41.193:443
154.79.244.182:443
154.79.245.158:443
139.255.116.42:443
178.254.161.250:443
178.134.47.166:443
158.181.179.229:443
103.90.197.33:443
109.207.165.40:443
178.72.192.20:443
Unpacked files
SH256 hash:
b9c7ddf5c834ab3f2591f64c31a9ecb552c2a47fc3363e31d67dda038e441d80
MD5 hash:
c792d74bb412f96f2d2fb38e9a2aacf2
SHA1 hash:
b5cca1789231bc0fdbc3caf4f92fb630090eea57
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/a2230950-4fbc-4443-9442-e31b4b75f35c/
SH256 hash:
e96d69e286ae65470d50e058c3c7cd36c77303ba4a2792680fd55150fa284d95
MD5 hash:
e95eb3dd17b6f9f7aa0757eb2b54e681
SHA1 hash:
f32689b4c15a456d22dd25c8e0c562ecd79f8618
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/a2230950-4fbc-4443-9442-e31b4b75f35c/
SH256 hash:
bedc5de10401cf085dbcc630e5e90effcef8f91bc641814c26617dfe4068583e
MD5 hash:
ad71736a0833f599dc0f8cc1d6617746
SHA1 hash:
8387a2c1575b82edafff48f6685453a64e7f7483
Link:
https://www.unpac.me/results/a2230950-4fbc-4443-9442-e31b4b75f35c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bedc5de10401cf085dbcc630e5e90effcef8f91bc641814c26617dfe4068583e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll bedc5de10401cf085dbcc630e5e90effcef8f91bc641814c26617dfe4068583e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1154769/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/143783/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-23 07:17:29 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0052] File System Micro-objective::Writes File