MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415
SHA3-384 hash: ad3317db777c32b15ce6ce8ced55beac6770b063d67e64e06e3be24667e6ed4725fd3ddb6926171f065255f4a7cd171b
SHA1 hash: 68613f1b07c90a0a1e948d3c6be75cd6dde0335c
MD5 hash: 24a582c40e3cc01a53c71d13a464a6ef
humanhash: magnesium-maryland-wolfram-uranus
File name:24a582c40e3cc01a53c71d13a464a6ef
Download: download sample
Signature TrickBot
Create hunting rule
File size:524'288 bytes
First seen:2021-10-07 07:56:47 UTC
Last seen:2021-10-07 09:29:50 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fd98f67a63ecc847a2028c66b8388afb (8 x TrickBot)
ssdeep 6144:b3oOkxQXFDzaLtFD2aD3zAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM117qFp12iwPqvDr2VI9bZa
Threatray 4'090 similar samples on MalwareBazaar
TLSH T192B4DF02B3C08836D66B227A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter zbetcheckin
Tags:32 dll exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195697/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Trickpak.gen.22236.13325.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger
Link:
https://www.filescan.io/uploads/615ea852b95458900cddeb42/reports/c4e4ee40-e131-4308-8945-7e398457f522/overview
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/866130
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hijacks the control flow in another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 498555 Sample: US0VpFs3k0 Startdate: 07/10/2021 Architecture: WINDOWS Score: 100 67 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->67 69 Multi AV Scanner detection for submitted file 2->69 71 Sigma detected: Suspect Svchost Activity 2->71 73 Sigma detected: Suspicious Svchost Process 2->73 9 loaddll32.exe 1 2->9         started        11 rundll32.exe 2->11         started        process3 process4 13 cmd.exe 1 9->13         started        15 rundll32.exe 9->15         started        18 rundll32.exe 9->18         started        signatures5 20 rundll32.exe 13->20         started        91 Writes to foreign memory regions 15->91 93 Allocates memory in foreign processes 15->93 95 Queues an APC in another process (thread injection) 15->95 23 wermgr.exe 15->23         started        26 cmd.exe 15->26         started        process6 dnsIp7 75 Writes to foreign memory regions 20->75 77 Allocates memory in foreign processes 20->77 28 wermgr.exe 20->28         started        32 cmd.exe 20->32         started        59 65.152.201.203, 443, 49737, 49848 CENTURYLINK-US-LEGACY-QWESTUS United States 23->59 79 May check the online IP address of the machine 23->79 81 Tries to detect virtualization through RDTSC time measurements 23->81 83 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 23->83 signatures8 process9 dnsIp10 61 185.56.175.122, 443, 49738, 49740 VIRTUAOPERATOR-ASPL Poland 28->61 63 75.176.235.182, 443, 49753, 49854 TWC-11426-CAROLINASUS United States 28->63 65 4 other IPs or domains 28->65 87 Hijacks the control flow in another process 28->87 89 Writes to foreign memory regions 28->89 34 svchost.exe 11 28->34         started        39 svchost.exe 28->39         started        41 wermgr.exe 32->41         started        43 cmd.exe 32->43         started        signatures11 process12 dnsIp13 53 203.109.82.172, 443, 49866, 49892 YOU-INDIA-APYOUBroadbandCableIndiaLtdIN India 34->53 55 103.201.142.30, 443, 49863, 49889 WORLD-ASWorldStarCommunicationIN India 34->55 57 24 other IPs or domains 34->57 45 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 34->45 dropped 47 C:\Users\user\AppData\...\Login Data.bak, SQLite 34->47 dropped 49 C:\Users\user\AppData\Local\...\History.bak, SQLite 34->49 dropped 51 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 34->51 dropped 85 Tries to harvest and steal browser information (history, passwords, etc) 34->85 file14 signatures15
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 07:57:16 UTC
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrykzczgkm4vpmpilrz2ghs2cqnwz55xgei2atstushl6dtbkqkq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
TrickBot
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
TrickBot
37c129eb8bb575d7ac12fdd14b5d05edee15c1230d7b712e5b9d2533f78dc5b4
TrickBot
4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919
TrickBot
944c18692e200c4de70817facee4fd8662c99743d64e57e43dd3f212d68e8003
TrickBot
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
TrickBot
bdce492e4d57278c61292d96fc20f8de5d9649cc2acc243b89243204d183be1f
TrickBot
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
fd26c012af2d0325a5eb2397fa3b6b36b8480dc99a6f7b81b8a6423b029ca03b
TrickBot
+ 4'080 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:fat1 banker trojan
Link:
https://tria.ge/reports/211007-jtavlacad5/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
9c8b04423100da077bd128ce7f819064f7ed1a6c8897a792bfc1b20423ef6988
MD5 hash:
e6cf2df32bbebb0a2bddd0ad04fdfbe4
SHA1 hash:
ea316e164aeddd9832426023daf04f8a2f47f26d
Link:
https://www.unpac.me/results/ec710b6b-9ab6-45a7-9e5c-0455516a0e9a/
SH256 hash:
ee60352e84e0eea543aed0f41ab70ac65cd0ac4226c42b09c0177dfa5ada2dfa
MD5 hash:
e6fc3463f7df7f7e661b352346681d60
SHA1 hash:
da11152f274bcc29ce33ec9cd6da21685f350f84
Link:
https://www.unpac.me/results/ec710b6b-9ab6-45a7-9e5c-0455516a0e9a/
SH256 hash:
6a7713508a070a4ef2123bfc999fb9bf012ee5fe475a3b3adfeb99990c6a664d
MD5 hash:
30ec7187a0d5f14d5535929a274e51aa
SHA1 hash:
8040f763f4d0bf018f4a1a73965151b2dcb323f7
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/ec710b6b-9ab6-45a7-9e5c-0455516a0e9a/
Parent samples :
cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
37c129eb8bb575d7ac12fdd14b5d05edee15c1230d7b712e5b9d2533f78dc5b4
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
61d1417ece7c1bbd2fd4ca685fc92c5239fa8ced521b90cd92cebc983d4fcc5e
dbd1cfed3d0b57ac4b4affbcd942287617d1f7bdd322ba2464d22020e4e29200
SH256 hash:
3c7991fab579f08e337fe14fab42616ab1df9e1899db4508b50671b941f265e9
MD5 hash:
f3332f3fc1dd8fb7dc499cb566afd81b
SHA1 hash:
3c57fab42973d602992deff26060aad835d8ad87
Link:
https://www.unpac.me/results/ec710b6b-9ab6-45a7-9e5c-0455516a0e9a/
SH256 hash:
cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415
MD5 hash:
24a582c40e3cc01a53c71d13a464a6ef
SHA1 hash:
68613f1b07c90a0a1e948d3c6be75cd6dde0335c
Link:
https://www.unpac.me/results/ec710b6b-9ab6-45a7-9e5c-0455516a0e9a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/cc70ac8b2653/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195697/

Comments


Avatar
zbet commented on 2021-10-07 07:56:48 UTC

url : hxxp://89.41.182.95/images/lifegreen.png