MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3b6ecc403a04c8df0c501d2cd369c01635620aa5eb2da01698d0d319dd1b781. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3b6ecc403a04c8df0c501d2cd369c01635620aa5eb2da01698d0d319dd1b781
SHA3-384 hash: bc1ff1d55ba415a4a1488360ce10abf22b33e5d1723c2de0576ed0df57c3728d2beffad53f809d31c788b9f3878001d3
SHA1 hash: e2f5feab5a45d5607dfe6c22b1db662c56e047db
MD5 hash: e231da087aae05ef16c8dae0030b6490
humanhash: dakota-magnesium-mexico-ohio
File name:e231da087aae05ef16c8dae0030b6490.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:333'312 bytes
First seen:2021-12-24 08:09:26 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 140793172cc35d6ed3ad0ac6b0e6b01c (2 x TrickBot)
ssdeep 6144:ejBZkkmxeyHT9Dy15VpSC21QhHGRnDDUNiFJ557aGb:UBZkkmxFBDyHLJ212GRDDUiF5P
Threatray 3 similar samples on MalwareBazaar
TLSH T146640212B7B2C039C5A3623054B5D7B1297A3D635AB9418B7F916B7DCE303E09A38367
File icon (PE):PE icon
dhash icon e4d0d0f8e4e8d804 (7 x TrickBot)
Reporter abuse_ch
Tags:dll rob144 TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
921
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216114/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Searching for the window
DNS request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61c5805eec6c6c14a9eea239/reports/448e7f87-c4e3-464d-9a8b-c38d049859d9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1700ab7-7a54-417d-b5f5-9c3fe84fb35c
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/912378
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544853 Sample: Se23ydIlT7.dll Startdate: 24/12/2021 Architecture: WINDOWS Score: 100 33 103.36.79.3 WOWSOLUTIONS-ASWowSolutionsandSystemsPvtLtdIN India 2->33 35 189.51.118.78 VIPWayTelecomunicacoesLtdaBR Brazil 2->35 37 21 other IPs or domains 2->37 47 Multi AV Scanner detection for domain / URL 2->47 49 Found malware configuration 2->49 51 Antivirus detection for URL or domain 2->51 53 6 other signatures 2->53 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 cmd.exe 1 9->14         started        16 rundll32.exe 9->16         started        signatures6 55 Writes to foreign memory regions 11->55 57 Allocates memory in foreign processes 11->57 59 Delayed program exit found 11->59 18 wermgr.exe 11->18         started        21 cmd.exe 11->21         started        23 rundll32.exe 14->23         started        25 wermgr.exe 16->25         started        27 cmd.exe 16->27         started        process7 signatures8 39 Tries to detect virtualization through RDTSC time measurements 18->39 41 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 18->41 43 Writes to foreign memory regions 23->43 45 Allocates memory in foreign processes 23->45 29 wermgr.exe 23->29         started        31 cmd.exe 23->31         started        process9
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d3b6ecc403a04c8df0c501d2cd369c01635620aa5eb2da01698d0d319dd1b781/
Threat name:
Win32.Spyware.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-12-24 05:46:09 UTC
File Type:
PE (Dll)
Extracted files:
21
AV detection:
17 of 28 (60.71%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2o3ozradubgi34gfahjm2nu4afrvmifkl2znualjrugtdhorw6aq._file
Verdict:
unknown
Similar samples:
4c08a4614de36445ea712490ef4699a1414db5449936b8ca2e801e1e8fa12151
TrickBot
f5a0b5b7892adbca1bce723fd952544006cfa8f05a9888f77544416287e99a8b
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob144 banker suricata trojan
Link:
https://tria.ge/reports/211224-j2qwsaddfn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443
Unpacked files
SH256 hash:
26c75b2adf54e81fa8c2aedbc773d5b5e845d9dffec9ea8de3a7ef9c2412214e
MD5 hash:
cf1ec1bfb9da5dcb0f193f7e485bd441
SHA1 hash:
1962f8f90e7a51231fcd970e572a447139529256
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8139a231-c0f0-4776-9eec-be11992b5c5d/
Parent samples :
f5a0b5b7892adbca1bce723fd952544006cfa8f05a9888f77544416287e99a8b
4c08a4614de36445ea712490ef4699a1414db5449936b8ca2e801e1e8fa12151
d3b6ecc403a04c8df0c501d2cd369c01635620aa5eb2da01698d0d319dd1b781
SH256 hash:
d3b6ecc403a04c8df0c501d2cd369c01635620aa5eb2da01698d0d319dd1b781
MD5 hash:
e231da087aae05ef16c8dae0030b6490
SHA1 hash:
e2f5feab5a45d5607dfe6c22b1db662c56e047db
Link:
https://www.unpac.me/results/8139a231-c0f0-4776-9eec-be11992b5c5d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d3b6ecc403a0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3b6ecc403a04c8df0c501d2cd369c01635620aa5eb2da01698d0d319dd1b781

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll d3b6ecc403a04c8df0c501d2cd369c01635620aa5eb2da01698d0d319dd1b781

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/216114/
  
URLhaus
https://urlhaus.abuse.ch/url/1914408/
  
Delivery method
Distributed via web download

Comments