🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
SHA3-384 hash: 25b798518598d2c4e6bc3e51213f4e0c7a98170e62ce142af420f873fa874b2834eb46b9b77ef5b8831c5168d0cf43fd
SHA1 hash: e23a3d3a7ce75f2ff9d1af7591e770042ef7f0db
MD5 hash: 7cdbcf8253a45f476d2a8d1dbf7bac37
humanhash: sixteen-lamp-steak-aspen
File name:triage_dropped_file
Download: download sample
Signature TrickBot
Create hunting rule
File size:487'551 bytes
First seen:2021-10-05 16:55:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f34a0f23e05f2c2a829565c932b87430 (15 x TrickBot)
ssdeep 12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Klld:bEKNb/aZl6KdSrs+d
Threatray 4'022 similar samples on MalwareBazaar
TLSH T1FAA4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter malwarelabnet
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/195139/
Detection(s):
SecuriteInfo.com.ML.PE-A.3070.28721.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/615c83a5b95458900cdc8db0/reports/f342e4d1-70c5-4704-bb30-f734c3088a73/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f9c2ce08-699b-485b-bc85-320c2cb3f554
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/864985
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for dropped file
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 497413 Sample: triage_dropped_file Startdate: 05/10/2021 Architecture: WINDOWS Score: 100 80 Found malware configuration 2->80 82 Multi AV Scanner detection for dropped file 2->82 84 Yara detected Trickbot 2->84 86 Sigma detected: Regsvr32 Command Line Without DLL 2->86 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        13 regsvr32.exe 2->13         started        15 rundll32.exe 2->15         started        process3 signatures4 88 Writes to foreign memory regions 8->88 90 Allocates memory in foreign processes 8->90 17 regsvr32.exe 8->17         started        20 cmd.exe 1 8->20         started        22 rundll32.exe 8->22         started        24 2 other processes 8->24 process5 dnsIp6 72 Writes to foreign memory regions 17->72 74 Allocates memory in foreign processes 17->74 76 Queues an APC in another process (thread injection) 17->76 27 wermgr.exe 2 17->27         started        78 Early bird code injection technique detected 20->78 31 rundll32.exe 20->31         started        33 wermgr.exe 22->33         started        52 www.myexternalip.com 34.117.59.81, 443, 49873 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 24->52 54 57.143.129.102.zen.spamhaus.org 24->54 56 2 other IPs or domains 24->56 36 iexplore.exe 2 152 24->36         started        signatures7 process8 dnsIp9 58 103.75.32.173, 443, 49818, 49841 ELYZIUM-ASElyziumTechnologiesPvtLtdIN India 27->58 66 4 other IPs or domains 27->66 92 Tries to detect virtualization through RDTSC time measurements 27->92 94 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 27->94 96 Writes to foreign memory regions 31->96 98 Allocates memory in foreign processes 31->98 100 Delayed program exit found 31->100 38 wermgr.exe 31->38         started        60 202.9.121.143, 443, 49822, 49848 WORLD-ASWorldStarCommunicationIN India 33->60 68 4 other IPs or domains 33->68 42 C:\Users\user\...\yotriage_dropped_filees.trd, PE32 33->42 dropped 62 ssp.ads.betweendigital.com 96.46.183.20, 443, 49811, 49812 SERVERS-COMUS United States 36->62 64 dart.l.doubleclick.net 172.217.168.38, 443, 49831, 49832 GOOGLEUS United States 36->64 70 28 other IPs or domains 36->70 file10 signatures11 process12 dnsIp13 46 36.91.117.231, 443, 49810, 49842 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID Indonesia 38->46 48 wtfismyip.com 54.39.106.25, 49860, 80 OVHFR Canada 38->48 50 3 other IPs or domains 38->50 44 C:\Users\user\...\mytriage_dropped_fileca.trd, PE32 38->44 dropped file14
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-05 16:56:05 UTC
AV detection:
18 of 45 (40.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
TrickBot
3816e3845184a41e9c7a1bcb9dacd089e712f72fff6f44ab4d55d563b0177652
TrickBot
3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e
TrickBot
473dfbecc3818114569a9a9f80b0a51ad74b3d88fa778158ab145e839ecb042c
TrickBot
49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856
TrickBot
5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2
TrickBot
a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6
TrickBot
c9a17531e2ae6361f893390f51295609f4a2fde60927a9afeac9a9e0c4fc2660
TrickBot
d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
TrickBot
def94d349e3c5637e40dcf603fd7c41d8807f13c0804bea48f1e098fd7629578
TrickBot
+ 4'012 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zvs1 banker trojan
Link:
https://tria.ge/reports/211005-vfpblsabb7/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
2aadcd168cc1e1cc465b57548f32f26f3d45fefe61e072563915ddf826a5b32d
MD5 hash:
165222903380731b1cf87db722b54aa5
SHA1 hash:
cad66a3edd3b3eafa9d9816c40e033f99ef18ed6
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/01310d39-e532-4930-b405-2f70c6d44cd1/
Parent samples :
a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6
2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446
57db3ac25a078af4897c0e0074529675c5deae55088709e692c2f1e6beb54cf7
2307eacaaf8da934e5d59e8c82510bb8174a127b1a5832dd581f13c56ddfb105
7648c2583b2f2e47a49f3ca435189ad0b21ec43efade37d98333917285732474
dfa2198d6443e31115a8fafa2909c3047793a77da81b301bc94c44362de81214
eaa6d9eaaacd31815717f5b972982b8ea2a6b8c078b323a4a4989d3161a4f975
37c7c855b9d5d3ab3537c05accac8850fce15b06833f418e658b700c5425ac25
90affcc89243f2e6f5eed9f89ec42079459510e329abb132a4749fe0817af1eb
0e3d9ce252ddfed3baf8dd48a895a2e6b718021abd242626ade783e423c4d96c
a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff
89932cba5b5d516255703ec625731f812e8939f6c6d64af82019ce3050280a29
e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8
SH256 hash:
6306bbdc63e0ec3720047f5a6e28c67890ad1c8765ceec85cde5889162293b22
MD5 hash:
3409f865936a247957955ad2df45a2cd
SHA1 hash:
be7e5017d762bc10278ddd0c6b7752c50c014ae0
Link:
https://www.unpac.me/results/01310d39-e532-4930-b405-2f70c6d44cd1/
SH256 hash:
3dc39f72fc1dd38da7277ffed474b5a3252809038ee23fe60f4232b5f7c7dff2
MD5 hash:
b67694dddf98298b539bddc8cabc255d
SHA1 hash:
7cfdc9b871972066055bdbe586dc8b394b6c0499
Link:
https://www.unpac.me/results/01310d39-e532-4930-b405-2f70c6d44cd1/
SH256 hash:
6515084c99478975c73987727e813ea6e8fa8046f425c8e88b54f6eeeea225d8
MD5 hash:
34d6a6bffa656c6b0c7b588e111dbed1
SHA1 hash:
06aea3fd95b58a9a93f7fc2a721c715be6c3b7b1
Link:
https://www.unpac.me/results/01310d39-e532-4930-b405-2f70c6d44cd1/
SH256 hash:
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
MD5 hash:
7cdbcf8253a45f476d2a8d1dbf7bac37
SHA1 hash:
e23a3d3a7ce75f2ff9d1af7591e770042ef7f0db
Link:
https://www.unpac.me/results/01310d39-e532-4930-b405-2f70c6d44cd1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d4d7324725a1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/195139/

Comments