🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6ca24c311c1c36be175a7540259837dd6ca8fc56ebf65412da3c623d936c8e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6ca24c311c1c36be175a7540259837dd6ca8fc56ebf65412da3c623d936c8e1
SHA3-384 hash: bc4eb23ad9110e092bdaa12b0ef197acde5b609db4607ca6a59fba83cc01bfbabf091a646e4c9a1465288f81abcd598c
SHA1 hash: 5477c6035ea424b32bdb096328cba4284e7265ce
MD5 hash: 60f7bdbf247e6fc2a46ab0402831ba84
humanhash: oklahoma-seven-oklahoma-pasta
File name:triage_dropped_file
Download: download sample
Signature TrickBot
Create hunting rule
File size:626'776 bytes
First seen:2021-07-16 17:09:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9f325b9ad7eb6a885ed588ae8ed1dc00 (2 x TrickBot)
ssdeep 12288:1hO5t+bI1p1CcMNYzvEXR76y1XjNcWJa29rvFCw:1hrbI1pklYLEXfjCca29rvz
Threatray 845 similar samples on MalwareBazaar
TLSH T1C8D4AE1372D0CC75DAAB02355922C76852FAFD309EF5C247BF807B6D5E325438A2A366
Reporter malwarelabnet
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172232/
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/220f2c93-7e4d-460b-aa04-5de9649f4e2c
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817599
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450010 Sample: triage_dropped_file Startdate: 16/07/2021 Architecture: WINDOWS Score: 100 92 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->92 94 Found malware configuration 2->94 96 Yara detected Trickbot 2->96 98 2 other signatures 2->98 9 loaddll32.exe 1 2->9         started        12 rundll32.exe 2->12         started        14 regsvr32.exe 2->14         started        16 rundll32.exe 2->16         started        process3 signatures4 106 Writes to foreign memory regions 9->106 108 Allocates memory in foreign processes 9->108 18 wermgr.exe 9->18         started        22 regsvr32.exe 9->22         started        24 cmd.exe 1 9->24         started        26 2 other processes 9->26 process5 dnsIp6 64 45.239.234.2, 443, 49775 SPEEDNETFRUTALNETFIBRAEWIRELESSBR Brazil 18->64 66 49.248.217.170, 443, 49792, 49796 HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN India 18->66 68 6 other IPs or domains 18->68 100 Hijacks the control flow in another process 18->100 102 Writes to foreign memory regions 18->102 28 svchost.exe 18->28         started        32 svchost.exe 18->32         started        104 Allocates memory in foreign processes 22->104 34 wermgr.exe 22->34         started        37 rundll32.exe 24->37         started        39 wermgr.exe 26->39         started        41 iexplore.exe 150 26->41         started        signatures7 process8 dnsIp9 58 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 28->58 dropped 60 C:\Users\user\AppData\...\Login Data.bak, SQLite 28->60 dropped 62 C:\Users\user\AppData\Local\...\History.bak, SQLite 28->62 dropped 110 Tries to harvest and steal browser information (history, passwords, etc) 28->110 70 118.173.233.64, 443, 49769 TOT-NETTOTPublicCompanyLimitedTH Thailand 34->70 72 45.201.136.3, 443, 49782, 49787 KINGCORP-KHOpenNetISPCambodiaKH Seychelles 34->72 78 6 other IPs or domains 34->78 112 Tries to detect virtualization through RDTSC time measurements 34->112 114 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 34->114 43 svchost.exe 34->43         started        116 Writes to foreign memory regions 37->116 118 Allocates memory in foreign processes 37->118 45 wermgr.exe 37->45         started        74 190.109.204.126, 443, 49786, 49788 METROREDSADECVHN Honduras 39->74 76 41.57.156.203, 443, 49772, 49785 BCSNETZA South Africa 39->76 80 6 other IPs or domains 39->80 49 svchost.exe 39->49         started        82 10 other IPs or domains 41->82 file10 signatures11 process12 dnsIp13 86 14.232.161.45, 443 VNPT-AS-VNVNPTCorpVN Viet Nam 45->86 88 116.212.152.225, 443, 49795 MEKONGNET-ADC-AS-APANGKORDATACOMMUNICATIONKH Cambodia 45->88 90 8 other IPs or domains 45->90 120 Hijacks the control flow in another process 45->120 122 Writes to foreign memory regions 45->122 51 svchost.exe 45->51         started        54 svchost.exe 45->54         started        56 svchost.exe 45->56         started        signatures14 process15 dnsIp16 84 12.23.113.92, 443 ATT-INTERNET4US United States 51->84
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f6ca24c311c1c36be175a7540259837dd6ca8fc56ebf65412da3c623d936c8e1/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-07-16 17:10:04 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
430efdb79d9d0560d74c99566671d064f93746e4162fc8c492a5b023ac6c0442
TrickBot
6ac9af13a02c781f20484c344a61f47c1988b93f99786fcb93042678ac7be760
TrickBot
82ee229f96371decb519948d2b1cffdccb39859fca84909032acef7da5bd0093
TrickBot
970fe530e3eaa88b4ae4e9cfff4d911874ab45c7e8026522d89a8f97632a5726
TrickBot
d1df22bbe41e65a75aaf201fc4ed1d5ca0eaa78f193a99eb2043706e26abfc48
TrickBot
daaa30e482038f20a6a9a2f0b5dee9e5f5e06284e7acea2413aa255d0e66d5d1
TrickBot
dea612148b5f17340638f8d3939c519013c5e28eb1aaacc2c026a1cbb885314b
TrickBot
f7c5108265f1b5b0140dddcbf9f2548214a43bdaa2cdaa251e72f1c64dbc2bf1
TrickBot
f95adae1cd46200a5b9d61024e3eb887bfacfe2fe63b94f1dc4e6b89edb9cae3
TrickBot
+ 835 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev1 banker trojan
Link:
https://tria.ge/reports/210716-tdmr58rz12/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Unpacked files
SH256 hash:
f7f17be21bfba69a126a6f385f2ecdffb09361dd55fd5681f52c606567ca5418
MD5 hash:
f28c1bedbf0165d349d94dd9a0dbf0c7
SHA1 hash:
905f1d1563f01b0b58673a377c6ece4ae34f2528
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d414e699-4b58-469e-8611-5125e112640b/
Parent samples :
f6ca24c311c1c36be175a7540259837dd6ca8fc56ebf65412da3c623d936c8e1
89d87f486616ff7319976c10f14e995ec939aa698d64bd48bac68f392c4da302
SH256 hash:
ab1c0428e7d5b87ad343b4e7823bd56c02619ed7253281b9d96e16e695aa553a
MD5 hash:
e2064c9a0a2c5de4ec4f59b61f70dca1
SHA1 hash:
59319a9d36836e4a38abd333215fa2dfa0d6bbf1
Link:
https://www.unpac.me/results/d414e699-4b58-469e-8611-5125e112640b/
SH256 hash:
880a47a27e12e51adceaf722a85cb43baab6f4092ed874be6f72931a22ef8444
MD5 hash:
763ef41825e3ed92be445e8d322dcb56
SHA1 hash:
47dac77ab419c73b081d1e35f157ed0c7bea612b
Link:
https://www.unpac.me/results/d414e699-4b58-469e-8611-5125e112640b/
SH256 hash:
18235de7e0a1c094556b623df7a3f417b8ffdaac52882581891c218e64975751
MD5 hash:
5596dd47c8ff1df27117f571ae737a2a
SHA1 hash:
4254b6109f05cebe502cf253ff7b6acacdf6fd32
Link:
https://www.unpac.me/results/d414e699-4b58-469e-8611-5125e112640b/
SH256 hash:
f6ca24c311c1c36be175a7540259837dd6ca8fc56ebf65412da3c623d936c8e1
MD5 hash:
60f7bdbf247e6fc2a46ab0402831ba84
SHA1 hash:
5477c6035ea424b32bdb096328cba4284e7265ce
Link:
https://www.unpac.me/results/d414e699-4b58-469e-8611-5125e112640b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f6ca24c311c1c36be175a7540259837dd6ca8fc56ebf65412da3c623d936c8e1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172232/

Comments