MALICIOUS — 121e1e7a554915bc940b36404050b0888eef129717beac9b4d98d1df5b5e494e
MALICIOUS — 121e1e7a554915bc940b36404050b0888eef129717beac9b4d98d1df5b5e494e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Trickbot family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
121e1e7a554915bc940b36404050b0888eef129717beac9b4d98d1df5b5e494e - SHA-1:
0ad77a25ea96c5f8da586855ffee4c69586ad7f8 - MD5:
06d174000053ea536132e8f06a41e79c - imphash:
484dff7a0ffa92aff35e79957c619fe1 - ssdeep:
384:aIQwN/ZxDnD90Ypw76YLC9rFA7DiJMJY+L57aQK:bjN/3Oj7FC9rFK2WDL1aD - TLSH:
T1B433DACD40780B37C7F224A12632E9DE9D9BB4A559DD324A194D203F40D2CE35EF2A66 - Submitted as: 121e1e7a554915bc940b36404050b0888eef129717beac9b4d98d1df5b5e494e
- File type: pe · Size: 48748 bytes
- Verdict: malicious (100/100) · Family: Trickbot
Detections (6 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): MPRESS
- ClamAV (daily): Win.Downloader.Upatre-5744087-0
- YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
- Detect It Easy (packer/type): DIE:MPRESS
- Microsoft Defender: Trojan:Win32/Trickbot.GML!MTB
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Downloader.Upatre-5744087-0 (rule
Win.Downloader.Upatre-5744087-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Trickbot.GML!MTB (rule
Trojan:Win32/Trickbot.GML!MTB) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule
HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:MPRESS (rule
DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged MPRESS (rule
MPRESS) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule
YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70 - Packing/obfuscation: MPRESS - static signal, weight 0.25, confidence 0.55
- Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
12424 behavior events · 2 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- th.bing.com
- aefd.nelreports.net
- fe3cr.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\smcoc.exe -
adc95eda98b021c42c900651f428af0ec1ce254e71d2d99068d9b31e0a7744fa
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- aefd.nelreports.net
Embedded IP addresses
- 20.184.175.6
- 4.230.171.124
- 20.42.179.204
- 57.154.63.210
- 74.178.240.51
- 4.150.223.102
- 104.18.33.89
- 135.233.95.144
- 20.247.184.142
- 74.179.77.204
- 20.42.179.192
- 52.110.12.52
- 52.110.12.54
- 135.234.160.245
- 72.153.5.136
- 52.148.114.188
- 52.110.12.51
- 52.110.12.37
File paths
- C:\vd76bzvF.exe
- C:\pIlxxMtR.exe
- C:\dau1Bhud.exe
- C:\27ml
- C:\ef467d636696fe1ad5ff6d91daa7f98882ba669cadae9a59f95382b5e7e51d4f
- C:\brKtVW2P.exe
- C:\rMPAEcsw.exe
- C:\6VcNo27b.exe
- C:\14148b9d39d4e025f1c80828f357261042cf959be0adf6e5b87305af2c602d7b
- C:\pLparmHr.exe
- C:\Users\Administrator\AppData\Local\Temp\cuckoo-35b49a5c3188a8fdf1850da80a19f279707cc6d06dee6c44f7ef119639f1027e.exe
- C:\f4c7fc85d10a314920211d3717e7b17bbd58aecddc8cc5807d3403b8b127fd6c
- C:\abb790ae7bd676b5f3459e591de25094ee68c232a1a3002d533f821bc9fee931
- C:\QD0jFpmo.exe
- C:\93bdbb3e5b4141348c3bea2560c88b7e3b2396ad500d5001a584a96f30cf5cb5
- C:\61d5c9e070d3f2941ea994c5a8fb307df5d37091440d4a0a9093d3a87a3f64cb
- C:\c349f49b5bd9d85b73c9d1c5c9b1d1a1238acc235eb91ffee204ee6133dfa5e9
- C:\876e513174fa5e4760de03efdfb6d77ac300b1e4cca644fe3795562678fe49ec
- C:\d43e9a34370126289af7ae7796f2b49cc3c7aa5fec021231fab7d73a16dbfebe
- C:\LDqeznuK.exe
- C:\d6dc354cdef64ecc188fbba7f2400adf27076666858d3f582f08573d560e2707
- C:\b8d554de1ede8c4aadfe9df91ecdacfb752a4a58baf3eaaa453b6072632c6bf9
- C:\tdxi7jl6.exe
- C:\9abd829be45554f06e02f133d029c31ee3e284707964f34204e97cfa579927d2
- C:\ZHbiAXPq.exe
More Trickbot samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report