Analysis
- max time kernel
132s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
19/04/2024, 09:19
General
- Target f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe
- Size 568KB
- Sample240419-lajphadf25
- SHA256 9c31f43a0c48a56de0e30cbdf89f8d03dd6cf73b2c2ec392bf285830454ae444
Malware Config
Extracted
-
trickbot
-
2000032
-
tot130
-
103.122.228.44:443
-
196.216.220.211:443
-
181.114.215.239:443
-
41.57.156.203:443
-
43.252.159.63:443
-
197.156.129.250:443
-
113.160.37.196:443
-
38.110.100.64:443
-
113.160.132.237:443
-
24.28.12.23:443
-
38.110.100.219:443
-
45.239.233.109:443
-
119.202.8.249:443
-
200.236.218.62:443
-
220.82.64.198:443
-
190.93.208.53:443
-
196.216.59.174:443
-
222.124.16.74:443
-
202.165.47.106:443
-
96.9.77.56:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 8482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4412 -ip 44121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1580-9-0x00000242930C0000-0x00000242930C1000-memory.dmp
memory/1580-10-0x0000024292F20000-0x0000024292F49000-memory.dmp
memory/1580-14-0x0000024292F20000-0x0000024292F49000-memory.dmp
memory/4412-1-0x0000000002360000-0x000000000239C000-memory.dmp
memory/4412-0-0x00000000024C0000-0x00000000024FE000-memory.dmp
memory/4412-5-0x0000000002500000-0x000000000253A000-memory.dmp
memory/4412-6-0x0000000002500000-0x000000000253A000-memory.dmp
memory/4412-7-0x0000000002540000-0x0000000002541000-memory.dmp
memory/4412-8-0x0000000010000000-0x0000000010003000-memory.dmp
memory/4412-12-0x0000000002500000-0x000000000253A000-memory.dmp
memory/4412-11-0x0000000002340000-0x0000000002353000-memory.dmp