Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 05:28
Static task
static1
Behavioral task
behavioral1
Sample
0da06485fe542333d67855067eed6339_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0da06485fe542333d67855067eed6339_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0da06485fe542333d67855067eed6339_JaffaCakes118.exe
-
Size
443KB
-
MD5
0da06485fe542333d67855067eed6339
-
SHA1
216a30b8cafce120917000ead51015ba56100b8c
-
SHA256
3f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
-
SHA512
ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
SSDEEP
12288:692J8GaNnYDKsC+v1yaVSjclCV3Li09zDT:EGSnYDKgv1yZn3
Malware Config
Extracted
trickbot
1000262
sun6
118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
168.167.87.79:443
103.111.53.126:449
182.253.20.66:449
192.188.120.164:443
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
69.9.232.167:443
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
103.111.55.218:449
62.141.94.107:443
96.43.40.221:443
197.232.50.85:443
223.25.64.119:443
185.222.202.127:443
116.212.152.12:449
107.181.174.176:443
23.94.41.215:443
107.173.102.231:443
192.252.209.44:443
107.175.127.147:443
23.226.138.169:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4436-1-0x0000000000710000-0x000000000074D000-memory.dmp trickbot_loader32 behavioral2/memory/3572-8-0x0000000000A30000-0x0000000000A6D000-memory.dmp trickbot_loader32 behavioral2/memory/4436-23-0x0000000000400000-0x0000000000475000-memory.dmp trickbot_loader32 behavioral2/memory/4436-24-0x0000000000710000-0x000000000074D000-memory.dmp trickbot_loader32 behavioral2/memory/3572-25-0x0000000000400000-0x0000000000475000-memory.dmp trickbot_loader32 behavioral2/memory/3572-28-0x0000000000A30000-0x0000000000A6D000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
0da07496fe642333d78966078eed7339_KaffaDaket119.exepid process 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\mssert\0da07496fe642333d78966078eed7339_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\mssert\\0da07496fe642333d78966078eed7339_KaffaDaket119.exe" svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 ipecho.net -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0da06485fe542333d67855067eed6339_JaffaCakes118.exe0da07496fe642333d78966078eed7339_KaffaDaket119.exedescription pid process target process PID 4436 wrote to memory of 3572 4436 0da06485fe542333d67855067eed6339_JaffaCakes118.exe 0da07496fe642333d78966078eed7339_KaffaDaket119.exe PID 4436 wrote to memory of 3572 4436 0da06485fe542333d67855067eed6339_JaffaCakes118.exe 0da07496fe642333d78966078eed7339_KaffaDaket119.exe PID 4436 wrote to memory of 3572 4436 0da06485fe542333d67855067eed6339_JaffaCakes118.exe 0da07496fe642333d78966078eed7339_KaffaDaket119.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe PID 3572 wrote to memory of 1400 3572 0da07496fe642333d78966078eed7339_KaffaDaket119.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0da06485fe542333d67855067eed6339_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0da06485fe542333d67855067eed6339_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mssert\0da07496fe642333d78966078eed7339_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\mssert\0da07496fe642333d78966078eed7339_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-17203666-93769886-2545153620-1000\0f5007522459c86e95ffcc62f32308f1_54631303-6cba-4b22-b333-215df416769aFilesize
1KB
MD5bc9d7ee4795917f7234f91cb2748f785
SHA15b32d2737b6011137751d312a3ecbd6eeee7653b
SHA2561b556fda9507bdca4f301afbb9bd6bd00fe26f1feebe1a10f47d2f0db17cd866
SHA512204f7ba1b5b3ccb5c76d2bf41ee524e7d9ce078a619e36f5e7c4fa4717d2b7708465f457ba2a4718d602beb735252f5014d78a84677be6d1731e1fbef09ab20f
-
C:\Users\Admin\AppData\Roaming\mssert\0da07496fe642333d78966078eed7339_KaffaDaket119.exeFilesize
443KB
MD50da06485fe542333d67855067eed6339
SHA1216a30b8cafce120917000ead51015ba56100b8c
SHA2563f85129c59dfdbdbb46638d05d7b3cbcb259ee6fdcd90bb9cf0c256976e04605
SHA512ba6f2fe9a1078794238799d0cd647d245369b15ef99664b6c20067cdda9b695fcf70fcf27922c28041e5a5c3f3916f9509c8215f1cec5eb2f1e75e6f795b3d12
-
memory/1400-15-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/1400-35-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/1400-17-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/1400-16-0x0000014F553D0000-0x0000014F553D1000-memory.dmpFilesize
4KB
-
memory/3572-11-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/3572-14-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/3572-9-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/3572-25-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/3572-26-0x00000000027C0000-0x000000000287E000-memory.dmpFilesize
760KB
-
memory/3572-28-0x0000000000A30000-0x0000000000A6D000-memory.dmpFilesize
244KB
-
memory/3572-27-0x0000000002880000-0x0000000002B49000-memory.dmpFilesize
2.8MB
-
memory/3572-8-0x0000000000A30000-0x0000000000A6D000-memory.dmpFilesize
244KB
-
memory/4436-1-0x0000000000710000-0x000000000074D000-memory.dmpFilesize
244KB
-
memory/4436-23-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/4436-24-0x0000000000710000-0x000000000074D000-memory.dmpFilesize
244KB