trickbot | 5372e8b0e4f6faefe0da17b4e81fb0eb1554c0b5e2d3ce5500d70d1e6511f436

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe
Size

412KB
MD5

213f7ad750d19a54261036b1af0d4d47
SHA1

d476f107e55c90c063b7a49ca63292cd0402f5d7
SHA256

5372e8b0e4f6faefe0da17b4e81fb0eb1554c0b5e2d3ce5500d70d1e6511f436
SHA512

d65b01b82b294a07f3eed069ad7836c401493819670f60b29c02b5e5dbe18ceffa2f57176e8e6989505ea3213deb493a794b7692bb802e172ce7a990099075a0
SSDEEP

6144:vhltaynk6tHuwvi2MQYP+kS764me2Z3yrD6VFhvpLb:vUKk6tHuQiRJPjwmeY+6FJb

Score

10^/10

trickbot tot271 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000231

Botnet

tot271

138.34.32.218:443

178.78.202.189:443

85.9.212.117:443

93.109.242.134:443

103.210.30.201:443

158.58.131.54:443

87.117.146.63:443

118.200.151.113:443

89.117.107.13:443

109.86.227.152:443

200.2.126.98:443

31.29.62.112:443

83.167.164.81:443

194.68.23.182:443

182.253.210.130:449

77.89.86.93:443

70.79.178.120:449

68.109.83.22:443

185.129.193.221:443

184.68.167.42:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/5012-2-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral2/memory/5012-3-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral2/memory/5012-5-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral2/memory/5012-11-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral2/memory/3968-20-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral2/memory/3968-29-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe
3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\msglob\213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\msglob\\213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ident.me
33	ident.me

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 1084 set thread context of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe
1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 5072 wrote to memory of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 5072 wrote to memory of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 5072 wrote to memory of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 5072 wrote to memory of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 5072 wrote to memory of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 5072 wrote to memory of 5012	5072	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	93
PID 5012 wrote to memory of 1084	5012	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	94
PID 5012 wrote to memory of 1084	5012	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	94
PID 5012 wrote to memory of 1084	5012	213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe	94
PID 1084 wrote to memory of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98
PID 1084 wrote to memory of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98
PID 1084 wrote to memory of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98
PID 1084 wrote to memory of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98
PID 1084 wrote to memory of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98
PID 1084 wrote to memory of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98
PID 1084 wrote to memory of 3968	1084	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	98
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99
PID 3968 wrote to memory of 4800	3968	213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\213f7ad750d19a54261036b1af0d4d47_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Roaming\msglob\213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe
    C:\Users\Admin\AppData\Roaming\msglob\213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Users\Admin\AppData\Roaming\msglob\213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe
      C:\Users\Admin\AppData\Roaming\msglob\213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Adds Run key to start application
        
        PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\msglob\213f8ad860d19a64271037b1af0d4d48_KaffaDaket119.exe

Filesize
412KB

MD5
213f7ad750d19a54261036b1af0d4d47

SHA1
d476f107e55c90c063b7a49ca63292cd0402f5d7

SHA256
5372e8b0e4f6faefe0da17b4e81fb0eb1554c0b5e2d3ce5500d70d1e6511f436

SHA512
d65b01b82b294a07f3eed069ad7836c401493819670f60b29c02b5e5dbe18ceffa2f57176e8e6989505ea3213deb493a794b7692bb802e172ce7a990099075a0

Download Submit
memory/3968-20-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3968-15-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3968-29-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3968-31-0x0000000002440000-0x00000000024FE000-memory.dmp

Filesize
760KB

Download
memory/3968-32-0x0000000002500000-0x00000000027C9000-memory.dmp

Filesize
2.8MB

Download
memory/4800-21-0x0000000140000000-0x0000000140036000-memory.dmp

Filesize
216KB

Download
memory/4800-22-0x0000025964690000-0x0000025964691000-memory.dmp

Filesize
4KB

Download
memory/4800-23-0x0000000140000000-0x0000000140036000-memory.dmp

Filesize
216KB

Download
memory/4800-39-0x0000000140000000-0x0000000140036000-memory.dmp

Filesize
216KB

Download
memory/5012-5-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5012-3-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5012-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5012-2-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads