trickbot | 2131d36e00c05899f504b6eea7f839bec6f981f60aad2a6ed0b9977a303ed25e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 08:44

Target

393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe
Size

365KB
MD5

393e33d9e6468b6fe6c18994f40267cf
SHA1

2aadb19b2303ec259af7545f3007028569c7ae81
SHA256

2131d36e00c05899f504b6eea7f839bec6f981f60aad2a6ed0b9977a303ed25e
SHA512

a5f81995eeb2d38ea9d91d601cccc8bc56eb82717e6f37348d6be0f4490469ddb2d8f0b9bd0f643cfe1aeb6dfeea18e0486e0def5ea529183f1ff4958056ae43
SSDEEP

6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANn:WBOO3VKID90TBEhx4O6an

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

Processes:

resource	yara_rule
behavioral1/memory/1860-3-0x0000000000320000-0x0000000000352000-memory.dmp	dave
behavioral1/memory/1860-8-0x0000000000230000-0x0000000000260000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe

pid process

1860 393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 756 wermgr.exe
Token: SeDebugPrivilege 756 wermgr.exe

pid	process
1860	393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	756	wermgr.exe
Token: SeDebugPrivilege	756	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe

description	pid	process	target process
PID 1860 wrote to memory of 756	1860	393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe	wermgr.exe
PID 1860 wrote to memory of 756	1860	393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe	wermgr.exe
PID 1860 wrote to memory of 756	1860	393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe	wermgr.exe
PID 1860 wrote to memory of 756	1860	393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe	wermgr.exe
PID 1860 wrote to memory of 756	1860	393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe	wermgr.exe
PID 1860 wrote to memory of 756	1860	393e33d9e6468b6fe6c18994f40267cf_JaffaCakes118.exe	wermgr.exe

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

memory/756-186-0x00000000000E0000-0x0000000000104000-memory.dmp

Filesize
144KB

Download
memory/756-188-0x00000000000E0000-0x0000000000104000-memory.dmp

Filesize
144KB

Download
memory/1860-3-0x0000000000320000-0x0000000000352000-memory.dmp

Filesize
200KB

Download
memory/1860-7-0x00000000005F0000-0x000000000061F000-memory.dmp

Filesize
188KB

Download
memory/1860-10-0x00000000005F0000-0x000000000061F000-memory.dmp

Filesize
188KB

Download
memory/1860-9-0x0000000000280000-0x00000000002AE000-memory.dmp

Filesize
184KB

Download
memory/1860-8-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1860-93-0x00000000005F0000-0x000000000061F000-memory.dmp

Filesize
188KB

Download
memory/1860-184-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1860-185-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1860-187-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1860-189-0x00000000005F0000-0x000000000061F000-memory.dmp

Filesize
188KB

Download