trickbot | d2e53feccc78e0df66c8b57053df59b71dafe3036e88ccc92f988030b4f02123

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe
Size

532KB
MD5

4573102ec94b4ef1e2222ccd99b0e6b5
SHA1

66595dda59ea64ded4b331f5e4d4eeda97379dd8
SHA256

d2e53feccc78e0df66c8b57053df59b71dafe3036e88ccc92f988030b4f02123
SHA512

ac4386a7a3a4c3dc2230211d4f42701fe27890b69ae75dcad06dae90961bca710ca69ba94f37250b30697c67e23c6dad215c80c84c655034da1efa16636b536b
SSDEEP

12288:8DnLuTVu/Ijm8qhFYNupxWLQfG7icDnLuTK:41/Ii8+zpwLQfpYj

Score

10^/10

trickbot jim360 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000307

Botnet

jim360

188.68.208.240:443

24.247.181.155:449

174.105.235.178:449

188.68.211.126:443

74.132.133.246:449

174.105.233.82:449

71.14.129.8:449

162.208.8.200:443

74.132.135.120:449

198.46.160.217:443

71.94.101.25:443

206.130.141.255:449

192.3.52.107:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

108.160.196.130:449

23.94.187.116:443

103.110.91.118:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/4556-19-0x0000000002AE0000-0x0000000002B20000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

pid process

2364 4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

pid	process
2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\vrssit\4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\vrssit\\4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe"	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

pid process

4556 4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe
2364 4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

pid	process
4556	4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe
2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

description	pid	process	target process
PID 4556 wrote to memory of 2364	4556	4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe
PID 4556 wrote to memory of 2364	4556	4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe
PID 4556 wrote to memory of 2364	4556	4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe
PID 2364 wrote to memory of 1980	2364	4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4573102ec94b4ef1e2222ccd99b0e6b5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Roaming\vrssit\4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\vrssit\4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3668,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vrssit\4683102ec94b4ef1e2222ccd99b0e7b6_KaffaDaket119.exe

Filesize
532KB

MD5
4573102ec94b4ef1e2222ccd99b0e6b5

SHA1
66595dda59ea64ded4b331f5e4d4eeda97379dd8

SHA256
d2e53feccc78e0df66c8b57053df59b71dafe3036e88ccc92f988030b4f02123

SHA512
ac4386a7a3a4c3dc2230211d4f42701fe27890b69ae75dcad06dae90961bca710ca69ba94f37250b30697c67e23c6dad215c80c84c655034da1efa16636b536b

Download Submit
memory/1980-69-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/1980-56-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/1980-55-0x0000017D7FCE0000-0x0000017D7FCE1000-memory.dmp

Filesize
4KB

Download
memory/1980-54-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/2364-39-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-43-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-63-0x0000000004510000-0x00000000047D9000-memory.dmp

Filesize
2.8MB

Download
memory/2364-62-0x0000000004450000-0x000000000450E000-memory.dmp

Filesize
760KB

Download
memory/2364-49-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2364-48-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2364-34-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-38-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-32-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-35-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-36-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-37-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-41-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-42-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-33-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-40-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-45-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2364-44-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4556-5-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-7-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-21-0x0000000000423000-0x0000000000424000-memory.dmp

Filesize
4KB

Download
memory/4556-23-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4556-19-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Filesize
256KB

Download
memory/4556-12-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-4-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-18-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-6-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-13-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-8-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-9-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-14-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-15-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-16-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-10-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-11-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/4556-17-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download