trickbot | efa8f41e69124aa247d366c53838d9c24cb734cc04c9646fc5b9c0d9706fc261

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 02:06

Target

4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe
Size

364KB
MD5

4dfe63b67ac7f1fa42b36a64ce58167f
SHA1

28a17cea34f2b2bb497010c01dd1424d2d53606d
SHA256

efa8f41e69124aa247d366c53838d9c24cb734cc04c9646fc5b9c0d9706fc261
SHA512

4b6bbc1d182c21219de7797f187f19048b807dfe5d10bd8e99b973ee7dc30987e9e36f477b67429c29d50fad99d74601930573876d61a910bc59c50052bf6214
SSDEEP

6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANe:WBOO3VKID90TBEhx4O6ae

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

Processes:

resource	yara_rule
behavioral2/memory/2996-3-0x0000000000910000-0x0000000000942000-memory.dmp	dave
behavioral2/memory/2996-8-0x00000000005A0000-0x00000000005D0000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe

pid process

2996 4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe
2996 4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 4356 wermgr.exe

pid	process
2996	4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe
2996	4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4356	wermgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe

description	pid	process	target process
PID 2996 wrote to memory of 4356	2996	4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe	wermgr.exe
PID 2996 wrote to memory of 4356	2996	4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe	wermgr.exe
PID 2996 wrote to memory of 4356	2996	4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe	wermgr.exe
PID 2996 wrote to memory of 4356	2996	4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4dfe63b67ac7f1fa42b36a64ce58167f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1308,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
1⤵
PID:3216

memory/2996-3-0x0000000000910000-0x0000000000942000-memory.dmp

Filesize
200KB

Download
memory/2996-7-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/2996-10-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/2996-9-0x0000000000950000-0x000000000097E000-memory.dmp

Filesize
184KB

Download
memory/2996-8-0x00000000005A0000-0x00000000005D0000-memory.dmp

Filesize
192KB

Download
memory/2996-101-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/2996-137-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2996-136-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/2996-139-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2996-141-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/4356-138-0x000001F3C7C60000-0x000001F3C7C84000-memory.dmp

Filesize
144KB

Download
memory/4356-140-0x000001F3C7C60000-0x000001F3C7C84000-memory.dmp

Filesize
144KB

Download