Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
17/05/2024, 04:37
General
- Target 4e71930a812a2b5650e7e08eb2b10b34_JaffaCakes118.exe
- Size 320KB
- Sample240517-e8645ahf4t
- SHA256 883c9caef4dca41384a6bc31657bab87c68d5249d6f191e88e5bda414148cb09
Malware Config
Extracted
-
trickbot
-
1000513
-
ono64
-
51.89.177.20:443
-
194.5.249.174:443
-
107.174.196.242:443
-
185.205.209.241:443
-
82.146.46.220:443
-
5.34.178.126:443
-
212.22.70.65:443
-
195.123.241.90:443
-
185.164.32.214:443
-
198.46.198.139:443
-
195.123.241.187:443
-
86.104.194.116:443
-
195.123.240.252:443
-
185.164.32.215:443
-
45.148.120.195:443
-
45.138.158.32:443
-
5.149.253.99:443
-
92.62.65.163:449
-
88.247.212.56:449
-
180.211.170.214:449
-
autorunName:pwgrab
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e71930a812a2b5650e7e08eb2b10b34_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4e71930a812a2b5650e7e08eb2b10b34_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2668-0-0x0000000002150000-0x0000000002182000-memory.dmp
memory/2668-2-0x0000000002150000-0x0000000002182000-memory.dmp
memory/2668-1-0x0000000002110000-0x0000000002141000-memory.dmp
memory/2668-25-0x00000000020B0000-0x00000000020E2000-memory.dmp
memory/2668-32-0x0000000002150000-0x0000000002182000-memory.dmp
memory/2668-37-0x0000000010000000-0x0000000010003000-memory.dmp
memory/2668-36-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/2668-42-0x0000000010000000-0x0000000010003000-memory.dmp
memory/2668-47-0x0000000002150000-0x0000000002182000-memory.dmp
memory/3124-38-0x00000153E7F90000-0x00000153E7FB3000-memory.dmp
memory/3124-43-0x00000153E7F90000-0x00000153E7FB3000-memory.dmp
memory/3124-44-0x00000153E7F90000-0x00000153E7FB3000-memory.dmp