trickbot | 56578ebedb5e302148f239e262ee74edb358d197153ba32963dbe8477e99c525

Analysis

max time kernel
137s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 00:03

Target

522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe
Size

364KB
MD5

522925cad674a92a0a3cbc3e853f563a
SHA1

ecc567bc858390e396ce59db76af6a42610656a8
SHA256

56578ebedb5e302148f239e262ee74edb358d197153ba32963dbe8477e99c525
SHA512

3378b3738af0f4da3002f175aef954d87fcc18fb4b12063f308075fc2164106d19ebba961d37fbcd10bdd782b1d0e0bea45524f3de7862b2fe77c1f741706c93
SSDEEP

6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANU:WBOO3VKID90TBEhx4O6aU

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

Processes:

resource	yara_rule
behavioral2/memory/3640-9-0x0000000000500000-0x0000000000530000-memory.dmp	dave
behavioral2/memory/3640-3-0x0000000000910000-0x0000000000942000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe

pid process

3640 522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe
3640 522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 644 wermgr.exe
Token: SeDebugPrivilege 644 wermgr.exe

pid	process
3640	522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe
3640	522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	644	wermgr.exe
Token: SeDebugPrivilege	644	wermgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe

description	pid	process	target process
PID 3640 wrote to memory of 644	3640	522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe	wermgr.exe
PID 3640 wrote to memory of 644	3640	522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe	wermgr.exe
PID 3640 wrote to memory of 644	3640	522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe	wermgr.exe
PID 3640 wrote to memory of 644	3640	522925cad674a92a0a3cbc3e853f563a_JaffaCakes118.exe	wermgr.exe

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:644

memory/644-202-0x000002994E3E0000-0x000002994E404000-memory.dmp

Filesize
144KB

Download
memory/644-204-0x000002994E3E0000-0x000002994E404000-memory.dmp

Filesize
144KB

Download
memory/3640-7-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/3640-10-0x0000000000950000-0x000000000097E000-memory.dmp

Filesize
184KB

Download
memory/3640-9-0x0000000000500000-0x0000000000530000-memory.dmp

Filesize
192KB

Download
memory/3640-3-0x0000000000910000-0x0000000000942000-memory.dmp

Filesize
200KB

Download
memory/3640-11-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download
memory/3640-201-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/3640-200-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/3640-203-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/3640-205-0x0000000000980000-0x00000000009AF000-memory.dmp

Filesize
188KB

Download