trickbot | 947658dd68b4aa2600ad5154ba18d5cccbaa09966880fe324cda0dd27cbadcbb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 21:37

Target

64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe
Size

364KB
MD5

64d9722bc67a397bd97e9b297fed61e9
SHA1

305e35d4701f5ba233420171c0b4bd62d3a9a541
SHA256

947658dd68b4aa2600ad5154ba18d5cccbaa09966880fe324cda0dd27cbadcbb
SHA512

ad0099ae3fbcd18798ffcd088efffcdbac7d4a6eb390328b5dfe65c782b7e43ee446210233dbb3da13c5fd8f06db0b3626422b5e68d424415e882c98bc956a93
SSDEEP

6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANE:WBOO3VKID90TBEhx4O6aE

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

resource	yara_rule
behavioral2/memory/112-3-0x0000000000710000-0x0000000000742000-memory.dmp	dave
behavioral2/memory/112-8-0x00000000006E0000-0x0000000000710000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
112	64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe
112	64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	wermgr.exe
Token: SeDebugPrivilege	4532	wermgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 4532	112	64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe	97
PID 112 wrote to memory of 4532	112	64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe	97
PID 112 wrote to memory of 4532	112	64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe	97
PID 112 wrote to memory of 4532	112	64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64d9722bc67a397bd97e9b297fed61e9_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4532

memory/112-3-0x0000000000710000-0x0000000000742000-memory.dmp

Filesize
200KB

Download
memory/112-7-0x0000000000B10000-0x0000000000B3F000-memory.dmp

Filesize
188KB

Download
memory/112-10-0x0000000000B10000-0x0000000000B3F000-memory.dmp

Filesize
188KB

Download
memory/112-9-0x0000000000AE0000-0x0000000000B0E000-memory.dmp

Filesize
184KB

Download
memory/112-8-0x00000000006E0000-0x0000000000710000-memory.dmp

Filesize
192KB

Download
memory/112-91-0x0000000000B10000-0x0000000000B3F000-memory.dmp

Filesize
188KB

Download
memory/112-183-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/112-182-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/112-185-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/112-187-0x0000000000B10000-0x0000000000B3F000-memory.dmp

Filesize
188KB

Download
memory/4532-184-0x000001A65F790000-0x000001A65F7B4000-memory.dmp

Filesize
144KB

Download
memory/4532-186-0x000001A65F790000-0x000001A65F7B4000-memory.dmp

Filesize
144KB

Download