trickbot | 4624c37234303e6ac930b65635ee898482a178ce5923b8aeec90bb94dd30efe4

General

Target

6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe
Size

350KB
MD5

6903fcf0eb78bf63a98edb89b87d9c4b
SHA1

e3d85a2b05c04b7d7c0f046f1a513848f7054ef7
SHA256

4624c37234303e6ac930b65635ee898482a178ce5923b8aeec90bb94dd30efe4
SHA512

b5e748c9c9f5e0092de71cbdad9687ea7ca4cf5756902afa6839ba7392e957d32fa678013bef1d96801a2b59556158b4aa7fb600f26fbd73d6f14e81dfb6f409
SSDEEP

6144:+mZNUq21p5TPNQELDYd1aW8n0kpJfY28rmUA6lSQUzt5LXp/keqj:+uEzN7M/N8LpJfY28iT5

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/1004-12-0x0000000002840000-0x0000000002870000-memory.dmp	trickbot_loader32
behavioral2/memory/1004-11-0x0000000000600000-0x000000000062E000-memory.dmp	trickbot_loader32
behavioral2/memory/1004-9-0x0000000002840000-0x0000000002870000-memory.dmp	trickbot_loader32
behavioral2/memory/1004-14-0x0000000002840000-0x0000000002870000-memory.dmp	trickbot_loader32
behavioral2/memory/372-24-0x0000000000A20000-0x0000000000A50000-memory.dmp	trickbot_loader32
behavioral2/memory/372-26-0x0000000000A20000-0x0000000000A50000-memory.dmp	trickbot_loader32

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

ÑÑ‡Ð².exeÑÑ‡Ð².exe

pid process

1004 ÑÑ‡Ð².exe
372 ÑÑ‡Ð².exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeTcbPrivilege 4364 svchost.exe

pid	process
1004	ÑÑ‡Ð².exe
372	ÑÑ‡Ð².exe

description	pid	process
Token: SeTcbPrivilege	4364	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exeÑÑ‡Ð².exeÑÑ‡Ð².exe

description	pid	process	target process
PID 4264 wrote to memory of 1004	4264	6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe	ÑÑ‡Ð².exe
PID 4264 wrote to memory of 1004	4264	6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe	ÑÑ‡Ð².exe
PID 4264 wrote to memory of 1004	4264	6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe	ÑÑ‡Ð².exe
PID 1004 wrote to memory of 5076	1004	ÑÑ‡Ð².exe	svchost.exe
PID 1004 wrote to memory of 5076	1004	ÑÑ‡Ð².exe	svchost.exe
PID 1004 wrote to memory of 5076	1004	ÑÑ‡Ð².exe	svchost.exe
PID 1004 wrote to memory of 5076	1004	ÑÑ‡Ð².exe	svchost.exe
PID 372 wrote to memory of 4364	372	ÑÑ‡Ð².exe	svchost.exe
PID 372 wrote to memory of 4364	372	ÑÑ‡Ð².exe	svchost.exe
PID 372 wrote to memory of 4364	372	ÑÑ‡Ð².exe	svchost.exe
PID 372 wrote to memory of 4364	372	ÑÑ‡Ð².exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6903fcf0eb78bf63a98edb89b87d9c4b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4264

C:\ProgramData\ÑÑ‡Ð².exe
"C:\ProgramData\ÑÑ‡Ð².exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:5076

C:\Users\Admin\AppData\Roaming\cmdcache\ÑÑ‡Ð².exe
C:\Users\Admin\AppData\Roaming\cmdcache\ÑÑ‡Ð².exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ÑÑ‡Ð².exe
Filesize
350KB

MD5
6903fcf0eb78bf63a98edb89b87d9c4b

SHA1
e3d85a2b05c04b7d7c0f046f1a513848f7054ef7

SHA256
4624c37234303e6ac930b65635ee898482a178ce5923b8aeec90bb94dd30efe4

SHA512
b5e748c9c9f5e0092de71cbdad9687ea7ca4cf5756902afa6839ba7392e957d32fa678013bef1d96801a2b59556158b4aa7fb600f26fbd73d6f14e81dfb6f409

Download Submit
memory/372-26-0x0000000000A20000-0x0000000000A50000-memory.dmp

Filesize
192KB

Download
memory/372-25-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/372-24-0x0000000000A20000-0x0000000000A50000-memory.dmp

Filesize
192KB

Download
memory/1004-14-0x0000000002840000-0x0000000002870000-memory.dmp

Filesize
192KB

Download
memory/1004-15-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/1004-9-0x0000000002840000-0x0000000002870000-memory.dmp

Filesize
192KB

Download
memory/1004-13-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1004-11-0x0000000000600000-0x000000000062E000-memory.dmp

Filesize
184KB

Download
memory/1004-12-0x0000000002840000-0x0000000002870000-memory.dmp

Filesize
192KB

Download
memory/4264-8-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4364-27-0x000001792FBE0000-0x000001792FC00000-memory.dmp

Filesize
128KB

Download
memory/4364-29-0x000001792FBE0000-0x000001792FC00000-memory.dmp

Filesize
128KB

Download
memory/5076-16-0x00000205D51E0000-0x00000205D5200000-memory.dmp

Filesize
128KB

Download
memory/5076-18-0x00000205D51E0000-0x00000205D5200000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads