trickbot | f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107

General

Target

74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe
Size

361KB
MD5

74ba5e610af8da17018aeb37ed6fa834
SHA1

d3ca5eef27592370fa380729c83cbf7d49092244
SHA256

f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107
SHA512

a66003a07e50f55a2d9d5eb0c5fdcc84e39362c3d1a97f8e7945b9b7995b0f109ffa1de75e242eec36bcd32824b9215040491b78374ac959e91fc6bde7d55d7e
SSDEEP

6144:6611x/ddyenQQU6wdLyTMnYtesyPLWJuUGq5BOf7aWpmJCp:6axvtn3LwdWCY3yO5jOzaWpmJ

Score

10^/10

trickbot ser0924 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000265

Botnet

ser0924

C2

118.97.119.218:449

94.181.47.198:449

144.121.143.129:449

185.200.60.138:449

185.42.52.126:449

181.174.112.74:449

178.116.83.49:443

121.58.242.206:449

182.50.64.148:449

82.222.40.119:449

203.176.132.102:449

103.110.91.118:449

128.201.92.41:449

103.111.53.126:449

182.253.20.66:449

103.10.145.197:449

81.17.86.112:443

95.154.80.154:449

46.149.182.112:449

109.95.113.227:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/2724-1-0x0000000000830000-0x000000000086D000-memory.dmp	trickbot_loader32
behavioral2/memory/996-8-0x0000000000720000-0x000000000075D000-memory.dmp	trickbot_loader32
behavioral2/memory/2724-23-0x0000000000400000-0x0000000000460000-memory.dmp	trickbot_loader32
behavioral2/memory/2724-24-0x0000000000830000-0x000000000086D000-memory.dmp	trickbot_loader32
behavioral2/memory/996-25-0x0000000000400000-0x0000000000460000-memory.dmp	trickbot_loader32
behavioral2/memory/996-28-0x0000000000720000-0x000000000075D000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe

pid process

996 84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe

pid	process
996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMT\\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

31 checkip.amazonaws.com

flow	ioc
31	checkip.amazonaws.com

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe

description	pid	process	target process
PID 2724 wrote to memory of 996	2724	74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
PID 2724 wrote to memory of 996	2724	74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
PID 2724 wrote to memory of 996	2724	74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe

Filesize
361KB

MD5
74ba5e610af8da17018aeb37ed6fa834

SHA1
d3ca5eef27592370fa380729c83cbf7d49092244

SHA256
f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107

SHA512
a66003a07e50f55a2d9d5eb0c5fdcc84e39362c3d1a97f8e7945b9b7995b0f109ffa1de75e242eec36bcd32824b9215040491b78374ac959e91fc6bde7d55d7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3558294865-3673844354-2255444939-1000\0f5007522459c86e95ffcc62f32308f1_39fbc0df-d496-4ae0-b1d7-bde60e245d90

Filesize
1KB

MD5
09a712f905477dd58b60f2e9e48bdc94

SHA1
0f31dc546090a7f32450b4def9ae0ea08744e907

SHA256
d4866d3b217aa988fc4b13a725deb4cfaa7c8f3b8260596c805fb96a0335a0e6

SHA512
a67f59e1cd43b2506a46b339c1f36cba4b9d1421e3325107f37f3e38cbfda2660b9558f40453336bc0fc1eda2a1255003345ed37bcc7648faf191cc31eb0a5c7

Download Submit
memory/996-25-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/996-8-0x0000000000720000-0x000000000075D000-memory.dmp

Filesize
244KB

Download
memory/996-10-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/996-9-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/996-27-0x0000000002A50000-0x0000000002D19000-memory.dmp

Filesize
2.8MB

Download
memory/996-28-0x0000000000720000-0x000000000075D000-memory.dmp

Filesize
244KB

Download
memory/996-26-0x0000000002580000-0x000000000263E000-memory.dmp

Filesize
760KB

Download
memory/996-15-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2724-1-0x0000000000830000-0x000000000086D000-memory.dmp

Filesize
244KB

Download
memory/2724-24-0x0000000000830000-0x000000000086D000-memory.dmp

Filesize
244KB

Download
memory/2724-23-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3320-16-0x0000022DF9820000-0x0000022DF9821000-memory.dmp

Filesize
4KB

Download
memory/3320-17-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3320-14-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3320-35-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads