trickbot | f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe
Size 361KB
Sample240526-h7e6ssca84
SHA256 f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107
MD5 74ba5e610af8da17018aeb37ed6fa834
SHA1 d3ca5eef27592370fa380729c83cbf7d49092244
SHA512 a66003a07e50f55a2d9d5eb0c5fdcc84e39362c3d1a97f8e7945b9b7995b0f109ffa1de75e242eec36bcd32824b9215040491b78374ac959e91fc6bde7d55d7e
SSDEEP 6144:6611x/ddyenQQU6wdLyTMnYtesyPLWJuUGq5BOf7aWpmJCp:6axvtn3LwdWCY3yO5jOzaWpmJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickbot ser0924 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000265

Botnet

ser0924

118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
203.176.132.102:449
103.110.91.118:449
128.201.92.41:449
103.111.53.126:449
182.253.20.66:449
103.10.145.197:449
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
109.95.113.227:443
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
109.199.231.116:443
62.141.94.107:443
81.0.118.50:443
197.232.50.85:443
190.145.74.84:449
73.204.250.88:449
116.212.152.12:449
107.181.174.176:443
23.94.41.215:443
107.173.102.231:443
192.252.209.44:443
107.175.127.147:443
23.226.138.169:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/2724-1-0x0000000000830000-0x000000000086D000-memory.dmp	trickbot_loader32
behavioral2/memory/996-8-0x0000000000720000-0x000000000075D000-memory.dmp	trickbot_loader32
behavioral2/memory/2724-23-0x0000000000400000-0x0000000000460000-memory.dmp	trickbot_loader32
behavioral2/memory/2724-24-0x0000000000830000-0x000000000086D000-memory.dmp	trickbot_loader32
behavioral2/memory/996-25-0x0000000000400000-0x0000000000460000-memory.dmp	trickbot_loader32
behavioral2/memory/996-28-0x0000000000720000-0x000000000075D000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

pid	Process
996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMT\\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	checkip.amazonaws.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 996	2724	74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe	82
PID 2724 wrote to memory of 996	2724	74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe	82
PID 2724 wrote to memory of 996	2724	74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe	82
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83
PID 996 wrote to memory of 3320	996	84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74ba5e610af8da17018aeb37ed6fa834_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe

Path C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934_KaffaDaket119.exe
Size 361KB
SHA256 f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107
MD5 74ba5e610af8da17018aeb37ed6fa834
SHA1 d3ca5eef27592370fa380729c83cbf7d49092244
SHA512 a66003a07e50f55a2d9d5eb0c5fdcc84e39362c3d1a97f8e7945b9b7995b0f109ffa1de75e242eec36bcd32824b9215040491b78374ac959e91fc6bde7d55d7e
SSDEEP 6144:6611x/ddyenQQU6wdLyTMnYtesyPLWJuUGq5BOf7aWpmJCp:6axvtn3LwdWCY3yO5jOzaWpmJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f5007522459c86e95ffcc62f32308f1_39fbc0df-d496-4ae0-b1d7-bde60e245d90

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3558294865-3673844354-2255444939-1000\0f5007522459c86e95ffcc62f32308f1_39fbc0df-d496-4ae0-b1d7-bde60e245d90
Size 1KB
SHA256 d4866d3b217aa988fc4b13a725deb4cfaa7c8f3b8260596c805fb96a0335a0e6
MD5 09a712f905477dd58b60f2e9e48bdc94
SHA1 0f31dc546090a7f32450b4def9ae0ea08744e907
SHA512 a67f59e1cd43b2506a46b339c1f36cba4b9d1421e3325107f37f3e38cbfda2660b9558f40453336bc0fc1eda2a1255003345ed37bcc7648faf191cc31eb0a5c7
MD5 SHA1 SHA512

Submit Download

memory/996-25-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/996-8-0x0000000000720000-0x000000000075D000-memory.dmp

Download

memory/996-10-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/996-9-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/996-27-0x0000000002A50000-0x0000000002D19000-memory.dmp

Download

memory/996-28-0x0000000000720000-0x000000000075D000-memory.dmp

Download

memory/996-26-0x0000000002580000-0x000000000263E000-memory.dmp

Download

memory/996-15-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2724-1-0x0000000000830000-0x000000000086D000-memory.dmp

Download

memory/2724-24-0x0000000000830000-0x000000000086D000-memory.dmp

Download

memory/2724-23-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3320-16-0x0000022DF9820000-0x0000022DF9821000-memory.dmp

Download

memory/3320-17-0x0000000140000000-0x0000000140035000-memory.dmp

Download

memory/3320-14-0x0000000140000000-0x0000000140035000-memory.dmp

Download

memory/3320-35-0x0000000140000000-0x0000000140035000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads