trickbot | 87bcda4bca2a08599c7ddb3bbef5109d655fe15d1f331d8fa8d80e50e74cf8d7

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 00:20

Target

774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe
Size

364KB
MD5

774a9cfb23b430edb5de54a019f6ffe0
SHA1

c890cc20e35d32ac173385b0ba8144770e09ec14
SHA256

87bcda4bca2a08599c7ddb3bbef5109d655fe15d1f331d8fa8d80e50e74cf8d7
SHA512

523cc2197ab7cbe313e1659f775a917a987c4b36fcd14c502149237c77fb002eaa3c9579db26b11620f264c87da44d76912b7fd10839d349a11df1a67d0a8803
SSDEEP

6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANA:WBOO3VKID90TBEhx4O6aA

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

resource	yara_rule
behavioral2/memory/2828-3-0x0000000000A50000-0x0000000000A82000-memory.dmp	dave
behavioral2/memory/2828-8-0x0000000000A20000-0x0000000000A50000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe
2828	774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	wermgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1708	2828	774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe	98
PID 2828 wrote to memory of 1708	2828	774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe	98
PID 2828 wrote to memory of 1708	2828	774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe	98
PID 2828 wrote to memory of 1708	2828	774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\774a9cfb23b430edb5de54a019f6ffe0_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4812

memory/1708-122-0x0000021CEF650000-0x0000021CEF674000-memory.dmp

Filesize
144KB

Download
memory/1708-124-0x0000021CEF650000-0x0000021CEF674000-memory.dmp

Filesize
144KB

Download
memory/2828-3-0x0000000000A50000-0x0000000000A82000-memory.dmp

Filesize
200KB

Download
memory/2828-7-0x0000000000AF0000-0x0000000000B1F000-memory.dmp

Filesize
188KB

Download
memory/2828-10-0x0000000000AF0000-0x0000000000B1F000-memory.dmp

Filesize
188KB

Download
memory/2828-9-0x0000000000AC0000-0x0000000000AEE000-memory.dmp

Filesize
184KB

Download
memory/2828-8-0x0000000000A20000-0x0000000000A50000-memory.dmp

Filesize
192KB

Download
memory/2828-94-0x0000000000AF0000-0x0000000000B1F000-memory.dmp

Filesize
188KB

Download
memory/2828-120-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/2828-121-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2828-123-0x0000000000AF0000-0x0000000000B1F000-memory.dmp

Filesize
188KB

Download