trickbot | f2e3ffc81a10e1c4fa279fc19778546514b51a8c33a4864f93b2da1f69110594

General

Target

79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
Size

680KB
MD5

79f76635bda045f2ca1330d5362394cd
SHA1

8f4bf8a6912adb10030afb6bda947af4e998b9dc
SHA256

f2e3ffc81a10e1c4fa279fc19778546514b51a8c33a4864f93b2da1f69110594
SHA512

1e0cfbfb656f4cadd42ea2bd08aec56e04a6b4cec01a387ea3d074b2358cf0b202385804f8bb4861e37e7e32ae4d8a9e0039ed9a53a2c4d9f39e505e371c1803
SSDEEP

12288:n5ba2SroKa5pwYM30A25cyDbXHELnUimJX+kdagdThKk/A6Mq:lSfaM30A25Amn/VUjq

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

pid process

2628 79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
Loads dropped DLL 2 IoCs

Processes:

79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

pid process

2240 79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
2240 79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2696 svchost.exe
Token: SeDebugPrivilege 2696 svchost.exe

pid	process
2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2696	svchost.exe
Token: SeDebugPrivilege	2696	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

pid	process
2240	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
2240	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

description	pid	process	target process
PID 2240 wrote to memory of 2628	2240	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
PID 2240 wrote to memory of 2628	2240	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
PID 2240 wrote to memory of 2628	2240	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
PID 2240 wrote to memory of 2628	2240	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
PID 2628 wrote to memory of 2696	2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	svchost.exe
PID 2628 wrote to memory of 2696	2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	svchost.exe
PID 2628 wrote to memory of 2696	2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	svchost.exe
PID 2628 wrote to memory of 2696	2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	svchost.exe
PID 2628 wrote to memory of 2696	2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	svchost.exe
PID 2628 wrote to memory of 2696	2628	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\monolib\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Roaming\monolib\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\monolib\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

Filesize
680KB

MD5
79f76635bda045f2ca1330d5362394cd

SHA1
8f4bf8a6912adb10030afb6bda947af4e998b9dc

SHA256
f2e3ffc81a10e1c4fa279fc19778546514b51a8c33a4864f93b2da1f69110594

SHA512
1e0cfbfb656f4cadd42ea2bd08aec56e04a6b4cec01a387ea3d074b2358cf0b202385804f8bb4861e37e7e32ae4d8a9e0039ed9a53a2c4d9f39e505e371c1803

Download Submit
memory/2240-13-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-8-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-17-0x0000000000270000-0x00000000002A1000-memory.dmp

Filesize
196KB

Download
memory/2240-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-7-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-12-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-10-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-16-0x0000000000456000-0x0000000000457000-memory.dmp

Filesize
4KB

Download
memory/2240-15-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-5-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2240-19-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2240-9-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2628-42-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-39-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-41-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-40-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-43-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-38-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-37-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-33-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-34-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-35-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-36-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-32-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2628-44-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2628-47-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2696-48-0x0000000000060000-0x0000000000084000-memory.dmp

Filesize
144KB

Download
memory/2696-49-0x0000000000060000-0x0000000000084000-memory.dmp

Filesize
144KB

Download
memory/2696-50-0x0000000000060000-0x0000000000084000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing