trickbot | f2e3ffc81a10e1c4fa279fc19778546514b51a8c33a4864f93b2da1f69110594

General

Target

79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
Size

680KB
MD5

79f76635bda045f2ca1330d5362394cd
SHA1

8f4bf8a6912adb10030afb6bda947af4e998b9dc
SHA256

f2e3ffc81a10e1c4fa279fc19778546514b51a8c33a4864f93b2da1f69110594
SHA512

1e0cfbfb656f4cadd42ea2bd08aec56e04a6b4cec01a387ea3d074b2358cf0b202385804f8bb4861e37e7e32ae4d8a9e0039ed9a53a2c4d9f39e505e371c1803
SSDEEP

12288:n5ba2SroKa5pwYM30A25cyDbXHELnUimJX+kdagdThKk/A6Mq:lSfaM30A25Amn/VUjq

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
2176	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4060	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
4060	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
2176	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
2176	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2176	4060	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	99
PID 4060 wrote to memory of 2176	4060	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	99
PID 4060 wrote to memory of 2176	4060	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	99
PID 2176 wrote to memory of 3640	2176	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	101
PID 2176 wrote to memory of 3640	2176	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	101
PID 2176 wrote to memory of 3640	2176	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	101
PID 2176 wrote to memory of 3640	2176	79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe	101

C:\Users\Admin\AppData\Local\Temp\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Roaming\monolib\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Roaming\monolib\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\monolib\79f76635bda045f2ca1330d5362394cd_JaffaCakes118.exe

Filesize
680KB

MD5
79f76635bda045f2ca1330d5362394cd

SHA1
8f4bf8a6912adb10030afb6bda947af4e998b9dc

SHA256
f2e3ffc81a10e1c4fa279fc19778546514b51a8c33a4864f93b2da1f69110594

SHA512
1e0cfbfb656f4cadd42ea2bd08aec56e04a6b4cec01a387ea3d074b2358cf0b202385804f8bb4861e37e7e32ae4d8a9e0039ed9a53a2c4d9f39e505e371c1803

Download Submit
memory/2176-33-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-34-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-40-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2176-29-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-30-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-31-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-39-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-32-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-28-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-35-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-36-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-37-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-38-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2176-43-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/3640-46-0x000001AF2C1E0000-0x000001AF2C204000-memory.dmp

Filesize
144KB

Download
memory/3640-45-0x000001AF2C1E0000-0x000001AF2C204000-memory.dmp

Filesize
144KB

Download
memory/4060-19-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4060-9-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-12-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-6-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-7-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-18-0x0000000002A20000-0x0000000002A51000-memory.dmp

Filesize
196KB

Download
memory/4060-10-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-8-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-3-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-5-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-11-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-13-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-14-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-4-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4060-16-0x0000000000456000-0x0000000000457000-memory.dmp

Filesize
4KB

Download
memory/4060-15-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads