trickbot | 6c46836c3f5b304f13e57ed77ee9e3fc0361b040339b3dc23acc7730f490ab07

General

Target

8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe
Size

732KB
MD5

8061cb1704f18210e601363c26c89fca
SHA1

6890087f361bb5eafb92b1574d8d1b907d3de1bf
SHA256

6c46836c3f5b304f13e57ed77ee9e3fc0361b040339b3dc23acc7730f490ab07
SHA512

950a4798bf94f2256aa37ec6f6bd0ad40bbc6300b46cc1bad81838d849d5fc6258a6e35ae277d91355c01beae6f32079d5cdf2ff10e054b253ff44a8a0eebe31
SSDEEP

12288:u1JJsh+EOWm1M5rv+itJE6yqr5PS6i0ZkUvBp:ZyWkMDfrcCZkUvX

Score

10^/10

trickbot banker dave trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 3 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
behavioral1/memory/2880-0-0x00000000006E0000-0x0000000000715000-memory.dmp	dave
behavioral1/memory/2880-5-0x00000000006A0000-0x00000000006D2000-memory.dmp	dave
behavioral1/memory/2208-14-0x0000000001DD0000-0x0000000001E05000-memory.dmp	dave

Executes dropped EXE 1 IoCs

Processes:

日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe

pid process

2208 日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe
Loads dropped DLL 2 IoCs

Processes:

8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe

pid process

2880 8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe
2880 8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2648 svchost.exe
Token: SeDebugPrivilege 2648 svchost.exe

pid	process
2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe

description	pid	process
Token: SeDebugPrivilege	2648	svchost.exe
Token: SeDebugPrivilege	2648	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe

pid	process
2880	8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe
2880	8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe
2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe
2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe

description	pid	process	target process
PID 2880 wrote to memory of 2208	2880	8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe
PID 2880 wrote to memory of 2208	2880	8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe
PID 2880 wrote to memory of 2208	2880	8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe
PID 2880 wrote to memory of 2208	2880	8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe
PID 2208 wrote to memory of 2648	2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe	svchost.exe
PID 2208 wrote to memory of 2648	2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe	svchost.exe
PID 2208 wrote to memory of 2648	2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe	svchost.exe
PID 2208 wrote to memory of 2648	2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe	svchost.exe
PID 2208 wrote to memory of 2648	2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe	svchost.exe
PID 2208 wrote to memory of 2648	2208	日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8061cb1704f18210e601363c26c89fca_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\ProgramData\日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe
  "C:\ProgramData\日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\日报XVIᠬᠹᠶᠳᠶᠲᠳᠰII.exe

Filesize
732KB

MD5
8061cb1704f18210e601363c26c89fca

SHA1
6890087f361bb5eafb92b1574d8d1b907d3de1bf

SHA256
6c46836c3f5b304f13e57ed77ee9e3fc0361b040339b3dc23acc7730f490ab07

SHA512
950a4798bf94f2256aa37ec6f6bd0ad40bbc6300b46cc1bad81838d849d5fc6258a6e35ae277d91355c01beae6f32079d5cdf2ff10e054b253ff44a8a0eebe31

Download Submit
memory/2208-14-0x0000000001DD0000-0x0000000001E05000-memory.dmp

Filesize
212KB

Download
memory/2208-19-0x0000000001F50000-0x0000000001F82000-memory.dmp

Filesize
200KB

Download
memory/2208-20-0x0000000001F10000-0x0000000001F41000-memory.dmp

Filesize
196KB

Download
memory/2208-21-0x0000000001F50000-0x0000000001F82000-memory.dmp

Filesize
200KB

Download
memory/2208-22-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2208-23-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2208-25-0x0000000001F50000-0x0000000001F82000-memory.dmp

Filesize
200KB

Download
memory/2648-24-0x0000000000060000-0x0000000000084000-memory.dmp

Filesize
144KB

Download
memory/2648-26-0x0000000000060000-0x0000000000084000-memory.dmp

Filesize
144KB

Download
memory/2880-0-0x00000000006E0000-0x0000000000715000-memory.dmp

Filesize
212KB

Download
memory/2880-5-0x00000000006A0000-0x00000000006D2000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads