trickbot | f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74ba5e610af8da17018aeb37ed6fa834JaffaCakes118.exe
Size

361KB
MD5

74ba5e610af8da17018aeb37ed6fa834
SHA1

d3ca5eef27592370fa380729c83cbf7d49092244
SHA256

f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107
SHA512

a66003a07e50f55a2d9d5eb0c5fdcc84e39362c3d1a97f8e7945b9b7995b0f109ffa1de75e242eec36bcd32824b9215040491b78374ac959e91fc6bde7d55d7e
SSDEEP

6144:6611x/ddyenQQU6wdLyTMnYtesyPLWJuUGq5BOf7aWpmJCp:6axvtn3LwdWCY3yO5jOzaWpmJ

Score

10^/10

trickbot ser0924 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000265

Botnet

ser0924

118.97.119.218:449

94.181.47.198:449

144.121.143.129:449

185.200.60.138:449

185.42.52.126:449

181.174.112.74:449

178.116.83.49:443

121.58.242.206:449

182.50.64.148:449

82.222.40.119:449

203.176.132.102:449

103.110.91.118:449

128.201.92.41:449

103.111.53.126:449

182.253.20.66:449

103.10.145.197:449

81.17.86.112:443

95.154.80.154:449

46.149.182.112:449

109.95.113.227:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3988-1-0x0000000000740000-0x000000000077D000-memory.dmp	trickbot_loader32
behavioral2/memory/2316-13-0x0000000000730000-0x000000000076D000-memory.dmp	trickbot_loader32
behavioral2/memory/3988-23-0x0000000000400000-0x0000000000460000-memory.dmp	trickbot_loader32
behavioral2/memory/3988-24-0x0000000000740000-0x000000000077D000-memory.dmp	trickbot_loader32
behavioral2/memory/2316-25-0x0000000000400000-0x0000000000460000-memory.dmp	trickbot_loader32
behavioral2/memory/2316-28-0x0000000000730000-0x000000000076D000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

pid	Process
2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMT\\84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	icanhazip.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2316	3988	74ba5e610af8da17018aeb37ed6fa834JaffaCakes118.exe	82
PID 3988 wrote to memory of 2316	3988	74ba5e610af8da17018aeb37ed6fa834JaffaCakes118.exe	82
PID 3988 wrote to memory of 2316	3988	74ba5e610af8da17018aeb37ed6fa834JaffaCakes118.exe	82
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83
PID 2316 wrote to memory of 3424	2316	84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\74ba5e610af8da17018aeb37ed6fa834JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74ba5e610af8da17018aeb37ed6fa834JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AIMT\84ba6e710af9da18019aeb38ed7fa934KaffaDaket119.exe

Filesize
361KB

MD5
74ba5e610af8da17018aeb37ed6fa834

SHA1
d3ca5eef27592370fa380729c83cbf7d49092244

SHA256
f1fca2ff7712a60158068b151b5ebf0c73826b50cb8be136fc17ba8c7c2d0107

SHA512
a66003a07e50f55a2d9d5eb0c5fdcc84e39362c3d1a97f8e7945b9b7995b0f109ffa1de75e242eec36bcd32824b9215040491b78374ac959e91fc6bde7d55d7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19

Filesize
1KB

MD5
dcac1aad221efc52ee313aa3241279a1

SHA1
2dced567584d12d8031448f7ae9e92af6b9e6edd

SHA256
51b86d3a3c64f519182c440a50a32c2b3b2d8f7049a10022d55dd8b5ab772731

SHA512
0f56a95ba1dd3abf1a09c6b054f61e55a4909ab4eb36574243e59550fce80994de10372f354dadc838c77600b9f9b04ff7aac498eaf1163f5be6d5b0fd498ed6

Download Submit
memory/2316-28-0x0000000000730000-0x000000000076D000-memory.dmp

Filesize
244KB

Download
memory/2316-27-0x0000000002980000-0x0000000002C49000-memory.dmp

Filesize
2.8MB

Download
memory/2316-14-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2316-13-0x0000000000730000-0x000000000076D000-memory.dmp

Filesize
244KB

Download
memory/2316-8-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2316-25-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2316-26-0x00000000028C0000-0x000000000297E000-memory.dmp

Filesize
760KB

Download
memory/3424-15-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3424-16-0x000002B285040000-0x000002B285041000-memory.dmp

Filesize
4KB

Download
memory/3424-17-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3424-35-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3988-23-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3988-1-0x0000000000740000-0x000000000077D000-memory.dmp

Filesize
244KB

Download
memory/3988-24-0x0000000000740000-0x000000000077D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads