trickbot | 327571c6f345df8ca5769404f6445c034ab4d8b8cef2302fdfc0c7d5d8305eea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89a3e160348482bb1701a9ca51db4679_JaffaCakes118.exe
Size 564KB
Sample240601-hfl52ach8v
SHA256 327571c6f345df8ca5769404f6445c034ab4d8b8cef2302fdfc0c7d5d8305eea
MD5 89a3e160348482bb1701a9ca51db4679
SHA1 29eb8fb34f9fb8faabe0b676877c4d4485154a1e
SHA512 f2cef404e22ece7104f388ba5ae87bb11f550f938844c673bd2c1240b9c20dc816998834a63d9b020302a59a617fe6fd43a3f1aca2e55e779575b1e273f89c1a
SSDEEP 6144:7aeXMKpoTxYo79sFF2objbHDeGvyU9L7aqzQwzQ6WUnzBuc34Bza3GUAr2Ghw2/Y:WCMKOTH7aPbjr3vyd+DBT4BWiMbGu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trickbot jim329 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000276

Botnet

jim329

92.38.149.25:443
94.181.47.198:449
31.31.161.165:449
158.69.177.176:443
181.113.17.230:449
212.23.70.149:443
91.201.65.89:443
170.81.32.66:449
42.115.91.177:443
54.39.167.242:443
71.94.101.25:443
68.45.243.125:449
192.252.209.44:443
182.50.64.148:449
187.190.249.230:443
107.175.127.147:443
82.222.40.119:449
198.100.157.163:443
23.226.138.169:443
103.110.91.118:449
31.179.162.86:443
202.137.121.14:449
98.177.188.224:449
103.111.53.126:449
105.27.171.234:449
182.253.20.66:449
71.13.140.89:443
5.104.41.188:443
46.149.182.112:449
37.235.251.150:449
62.141.94.107:443
115.78.3.170:443
197.232.50.85:443
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
110.232.86.52:449
68.109.83.22:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMY\99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMY\\99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	checkip.amazonaws.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4624	4436	89a3e160348482bb1701a9ca51db4679_JaffaCakes118.exe	84
PID 4436 wrote to memory of 4624	4436	89a3e160348482bb1701a9ca51db4679_JaffaCakes118.exe	84
PID 4436 wrote to memory of 4624	4436	89a3e160348482bb1701a9ca51db4679_JaffaCakes118.exe	84
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85
PID 4624 wrote to memory of 1112	4624	99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\89a3e160348482bb1701a9ca51db4679_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89a3e160348482bb1701a9ca51db4679_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Roaming\AIMY\99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\AIMY\99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe

Path C:\Users\Admin\AppData\Roaming\AIMY\99a3e170349492bb1801a9ca61db4789_KaffaDaket119.exe
Size 564KB
SHA256 327571c6f345df8ca5769404f6445c034ab4d8b8cef2302fdfc0c7d5d8305eea
MD5 89a3e160348482bb1701a9ca51db4679
SHA1 29eb8fb34f9fb8faabe0b676877c4d4485154a1e
SHA512 f2cef404e22ece7104f388ba5ae87bb11f550f938844c673bd2c1240b9c20dc816998834a63d9b020302a59a617fe6fd43a3f1aca2e55e779575b1e273f89c1a
SSDEEP 6144:7aeXMKpoTxYo79sFF2objbHDeGvyU9L7aqzQwzQ6WUnzBuc34Bza3GUAr2Ghw2/Y:WCMKOTH7aPbjr3vyd+DBT4BWiMbGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f5007522459c86e95ffcc62f32308f1_468f6343-c0e6-4931-9703-30c6539573cb

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\0f5007522459c86e95ffcc62f32308f1_468f6343-c0e6-4931-9703-30c6539573cb
Size 1KB
SHA256 a68972b740205391a5bb5d36a14584065386c0f5dd065a7bdfb2a98ac6759b11
MD5 cbdc8b0a34df49b8e1e8901268a38966
SHA1 79a297590d73158f0674c72f6406c5ea507d972f
SHA512 1484d05c4c45f720d9737e75f1d4c9444ad71cf480c79defb9bdd14b8c3b8562c8b4d45780e850d20c85c6dae084a6865cf298732fd7fda65ecca5c7b6dbcc24
MD5 SHA1 SHA512

Submit Download

memory/1112-17-0x0000000140000000-0x0000000140035000-memory.dmp

Download

memory/1112-35-0x0000000140000000-0x0000000140035000-memory.dmp

Download

memory/1112-24-0x000001CBD9CB0000-0x000001CBD9CB1000-memory.dmp

Download

memory/1112-18-0x0000000140000000-0x0000000140035000-memory.dmp

Download

memory/4436-25-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4436-4-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4436-1-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4436-0-0x0000000000401000-0x0000000000417000-memory.dmp

Download

memory/4624-13-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4624-11-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4624-12-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4624-8-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4624-26-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4624-28-0x00000000028D0000-0x0000000002B99000-memory.dmp

Download

memory/4624-27-0x0000000002810000-0x00000000028CE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads