trickbot | 5609b3f916346146771b721ee20f7679ce87b7fc4b6a18bf6adf7201b98c5e22

General

Target

89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe
Size

159KB
MD5

89ae5e21d6cf455f467cfaf62350848c
SHA1

e69b24e44991d6d9a2e707f19757d8b2a6222e74
SHA256

5609b3f916346146771b721ee20f7679ce87b7fc4b6a18bf6adf7201b98c5e22
SHA512

63b67c859e5a0477b5c88cc696e298cfaed6cf22357ef2e3e41f59cd76aa6e313786f509e73cf3e5309b6880af71f58eb9a24305b5841370be8ca8d75c3ee5a4
SSDEEP

3072:SH46pwuexbq0J2uKpQTbFgq5xvhPFFPZ31C72Bm+UgkrS2n2icz:04weEu7FhPbPZ319nkF

Score

10^/10

trickbot ser0516 banker evasion trojan

Malware Config

Extracted

Family

trickbot

Version

1000194

Botnet

ser0516

C2

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

173.220.6.194:449

179.107.89.145:449

46.20.207.204:443

69.122.117.95:449

68.96.73.154:449

185.42.192.194:449

189.84.125.37:443

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449

37.230.112.67:443

92.53.78.159:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 5 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1808-0-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral1/memory/1808-20-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral1/memory/1928-21-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral1/memory/2420-24-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral1/memory/2420-36-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\diskcheck\ = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\diskcheck\ = "0"	svchost.exe

Executes dropped EXE 2 IoCs

Processes:

99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

pid process

1928 99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
2420 99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
Loads dropped DLL 1 IoCs

Processes:

89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe

pid process

1808 89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 icanhazip.com
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

description pid process

Token: SeTakeOwnershipPrivilege 2924 svchost.exe
Token: SeTcbPrivilege 2420 99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

pid	process
1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
2420	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

pid	process
1808	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe

flow	ioc
2	icanhazip.com

description	pid	process
Token: SeTakeOwnershipPrivilege	2924	svchost.exe
Token: SeTcbPrivilege	2420	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

description	pid	process	target process
PID 1808 wrote to memory of 1928	1808	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
PID 1808 wrote to memory of 1928	1808	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
PID 1808 wrote to memory of 1928	1808	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
PID 1808 wrote to memory of 1928	1808	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 1928 wrote to memory of 2924	1928	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Windows security bypass
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\system32\taskeng.exe
taskeng.exe {2BF8A1F4-45A8-497D-BAFC-C1047ED0CC67} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1672

C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Windows security bypass
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

Filesize
159KB

MD5
89ae5e21d6cf455f467cfaf62350848c

SHA1
e69b24e44991d6d9a2e707f19757d8b2a6222e74

SHA256
5609b3f916346146771b721ee20f7679ce87b7fc4b6a18bf6adf7201b98c5e22

SHA512
63b67c859e5a0477b5c88cc696e298cfaed6cf22357ef2e3e41f59cd76aa6e313786f509e73cf3e5309b6880af71f58eb9a24305b5841370be8ca8d75c3ee5a4

Download Submit
memory/1808-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1808-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1928-7-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1928-6-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1928-12-0x0000000000250000-0x00000000002BC000-memory.dmp

Filesize
432KB

Download
memory/1928-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2420-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2420-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-11-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2924-13-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2924-14-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads