trickbot | 5609b3f916346146771b721ee20f7679ce87b7fc4b6a18bf6adf7201b98c5e22

General

Target

89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe
Size

159KB
MD5

89ae5e21d6cf455f467cfaf62350848c
SHA1

e69b24e44991d6d9a2e707f19757d8b2a6222e74
SHA256

5609b3f916346146771b721ee20f7679ce87b7fc4b6a18bf6adf7201b98c5e22
SHA512

63b67c859e5a0477b5c88cc696e298cfaed6cf22357ef2e3e41f59cd76aa6e313786f509e73cf3e5309b6880af71f58eb9a24305b5841370be8ca8d75c3ee5a4
SSDEEP

3072:SH46pwuexbq0J2uKpQTbFgq5xvhPFFPZ31C72Bm+UgkrS2n2icz:04weEu7FhPbPZ319nkF

Score

10^/10

trickbot ser0516 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000194

Botnet

ser0516

C2

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

173.220.6.194:449

179.107.89.145:449

46.20.207.204:443

69.122.117.95:449

68.96.73.154:449

185.42.192.194:449

189.84.125.37:443

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449

37.230.112.67:443

92.53.78.159:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral2/memory/4304-0-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral2/memory/3620-5-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral2/memory/4304-20-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32
behavioral2/memory/3620-23-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

Processes:

99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

pid process

3620 99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

pid	process
3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\diskcheck\\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 ip.anysrc.net

flow	ioc
22	ip.anysrc.net

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

description	pid	process	target process
PID 4304 wrote to memory of 3620	4304	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
PID 4304 wrote to memory of 3620	4304	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
PID 4304 wrote to memory of 3620	4304	89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe
PID 3620 wrote to memory of 384	3620	99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89ae5e21d6cf455f467cfaf62350848c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4304

C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\diskcheck\99ae6e21d7cf466f478cfaf72360949c_KaffaDaket119.exe

Filesize
159KB

MD5
89ae5e21d6cf455f467cfaf62350848c

SHA1
e69b24e44991d6d9a2e707f19757d8b2a6222e74

SHA256
5609b3f916346146771b721ee20f7679ce87b7fc4b6a18bf6adf7201b98c5e22

SHA512
63b67c859e5a0477b5c88cc696e298cfaed6cf22357ef2e3e41f59cd76aa6e313786f509e73cf3e5309b6880af71f58eb9a24305b5841370be8ca8d75c3ee5a4

Download Submit
memory/384-13-0x000001AB689E0000-0x000001AB689E1000-memory.dmp

Filesize
4KB

Download
memory/384-30-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/384-14-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/3620-6-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3620-11-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/3620-7-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3620-21-0x00000000023F0000-0x00000000024AE000-memory.dmp

Filesize
760KB

Download
memory/3620-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3620-22-0x00000000024B0000-0x0000000002779000-memory.dmp

Filesize
2.8MB

Download
memory/3620-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4304-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4304-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads