trickbot | 7135ddf422b543528dd66f6db047761b01a2d538efa530a8ebfbb3f76fc38ab6

Analysis

max time kernel
136s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d13af3702d2f0b8598e5c0421f002cb_JaffaCakes118.exe
Size

265KB
MD5

8d13af3702d2f0b8598e5c0421f002cb
SHA1

c72101f1591b00396bcb8710f35283bdd742e06c
SHA256

7135ddf422b543528dd66f6db047761b01a2d538efa530a8ebfbb3f76fc38ab6
SHA512

16985a30b96f0f5095531b79ef56c95141b0506a7b3c1e49d0a53ae402cfffa7d023212d7fb2ceea1488baf55b90447ca54adb551a98b9f969ffe5c115c314ab
SSDEEP

6144:0sndQKnNVBi47Zl/7PrS6axzQR/iC7sW0jw3c0G:VdQKP97T5FRibxgG

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 10 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/2596-1-0x00000000006B0000-0x00000000006D9000-memory.dmp	trickbot_loader32
behavioral2/memory/2596-6-0x0000000000400000-0x0000000000446000-memory.dmp	trickbot_loader32
behavioral2/memory/2596-9-0x00000000006B0000-0x00000000006D9000-memory.dmp	trickbot_loader32
behavioral2/memory/2924-23-0x0000000000400000-0x0000000000446000-memory.dmp	trickbot_loader32
behavioral2/memory/2924-26-0x0000000000670000-0x0000000000699000-memory.dmp	trickbot_loader32
behavioral2/memory/2924-15-0x0000000000670000-0x0000000000699000-memory.dmp	trickbot_loader32
behavioral2/memory/1948-30-0x00000000006B0000-0x00000000006D9000-memory.dmp	trickbot_loader32
behavioral2/memory/1948-42-0x0000000000400000-0x0000000000446000-memory.dmp	trickbot_loader32
behavioral2/memory/1948-45-0x00000000006B0000-0x00000000006D9000-memory.dmp	trickbot_loader32
behavioral2/memory/2924-60-0x0000000000400000-0x0000000000446000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\HJCVSQW.Cons	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
File opened for modification	C:\Windows\SysWOW64\HJCVSQW.Cons	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
Token: SeTcbPrivilege	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2924	2596	8d13af3702d2f0b8598e5c0421f002cb_JaffaCakes118.exe	83
PID 2596 wrote to memory of 2924	2596	8d13af3702d2f0b8598e5c0421f002cb_JaffaCakes118.exe	83
PID 2596 wrote to memory of 2924	2596	8d13af3702d2f0b8598e5c0421f002cb_JaffaCakes118.exe	83
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 2924 wrote to memory of 4048	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	84
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 1948 wrote to memory of 3048	1948	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	98
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100
PID 2924 wrote to memory of 1776	2924	9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8d13af3702d2f0b8598e5c0421f002cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d13af3702d2f0b8598e5c0421f002cb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Roaming\WinSocket\9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4048

C:\Users\Admin\AppData\Roaming\WinSocket\9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3048

C:\Users\Admin\AppData\Roaming\WinSocket\9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\WinSocket\9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\9baf9096577fc5138f25f90c8860f18f_468f6343-c0e6-4931-9703-30c6539573cb

Filesize
1KB

MD5
c8666ca87f825039ec3c441cb7e4edb9

SHA1
0a2b8dd38cc3528af2adcb0bd08602fb564b214c

SHA256
b802cb62598c900d8e779a21878c8503649cb0b3fc7eb21dbfa781a60986d095

SHA512
3107cdc215385b235f76fa31e5210edc638b4763270cde59db3b1866af8c6518bfa683133d28940988975ad11c1312bfcd010bfc3045ac7aa939605d0a4a0f47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\0f5007522459c86e95ffcc62f32308f1_468f6343-c0e6-4931-9703-30c6539573cb

Filesize
1KB

MD5
436f2a113fdc8bd5cddc2d76a21c3148

SHA1
053925494213ff62cc832a8ebf98c1d67323cc18

SHA256
150abb7e1e131cb8cbbe8e6e5dcccadeec36b6c3efc7f39dd86fa4af2e0e01d7

SHA512
4074712220abf0bac73c0a19a44566d2328771b1efa0557631436dcb11302f4ce3e5782c5f8d6f90bb872ba61bdbe842ea52e2ed32b76819bafeb73c67edbb00

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\9d13af3802d2f0b9699e6c0421f002cb_KaffaDaket119.exe

Filesize
265KB

MD5
8d13af3702d2f0b8598e5c0421f002cb

SHA1
c72101f1591b00396bcb8710f35283bdd742e06c

SHA256
7135ddf422b543528dd66f6db047761b01a2d538efa530a8ebfbb3f76fc38ab6

SHA512
16985a30b96f0f5095531b79ef56c95141b0506a7b3c1e49d0a53ae402cfffa7d023212d7fb2ceea1488baf55b90447ca54adb551a98b9f969ffe5c115c314ab

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
68KB

MD5
586c0b43c4a6b910ef03a20afefee54e

SHA1
856605e564db05953625db7f00a41376a08b649c

SHA256
117392aa77a64f419fbc6854157f67e838ce59a2f4ec3a578414dbebe862480f

SHA512
267352f2a2c30ed512cc345f1bfb9fece5d9f793b4cf6817f5156b9aecb7d63dd2b7fb5d64e335902484fdfafd9da9daf47610088488fce1a50c0a14a0a95223

Download Submit
memory/1948-30-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/1948-45-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/1948-44-0x0000000001500000-0x00000000017C9000-memory.dmp

Filesize
2.8MB

Download
memory/1948-43-0x0000000001440000-0x00000000014FE000-memory.dmp

Filesize
760KB

Download
memory/1948-42-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1948-41-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/2596-9-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/2596-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2596-1-0x00000000006B0000-0x00000000006D9000-memory.dmp

Filesize
164KB

Download
memory/2924-25-0x00000000028A0000-0x0000000002B69000-memory.dmp

Filesize
2.8MB

Download
memory/2924-26-0x0000000000670000-0x0000000000699000-memory.dmp

Filesize
164KB

Download
memory/2924-14-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2924-16-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/2924-15-0x0000000000670000-0x0000000000699000-memory.dmp

Filesize
164KB

Download
memory/2924-23-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2924-62-0x0000000001560000-0x0000000001829000-memory.dmp

Filesize
2.8MB

Download
memory/2924-61-0x00000000014A0000-0x000000000155E000-memory.dmp

Filesize
760KB

Download
memory/2924-24-0x00000000027E0000-0x000000000289E000-memory.dmp

Filesize
760KB

Download
memory/2924-60-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2924-10-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/3048-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4048-22-0x0000025F2DA70000-0x0000025F2DA71000-memory.dmp

Filesize
4KB

Download
memory/4048-18-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/4048-17-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download