Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
02/06/2024, 16:48
General
- Target 8ec21130f83612b50655fa1755c68cca_JaffaCakes118.exe
- Size 320KB
- Sample240602-vbk4dsgh8w
- SHA256 c512b38e476dada9b7b00d34625c8d543fa927068893482d8f521cddf2aadaa6
Malware Config
Extracted
-
trickbot
-
1000513
-
ono64
-
51.89.177.20:443
-
194.5.249.174:443
-
107.174.196.242:443
-
185.205.209.241:443
-
82.146.46.220:443
-
5.34.178.126:443
-
212.22.70.65:443
-
195.123.241.90:443
-
185.164.32.214:443
-
198.46.198.139:443
-
195.123.241.187:443
-
86.104.194.116:443
-
195.123.240.252:443
-
185.164.32.215:443
-
45.148.120.195:443
-
45.138.158.32:443
-
5.149.253.99:443
-
92.62.65.163:449
-
88.247.212.56:449
-
180.211.170.214:449
-
autorunName:pwgrab
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ec21130f83612b50655fa1755c68cca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ec21130f83612b50655fa1755c68cca_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/552-168-0x0000024D97010000-0x0000024D97033000-memory.dmp
memory/552-172-0x0000024D97010000-0x0000024D97033000-memory.dmp
memory/552-174-0x0000024D97010000-0x0000024D97033000-memory.dmp
memory/1192-0-0x0000000000950000-0x0000000000982000-memory.dmp
memory/1192-2-0x0000000000950000-0x0000000000982000-memory.dmp
memory/1192-1-0x0000000000900000-0x0000000000931000-memory.dmp
memory/1192-29-0x00000000008C0000-0x00000000008F2000-memory.dmp
memory/1192-88-0x0000000000950000-0x0000000000982000-memory.dmp
memory/1192-167-0x0000000010000000-0x0000000010003000-memory.dmp
memory/1192-166-0x0000000000660000-0x0000000000661000-memory.dmp
memory/1192-171-0x0000000010000000-0x0000000010003000-memory.dmp
memory/1192-177-0x0000000000950000-0x0000000000982000-memory.dmp