trickbot | 89459601b63e40b368893b3ada259d5fa4991a362acd350a78d8f48e3a52b028

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96e11187133b859ef5233e97f31a04e4_JaffaCakes118.exe
Size

479KB
MD5

96e11187133b859ef5233e97f31a04e4
SHA1

786a912301c3c06d05f43646cb46c1d5011cd2c9
SHA256

89459601b63e40b368893b3ada259d5fa4991a362acd350a78d8f48e3a52b028
SHA512

5a0277a4a830a8ae783cdd50d51702c1774835edb8bba0c9062969de305cac9df720a1be740e73dd9b68aba52716a6b7553406d19f78f61a08cfeca3795835ed
SSDEEP

6144:0/BkMx7//OXHJ0ZTG60eKiw/WSeHm0LSYTQYzvwwodZCp4zxYtY:MkK7WHq1aZiwOSeH6ZWowobzNEY

Score

10^/10

trickbot ser0920 banker persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000263

Botnet

ser0920

118.97.119.218:449

94.181.47.198:449

144.121.143.129:449

185.200.60.138:449

185.42.52.126:449

181.174.112.74:449

178.116.83.49:443

121.58.242.206:449

182.50.64.148:449

82.222.40.119:449

97.78.222.18:449

67.79.15.106:449

168.167.87.79:443

103.111.53.126:449

182.253.20.66:449

192.188.120.164:443

81.17.86.112:443

95.154.80.154:449

46.149.182.112:449

69.9.232.167:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/2332-0-0x0000000000D50000-0x0000000000D8D000-memory.dmp	trickbot_loader32
behavioral2/memory/4464-5-0x0000000000B60000-0x0000000000B9D000-memory.dmp	trickbot_loader32
behavioral2/memory/2332-21-0x0000000000D50000-0x0000000000D8D000-memory.dmp	trickbot_loader32
behavioral2/memory/4464-25-0x0000000000B60000-0x0000000000B9D000-memory.dmp	trickbot_loader32

Executes dropped EXE 1 IoCs

pid	Process
4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\mssert\97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\mssert\\97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ident.me
22	ident.me

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4464	2332	96e11187133b859ef5233e97f31a04e4_JaffaCakes118.exe	90
PID 2332 wrote to memory of 4464	2332	96e11187133b859ef5233e97f31a04e4_JaffaCakes118.exe	90
PID 2332 wrote to memory of 4464	2332	96e11187133b859ef5233e97f31a04e4_JaffaCakes118.exe	90
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91
PID 4464 wrote to memory of 816	4464	97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\96e11187133b859ef5233e97f31a04e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96e11187133b859ef5233e97f31a04e4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Roaming\mssert\97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\mssert\97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mssert\97e11198133b969ef6233e98f31a04e4_KaffaDaket119.exe

Filesize
479KB

MD5
96e11187133b859ef5233e97f31a04e4

SHA1
786a912301c3c06d05f43646cb46c1d5011cd2c9

SHA256
89459601b63e40b368893b3ada259d5fa4991a362acd350a78d8f48e3a52b028

SHA512
5a0277a4a830a8ae783cdd50d51702c1774835edb8bba0c9062969de305cac9df720a1be740e73dd9b68aba52716a6b7553406d19f78f61a08cfeca3795835ed

Download Submit
memory/816-14-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/816-32-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/816-12-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/816-13-0x0000022B09CF0000-0x0000022B09CF1000-memory.dmp

Filesize
4KB

Download
memory/2332-21-0x0000000000D50000-0x0000000000D8D000-memory.dmp

Filesize
244KB

Download
memory/2332-0-0x0000000000D50000-0x0000000000D8D000-memory.dmp

Filesize
244KB

Download
memory/2332-20-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4464-6-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4464-11-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/4464-7-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4464-22-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4464-23-0x0000000002910000-0x00000000029CE000-memory.dmp

Filesize
760KB

Download
memory/4464-25-0x0000000000B60000-0x0000000000B9D000-memory.dmp

Filesize
244KB

Download
memory/4464-24-0x00000000029D0000-0x0000000002C99000-memory.dmp

Filesize
2.8MB

Download
memory/4464-5-0x0000000000B60000-0x0000000000B9D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads