trickbot | 7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79

Analysis

max time kernel
146s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 09:19

Target

9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe
Size

448KB
MD5

9dafee1dd1d847462a98b598d1d11064
SHA1

f9c75ca6993a1ea2ad05812aa7ea41aebbedc358
SHA256

7ac069def964c0987535ddd87f1366c3f41a9c853bb52cc06f2d708b636c5e79
SHA512

3b550198e88b7b009747571088d73d0b26f7d83390c8cec2ddf027b7e81fc5a55ac6591c179d18433cf33a7cbec2244cc69cb8c7a5e4c4c5ac6079f5e794ada1
SSDEEP

12288:QboBb/W9ANGBAFb5i0P6HfewKQLYg0yCxE:4xBAiAHwfzl

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

resource	yara_rule
behavioral1/memory/2352-3-0x0000000000370000-0x00000000003A2000-memory.dmp	dave
behavioral1/memory/2352-8-0x0000000000250000-0x0000000000280000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2352	9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	wermgr.exe
Token: SeDebugPrivilege	1736	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1736	2352	9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe	28
PID 2352 wrote to memory of 1736	2352	9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe	28
PID 2352 wrote to memory of 1736	2352	9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe	28
PID 2352 wrote to memory of 1736	2352	9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe	28
PID 2352 wrote to memory of 1736	2352	9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe	28
PID 2352 wrote to memory of 1736	2352	9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe	28

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9dafee1dd1d847462a98b598d1d11064_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1736

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1736-177-0x00000000000F0000-0x0000000000114000-memory.dmp

Filesize
144KB

Download
memory/1736-179-0x00000000000F0000-0x0000000000114000-memory.dmp

Filesize
144KB

Download
memory/2352-3-0x0000000000370000-0x00000000003A2000-memory.dmp

Filesize
200KB

Download
memory/2352-7-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/2352-10-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/2352-9-0x0000000000280000-0x00000000002AE000-memory.dmp

Filesize
184KB

Download
memory/2352-8-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/2352-95-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/2352-175-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2352-176-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2352-178-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2352-180-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download