trickbot | 0be13698cb9a68bfa85af43224c0746a71a0c0ed85c49e945061e43dec7475cd

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 10:00

Target

a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe
Size

448KB
MD5

a917430db15b34810a77d5087a6e45cc
SHA1

d17173c9206ba9a5b665fab102d7e97ad47a2152
SHA256

0be13698cb9a68bfa85af43224c0746a71a0c0ed85c49e945061e43dec7475cd
SHA512

232a242973b4d6bc5b3630ece742a9dcaf6388a47439f5ee26c275f0a5604e6b70a511d7a5833b2dad67255b4f50d793228c71e59b18068ac5ef3690e85b73c0
SSDEEP

12288:QboBb/W9ANGBAFb5i0P6HfewKQLYg0yCx2:4xBAiAHwfzp

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 2 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

Processes:

resource	yara_rule
behavioral2/memory/1076-3-0x0000000002430000-0x0000000002462000-memory.dmp	dave
behavioral2/memory/1076-7-0x0000000002400000-0x0000000002430000-memory.dmp	dave

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe

pid process

1076 a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe
1076 a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe

pid	process
1076	a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe
1076	a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a917430db15b34810a77d5087a6e45cc_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:660

memory/1076-3-0x0000000002430000-0x0000000002462000-memory.dmp

Filesize
200KB

Download
memory/1076-7-0x0000000002400000-0x0000000002430000-memory.dmp

Filesize
192KB

Download
memory/1076-8-0x0000000002900000-0x000000000292F000-memory.dmp

Filesize
188KB

Download
memory/1076-9-0x00000000028D0000-0x00000000028FE000-memory.dmp

Filesize
184KB

Download
memory/1076-10-0x0000000002900000-0x000000000292F000-memory.dmp

Filesize
188KB

Download
memory/1076-96-0x0000000002900000-0x000000000292F000-memory.dmp

Filesize
188KB

Download