trickbot | b2c0ff066088af142c374caea22757f021b810043761b3ec969cf57178ec5f0d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6b746b4538dba9e3016b7afe6707341_JaffaCakes118.exe
Size

409KB
MD5

b6b746b4538dba9e3016b7afe6707341
SHA1

6dd445a26c6b120d5473bf7502a4a2cc105fa9b1
SHA256

b2c0ff066088af142c374caea22757f021b810043761b3ec969cf57178ec5f0d
SHA512

b65c43d27942ebac6f44eb80d2d335bbf52f5ae64e0487a433438aa81f616aef61a2e420339e6add983bdfa3e3986f2b0d9e6a63e7ddcf786e303f712af7a9fc
SSDEEP

6144:lN4y/IlOJtP9lIzXqr+D6bRXDLEs6bE0s8JOHs0Q+aPR:lS8IYJtP9KzXqrW6FXDLEsj0jOYFR

Score

10^/10

trickbot banker trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 10 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1612-1-0x0000000000180000-0x00000000001A9000-memory.dmp	trickbot_loader32
behavioral2/memory/1612-9-0x0000000000180000-0x00000000001A9000-memory.dmp	trickbot_loader32
behavioral2/memory/452-10-0x0000000000690000-0x00000000006B9000-memory.dmp	trickbot_loader32
behavioral2/memory/1612-6-0x0000000000400000-0x0000000000469000-memory.dmp	trickbot_loader32
behavioral2/memory/452-23-0x0000000000400000-0x0000000000469000-memory.dmp	trickbot_loader32
behavioral2/memory/452-26-0x0000000000690000-0x00000000006B9000-memory.dmp	trickbot_loader32
behavioral2/memory/4992-30-0x00000000001A0000-0x00000000001C9000-memory.dmp	trickbot_loader32
behavioral2/memory/4992-42-0x0000000000400000-0x0000000000469000-memory.dmp	trickbot_loader32
behavioral2/memory/4992-45-0x00000000001A0000-0x00000000001C9000-memory.dmp	trickbot_loader32
behavioral2/memory/3448-60-0x0000000000400000-0x0000000000469000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\HJCVSQW.Cons	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
File opened for modification	C:\Windows\SysWOW64\HJCVSQW.Cons	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
Token: SeTcbPrivilege	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 452	1612	b6b746b4538dba9e3016b7afe6707341_JaffaCakes118.exe	81
PID 1612 wrote to memory of 452	1612	b6b746b4538dba9e3016b7afe6707341_JaffaCakes118.exe	81
PID 1612 wrote to memory of 452	1612	b6b746b4538dba9e3016b7afe6707341_JaffaCakes118.exe	81
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 452 wrote to memory of 2796	452	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	82
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 4992 wrote to memory of 1452	4992	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	90
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92
PID 3448 wrote to memory of 3900	3448	b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b6b746b4538dba9e3016b7afe6707341_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6b746b4538dba9e3016b7afe6707341_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Roaming\WinSocket\b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2796

C:\Users\Admin\AppData\Roaming\WinSocket\b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\WinSocket\b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1452

C:\Users\Admin\AppData\Roaming\WinSocket\b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\WinSocket\b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\503dd1842ca2542783c874edc85e93f5_50b25195-d6c8-43bb-b2ca-a8bd616967ef

Filesize
1KB

MD5
16d1f01c6fb68d54623e4e3495419ba6

SHA1
922caee437a358bfdf2f1fdc74f576b7dd5b415c

SHA256
ce934b00464b17b8394e83f87390b538887850ca81e02202d610d2db20d928f5

SHA512
56b54675c51dbde5f640e05cf358cfb0627542a9f4ae56bd03acebc4588a24a2de05c1af23ac3c0d224f2e263c73f2d2d72199d2ba6e731c890156b5e6f1fba4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2080292272-204036150-2159171770-1000\0f5007522459c86e95ffcc62f32308f1_50b25195-d6c8-43bb-b2ca-a8bd616967ef

Filesize
1KB

MD5
aafe03c5dfe6edeb0ea854b0c4bacbfb

SHA1
2e5c4caa2ae89e41bd142e24747e2bf2cbbb4e78

SHA256
ec79f38299b8538870207df7dc5afcb7f33d8ca4366b75478354b0410d1864e2

SHA512
de31983fee099d3a7d0456c91173da3fee8ec9c56e42d5c8a0bf776666b334053863fb25a3c543caf045a874a3db24c4fb73a251c851a1bf6c180f7264e6c025

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\b7b847b4639dba9e3017b8afe7808341_KaffaDaket119.exe

Filesize
409KB

MD5
b6b746b4538dba9e3016b7afe6707341

SHA1
6dd445a26c6b120d5473bf7502a4a2cc105fa9b1

SHA256
b2c0ff066088af142c374caea22757f021b810043761b3ec969cf57178ec5f0d

SHA512
b65c43d27942ebac6f44eb80d2d335bbf52f5ae64e0487a433438aa81f616aef61a2e420339e6add983bdfa3e3986f2b0d9e6a63e7ddcf786e303f712af7a9fc

Download Submit
C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

Filesize
23KB

MD5
ccc02afc1b8ca2a42b5e883f0ca7e314

SHA1
319162df718f09937c859a0733b8d3e2ee22bc1b

SHA256
55b00b73f83fc9fca84b1d0102280515c7d98117a153afc9c0df74144797f25b

SHA512
8e910661c507618ff2558e652010db7cb816604cbd3824c8b0bfac0f5ab51993c5ce946fb0cc9b67e5048833a2a1a3e1b0d77f6f34b4de17b52803a8340f52e6

Download Submit
memory/452-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/452-10-0x0000000000690000-0x00000000006B9000-memory.dmp

Filesize
164KB

Download
memory/452-24-0x0000000000A80000-0x0000000000B3E000-memory.dmp

Filesize
760KB

Download
memory/452-23-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/452-21-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/452-26-0x0000000000690000-0x00000000006B9000-memory.dmp

Filesize
164KB

Download
memory/452-25-0x00000000028D0000-0x0000000002B99000-memory.dmp

Filesize
2.8MB

Download
memory/1452-47-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1612-1-0x0000000000180000-0x00000000001A9000-memory.dmp

Filesize
164KB

Download
memory/1612-6-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1612-9-0x0000000000180000-0x00000000001A9000-memory.dmp

Filesize
164KB

Download
memory/2796-16-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2796-22-0x00000130FBB60000-0x00000130FBB61000-memory.dmp

Filesize
4KB

Download
memory/2796-17-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/3448-60-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3448-61-0x0000000001460000-0x000000000151E000-memory.dmp

Filesize
760KB

Download
memory/3448-62-0x0000000001520000-0x00000000017E9000-memory.dmp

Filesize
2.8MB

Download
memory/4992-41-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4992-42-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4992-43-0x00000000014A0000-0x000000000155E000-memory.dmp

Filesize
760KB

Download
memory/4992-44-0x0000000001560000-0x0000000001829000-memory.dmp

Filesize
2.8MB

Download
memory/4992-45-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/4992-30-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download