trickbot | ae98fc737253fa4e0c722ce5cf0b0f9203faf0cc0e759a029a12cf7f609e71bb

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 05:55

Target

10f19b901d088298285278ee4550ef9e_JaffaCakes118.exe
Size

164KB
MD5

10f19b901d088298285278ee4550ef9e
SHA1

60757910c193f62a99689256f5db1fc62ac11697
SHA256

ae98fc737253fa4e0c722ce5cf0b0f9203faf0cc0e759a029a12cf7f609e71bb
SHA512

beea04474c6b239493a2b1e57941f4bded2a09a0a800d881955f818ed3404333f37f04c9ab627a77a493eada57e74819411e33f5cb8929f4b1f581d23c225670
SSDEEP

3072:w6E37BFasd6JO8+FCPrn4/UK0jgNJqmSTZyBtG6tSixOJ33wf:w6E310s8JB+Fgq0jQRSTuQISM

Score

10^/10

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral1/memory/2000-0-0x0000000000400000-0x0000000000429000-memory.dmp	trickbot_loader32

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2388	2000	10f19b901d088298285278ee4550ef9e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2388	2000	10f19b901d088298285278ee4550ef9e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2388	2000	10f19b901d088298285278ee4550ef9e_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2388	2000	10f19b901d088298285278ee4550ef9e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\10f19b901d088298285278ee4550ef9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10f19b901d088298285278ee4550ef9e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 36
  2⤵
  - Program crash
  PID:2388

memory/2000-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download