trickbot | def9411f8ed86b0b056311aab1647747cb692c111919e7ead29e70d583dbf61f

General

Target

289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
Size

400KB
MD5

289c70c2097900b5797622e1802e649d
SHA1

3dd51cb8e4ba7f430c9a6fd010bb58964737d4ea
SHA256

def9411f8ed86b0b056311aab1647747cb692c111919e7ead29e70d583dbf61f
SHA512

42e2eac1da09d51e15c8a6f049828c1802ff106450569dd202b28d0de95d4ca18f9e894c50f3277d2b2d28b944cbfaa9db838b78dab573e209a21f8290c45196
SSDEEP

6144:fXRY/TyW0mL1QnLSNFXI21MfCDKbGsRtdumLIs/q+xmG3SOKCtqhhl0wN:pgT/0mL1f712CD6GyDuv+SOHqhhau

Score

10^/10

trickbot tot33 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000024

Botnet

tot33

C2

85.93.159.98:449

92.242.214.203:449

202.21.103.194:449

169.239.45.42:449

45.234.248.66:449

103.91.244.102:449

118.67.216.238:449

117.212.193.62:449

201.184.190.59:449

103.29.185.138:449

79.122.166.236:449

37.143.150.186:449

179.191.108.58:449

85.159.214.61:443

149.56.80.31:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Loads dropped DLL 7 IoCs

pid	Process
1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
1456	WerFault.exe
1456	WerFault.exe
1456	WerFault.exe
1456	WerFault.exe
1456	WerFault.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2880	1624	WerFault.exe	29
1456	2264	WerFault.exe	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2264	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	31
PID 1624 wrote to memory of 2264	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	31
PID 1624 wrote to memory of 2264	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	31
PID 1624 wrote to memory of 2264	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	31
PID 2264 wrote to memory of 2736	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2736	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2736	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2736	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	32
PID 1624 wrote to memory of 2880	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	33
PID 1624 wrote to memory of 2880	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	33
PID 1624 wrote to memory of 2880	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	33
PID 1624 wrote to memory of 2880	1624	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	33
PID 2264 wrote to memory of 2540	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2540	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2540	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2540	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2540	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2540	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	34
PID 2264 wrote to memory of 1456	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	35
PID 2264 wrote to memory of 1456	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	35
PID 2264 wrote to memory of 1456	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	35
PID 2264 wrote to memory of 1456	2264	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
  "C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:2736
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 160
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 160
  2⤵
  - Program crash
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Filesize
400KB

MD5
289c70c2097900b5797622e1802e649d

SHA1
3dd51cb8e4ba7f430c9a6fd010bb58964737d4ea

SHA256
def9411f8ed86b0b056311aab1647747cb692c111919e7ead29e70d583dbf61f

SHA512
42e2eac1da09d51e15c8a6f049828c1802ff106450569dd202b28d0de95d4ca18f9e894c50f3277d2b2d28b944cbfaa9db838b78dab573e209a21f8290c45196

Download Submit
memory/1624-9-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-15-0x0000000000418000-0x0000000000419000-memory.dmp

Filesize
4KB

Download
memory/1624-8-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-5-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-7-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-14-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-12-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-11-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-10-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-3-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-6-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-4-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-13-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/1624-16-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download
memory/1624-17-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1624-2-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2264-41-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2264-43-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2540-44-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2540-45-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/2540-46-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing