trickbot | def9411f8ed86b0b056311aab1647747cb692c111919e7ead29e70d583dbf61f

General

Target

289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
Size

400KB
MD5

289c70c2097900b5797622e1802e649d
SHA1

3dd51cb8e4ba7f430c9a6fd010bb58964737d4ea
SHA256

def9411f8ed86b0b056311aab1647747cb692c111919e7ead29e70d583dbf61f
SHA512

42e2eac1da09d51e15c8a6f049828c1802ff106450569dd202b28d0de95d4ca18f9e894c50f3277d2b2d28b944cbfaa9db838b78dab573e209a21f8290c45196
SSDEEP

6144:fXRY/TyW0mL1QnLSNFXI21MfCDKbGsRtdumLIs/q+xmG3SOKCtqhhl0wN:pgT/0mL1f712CD6GyDuv+SOHqhhau

Score

10^/10

trickbot tot33 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000024

Botnet

tot33

C2

85.93.159.98:449

92.242.214.203:449

202.21.103.194:449

169.239.45.42:449

45.234.248.66:449

103.91.244.102:449

118.67.216.238:449

117.212.193.62:449

201.184.190.59:449

103.29.185.138:449

79.122.166.236:449

37.143.150.186:449

179.191.108.58:449

85.159.214.61:443

149.56.80.31:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

pid process

3444 289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

pid	process
3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

Processes:

289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1948	2684	WerFault.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
2620	3444	WerFault.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
4036	3444	WerFault.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 4728 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

289c70c2097900b5797622e1802e649d_JaffaCakes118.exe289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

pid process

2684 289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
3444 289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4728	wermgr.exe

pid	process
2684	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

289c70c2097900b5797622e1802e649d_JaffaCakes118.exe289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

description	pid	process	target process
PID 2684 wrote to memory of 3444	2684	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
PID 2684 wrote to memory of 3444	2684	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
PID 2684 wrote to memory of 3444	2684	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
PID 3444 wrote to memory of 4780	3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	wermgr.exe
PID 3444 wrote to memory of 4780	3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	wermgr.exe
PID 3444 wrote to memory of 4728	3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	wermgr.exe
PID 3444 wrote to memory of 4728	3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	wermgr.exe
PID 3444 wrote to memory of 4728	3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	wermgr.exe
PID 3444 wrote to memory of 4728	3444	289c70c2097900b5797622e1802e649d_JaffaCakes118.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684

C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe
"C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
PID:4780

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 636
3⤵
- Program crash
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 624
3⤵
- Program crash
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 428
2⤵
- Program crash
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2684 -ip 2684
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3444 -ip 3444
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3444 -ip 3444
1⤵
PID:3512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DC\289c70c2097900b5797622e1802e649d_JaffaCakes118.exe

Filesize
400KB

MD5
289c70c2097900b5797622e1802e649d

SHA1
3dd51cb8e4ba7f430c9a6fd010bb58964737d4ea

SHA256
def9411f8ed86b0b056311aab1647747cb692c111919e7ead29e70d583dbf61f

SHA512
42e2eac1da09d51e15c8a6f049828c1802ff106450569dd202b28d0de95d4ca18f9e894c50f3277d2b2d28b944cbfaa9db838b78dab573e209a21f8290c45196

Download Submit
memory/2684-8-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-9-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-13-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-12-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-11-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-10-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-17-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2684-5-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-7-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-6-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-4-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-2-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-3-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2684-16-0x0000000002110000-0x0000000002144000-memory.dmp

Filesize
208KB

Download
memory/2684-15-0x0000000000418000-0x0000000000419000-memory.dmp

Filesize
4KB

Download
memory/2684-14-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/3444-32-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-31-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-37-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3444-35-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-34-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-33-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-29-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-36-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-30-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-28-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-27-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-26-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/3444-25-0x00000000020F0000-0x00000000020F2000-memory.dmp

Filesize
8KB

Download
memory/4728-41-0x000001EB6E0A0000-0x000001EB6E0C7000-memory.dmp

Filesize
156KB

Download
memory/4728-40-0x000001EB6E0A0000-0x000001EB6E0C7000-memory.dmp

Filesize
156KB

Download
memory/4728-39-0x000001EB6E240000-0x000001EB6E241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads