trickbot | 2eba29b98da83f9bdb340294baa41f3aeaf3eb3ec022e432fc0df32cd331fbc0

General

Target

368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe
Size

912KB
MD5

368ad4641b504495795ef0406a1d1fa8
SHA1

7fba56b4200a24257b579e6c5385b75c6fd0c056
SHA256

2eba29b98da83f9bdb340294baa41f3aeaf3eb3ec022e432fc0df32cd331fbc0
SHA512

e198f2a791bb445433628b9bb4a19ed80878926b893788216c2cc4370e2c11dfaf33163144dffa8b2b050e7d12cd520843b9ad397fb5689dcf1f0c1bf20fc61f
SSDEEP

12288:e0vUJk88BBAL0toWye2eZ4OTjwkwclwo8v1jBq9kKj7Nivzqg:2JkRBALfWye2er556XFBqnj7G+g

Score

10^/10

trickbot tot39 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000025

Botnet

tot39

C2

134.119.186.200:443

45.14.226.115:443

85.204.116.134:443

45.89.127.240:443

195.123.241.195:443

188.34.142.248:443

185.234.72.84:443

108.170.20.72:443

94.158.245.54:443

134.119.186.201:443

45.83.129.224:443

85.93.159.98:449

92.242.214.203:449

202.21.103.194:449

169.239.45.42:449

45.234.248.66:449

103.91.244.102:449

118.67.216.238:449

117.212.193.62:449

201.184.190.59:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Executes dropped EXE 1 IoCs

pid	Process
1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DinoComp\368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\DinoComp\368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	wermgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2152	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe
2152	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe
1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe
1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1960	2152	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	86
PID 2152 wrote to memory of 1960	2152	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	86
PID 2152 wrote to memory of 1960	2152	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	86
PID 1960 wrote to memory of 2060	1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	87
PID 1960 wrote to memory of 2060	1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	87
PID 1960 wrote to memory of 3020	1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	88
PID 1960 wrote to memory of 3020	1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	88
PID 1960 wrote to memory of 3020	1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	88
PID 1960 wrote to memory of 3020	1960	368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\DinoComp\368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe
  "C:\Program Files (x86)\DinoComp\368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:2060
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DinoComp\368ad4641b504495795ef0406a1d1fa8_JaffaCakes118.exe

Filesize
912KB

MD5
368ad4641b504495795ef0406a1d1fa8

SHA1
7fba56b4200a24257b579e6c5385b75c6fd0c056

SHA256
2eba29b98da83f9bdb340294baa41f3aeaf3eb3ec022e432fc0df32cd331fbc0

SHA512
e198f2a791bb445433628b9bb4a19ed80878926b893788216c2cc4370e2c11dfaf33163144dffa8b2b050e7d12cd520843b9ad397fb5689dcf1f0c1bf20fc61f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-47134698-4092160662-1261813102-1000\0f5007522459c86e95ffcc62f32308f1_58a5be6a-fbdc-4fe6-8f93-5aa44c9d3351

Filesize
1KB

MD5
6f4b97e02fec06393c662df0988716e0

SHA1
4e76bfd81a016c2780f0bf1b4ca193c3abd1849b

SHA256
76ad6d180822904369f13887adbb3087004a4400c351edff45038c34cf1636c2

SHA512
a594f9f87ef60f9ead4b9b89c08f64779cd014bba4b5dbb67c529093c6d4fd089f98671adcbd0cd2e4696b558d272af515331874b70f68236c55a26896eb0824

Download Submit
memory/1960-30-0x0000000004230000-0x0000000004313000-memory.dmp

Filesize
908KB

Download
memory/1960-27-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1960-39-0x0000000004230000-0x0000000004313000-memory.dmp

Filesize
908KB

Download
memory/1960-33-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1960-22-0x0000000002470000-0x00000000024A4000-memory.dmp

Filesize
208KB

Download
memory/1960-23-0x0000000002470000-0x00000000024A4000-memory.dmp

Filesize
208KB

Download
memory/1960-18-0x0000000002430000-0x0000000002468000-memory.dmp

Filesize
224KB

Download
memory/1960-32-0x0000000002470000-0x00000000024A4000-memory.dmp

Filesize
208KB

Download
memory/1960-26-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2152-9-0x00000000026C0000-0x00000000026F4000-memory.dmp

Filesize
208KB

Download
memory/2152-24-0x0000000004070000-0x0000000004153000-memory.dmp

Filesize
908KB

Download
memory/2152-3-0x0000000002680000-0x00000000026B8000-memory.dmp

Filesize
224KB

Download
memory/2152-25-0x00000000026C0000-0x00000000026F4000-memory.dmp

Filesize
208KB

Download
memory/2152-7-0x0000000002640000-0x0000000002676000-memory.dmp

Filesize
216KB

Download
memory/2152-8-0x00000000026C0000-0x00000000026F4000-memory.dmp

Filesize
208KB

Download
memory/3020-28-0x0000026413350000-0x0000026413351000-memory.dmp

Filesize
4KB

Download
memory/3020-29-0x00000264131B0000-0x00000264131D7000-memory.dmp

Filesize
156KB

Download
memory/3020-34-0x00000264131B0000-0x00000264131D7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing