trickbot | a3d8d5d2d43c91168b7abf1a6c5823ea9d0553f5bee6ba92574c63151d52384c

General

Target

bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe
Size

752KB
MD5

bf21064ba18c77bb0dc141385f7e4835
SHA1

1ad948b5fbdb4e18a133900af8c96260aa9557e6
SHA256

a3d8d5d2d43c91168b7abf1a6c5823ea9d0553f5bee6ba92574c63151d52384c
SHA512

1e59ba40f1a495195ccd6fc343475dbbe3e82cc7601a6ffbee7d16da9b455768a153bc6b767657dc2225c80daa4c7dbb673c1b6fa2a494cecd23d828596b571d
SSDEEP

12288:6/Krvw0dDEW3Ngj3w+uCzd+e4SvNko6xNB+yQIwQuYo5k:8KbDoj3w+uoo9xNB50Qx

Score

10^/10

trickbot banker discovery trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4952-3-0x00000000006A0000-0x00000000006CE000-memory.dmp	trickbot_loader32
behavioral2/memory/4952-2-0x0000000000670000-0x000000000069D000-memory.dmp	trickbot_loader32
behavioral2/memory/4952-0-0x00000000006A0000-0x00000000006CE000-memory.dmp	trickbot_loader32
behavioral2/memory/4952-8-0x00000000006A0000-0x00000000006CE000-memory.dmp	trickbot_loader32
behavioral2/memory/1668-11-0x0000000002190000-0x00000000021BE000-memory.dmp	trickbot_loader32
behavioral2/memory/1668-16-0x0000000002190000-0x00000000021BE000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
1668	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe
1252	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4952	bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe
1668	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe
1252	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1668	4952	bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe	94
PID 4952 wrote to memory of 1668	4952	bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe	94
PID 4952 wrote to memory of 1668	4952	bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe	94
PID 1668 wrote to memory of 1872	1668	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe	98
PID 1668 wrote to memory of 1872	1668	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe	98
PID 1668 wrote to memory of 1872	1668	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe	98
PID 1668 wrote to memory of 1872	1668	bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe
  C:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1872

C:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe
C:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe

Filesize
752KB

MD5
bf21064ba18c77bb0dc141385f7e4835

SHA1
1ad948b5fbdb4e18a133900af8c96260aa9557e6

SHA256
a3d8d5d2d43c91168b7abf1a6c5823ea9d0553f5bee6ba92574c63151d52384c

SHA512
1e59ba40f1a495195ccd6fc343475dbbe3e82cc7601a6ffbee7d16da9b455768a153bc6b767657dc2225c80daa4c7dbb673c1b6fa2a494cecd23d828596b571d

Download Submit
memory/1668-11-0x0000000002190000-0x00000000021BE000-memory.dmp

Filesize
184KB

Download
memory/1668-13-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/1668-12-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1668-16-0x0000000002190000-0x00000000021BE000-memory.dmp

Filesize
184KB

Download
memory/1872-14-0x00000244C5240000-0x00000244C5260000-memory.dmp

Filesize
128KB

Download
memory/1872-15-0x00000244C5240000-0x00000244C5260000-memory.dmp

Filesize
128KB

Download
memory/4952-3-0x00000000006A0000-0x00000000006CE000-memory.dmp

Filesize
184KB

Download
memory/4952-2-0x0000000000670000-0x000000000069D000-memory.dmp

Filesize
180KB

Download
memory/4952-0-0x00000000006A0000-0x00000000006CE000-memory.dmp

Filesize
184KB

Download
memory/4952-8-0x00000000006A0000-0x00000000006CE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing