trickbot | a95ce1288d1f507831a7c257d2ee148f8fffbe4690e2a8dc8d96ce4886e094a1

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
Size

335KB
MD5

c5d25323ff2485599bc5eb6646ea246e
SHA1

14066b1de7794e035f80aefd96b2a0ec48525e4a
SHA256

a95ce1288d1f507831a7c257d2ee148f8fffbe4690e2a8dc8d96ce4886e094a1
SHA512

71f3c0efb9139b41d21f8d190b1be3791da1e3e3610e15cc4ac193be1afd9200aac9663f9af62f885581d0128accff5c8b53076467f03a12db5cad7d5e8b00a1
SSDEEP

6144:nbaydxXqngWpKN+rbZnLrL2Mu1bUlhX0FZ9IhzM9oo6dWcB:nbDxXPWpKN+hjvoqhVUVa

Score

10^/10

trickbot lib242 banker discovery persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000209

Botnet

lib242

188.124.167.132:449

93.109.242.134:443

41.211.9.226:443

158.58.131.54:443

36.74.100.211:449

87.255.24.238:449

200.111.167.227:449

109.86.227.152:443

85.172.38.59:449

190.4.189.129:443

65.30.201.40:443

66.232.212.59:443

80.53.57.146:443

182.253.210.130:449

155.133.31.21:449

94.112.52.197:449

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 6 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4068-0-0x0000000000400000-0x000000000043C000-memory.dmp	trickbot_loader32
behavioral2/memory/4068-1-0x0000000000400000-0x000000000043C000-memory.dmp	trickbot_loader32
behavioral2/memory/4068-6-0x0000000000400000-0x000000000043C000-memory.dmp	trickbot_loader32
behavioral2/memory/4940-10-0x0000000000400000-0x000000000043C000-memory.dmp	trickbot_loader32
behavioral2/memory/4940-17-0x0000000000400000-0x000000000043C000-memory.dmp	trickbot_loader32
behavioral2/memory/4940-25-0x0000000000400000-0x000000000043C000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

pid	Process
3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\coplane\\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	myexternalip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3844 set thread context of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 3480 set thread context of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103

Program crash 2 IoCs

pid	pid_target	Process	procid_target
408	3844	WerFault.exe	83
4360	3480	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 3844 wrote to memory of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 3844 wrote to memory of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 3844 wrote to memory of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 3844 wrote to memory of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 3844 wrote to memory of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 3844 wrote to memory of 4068	3844	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	96
PID 4068 wrote to memory of 3480	4068	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	99
PID 4068 wrote to memory of 3480	4068	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	99
PID 4068 wrote to memory of 3480	4068	c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe	99
PID 3480 wrote to memory of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103
PID 3480 wrote to memory of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103
PID 3480 wrote to memory of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103
PID 3480 wrote to memory of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103
PID 3480 wrote to memory of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103
PID 3480 wrote to memory of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103
PID 3480 wrote to memory of 4940	3480	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	103
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105
PID 4940 wrote to memory of 3060	4940	c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
    C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
      "C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Adds Run key to start application
        
        PID:3060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 268
      4⤵
      Program crash
      PID:4360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 260
  2⤵
  - Program crash
  PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3844 -ip 3844
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3480 -ip 3480
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

Filesize
335KB

MD5
c5d25323ff2485599bc5eb6646ea246e

SHA1
14066b1de7794e035f80aefd96b2a0ec48525e4a

SHA256
a95ce1288d1f507831a7c257d2ee148f8fffbe4690e2a8dc8d96ce4886e094a1

SHA512
71f3c0efb9139b41d21f8d190b1be3791da1e3e3610e15cc4ac193be1afd9200aac9663f9af62f885581d0128accff5c8b53076467f03a12db5cad7d5e8b00a1

Download Submit
memory/3060-18-0x00000288568F0000-0x00000288568F1000-memory.dmp

Filesize
4KB

Download
memory/3060-35-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3060-20-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/3060-16-0x0000000140000000-0x0000000140035000-memory.dmp

Filesize
212KB

Download
memory/4068-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4068-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4068-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4940-12-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4940-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4940-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4940-11-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4940-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4940-27-0x0000000002460000-0x000000000251E000-memory.dmp

Filesize
760KB

Download
memory/4940-28-0x0000000002520000-0x00000000027E9000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads