trickbot | d3bb47fb961a415f8adc37b8154c42ee2214cd81c8fcb56982980eacd3b6ea86

General

Target

566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe
Size

332KB
MD5

566e13e8c5d8ed5c97d9162c4c6ba5d0
SHA1

f09dbdba1c53a02c416620c9ca07f7e517076677
SHA256

d3bb47fb961a415f8adc37b8154c42ee2214cd81c8fcb56982980eacd3b6ea86
SHA512

13a75d9875ca31a67401470228f9aba44cbb5883d8692ca193b6b3eef8f6e7777f461df2ee53a4a8de986116bb857672684ed16e7d416efaae83fc1bf2a8d972
SSDEEP

6144:50Xc85ziBHz6lDiBo8jcdMheQ/Qj4tcmMpcG3C6YFlfTNU:50XciziBT6u3YdM0Ae41MpcG3Q6

Score

10^/10

trickbot lib359 banker discovery persistence trojan

Malware Config

Extracted

Family

trickbot

Version

1000305

Botnet

lib359

C2

188.68.208.240:443

24.247.181.155:449

174.105.235.178:449

188.68.211.126:443

181.113.17.230:449

174.105.233.82:449

71.14.129.8:449

216.183.62.43:449

42.115.91.177:443

137.74.151.18:443

71.94.101.25:443

206.130.141.255:449

92.38.163.39:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

64.203.225.216:449

213.183.63.245:443

103.110.91.118:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

pid process

4224 677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

pid	process
4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\vrssit\677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\vrssit\\677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 icanhazip.com

flow	ioc
28	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

pid	process
4612	566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe
4612	566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe
4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe
4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

description	pid	process	target process
PID 4612 wrote to memory of 4224	4612	566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe
PID 4612 wrote to memory of 4224	4612	566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe
PID 4612 wrote to memory of 4224	4612	566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe
PID 4224 wrote to memory of 452	4224	677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Roaming\vrssit\677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\vrssit\677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Adds Run key to start application
    PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vrssit\677e13e9c6d9ed6c98d9172c4c7ba6d0_KaffaDaket119.exe

Filesize
332KB

MD5
566e13e8c5d8ed5c97d9162c4c6ba5d0

SHA1
f09dbdba1c53a02c416620c9ca07f7e517076677

SHA256
d3bb47fb961a415f8adc37b8154c42ee2214cd81c8fcb56982980eacd3b6ea86

SHA512
13a75d9875ca31a67401470228f9aba44cbb5883d8692ca193b6b3eef8f6e7777f461df2ee53a4a8de986116bb857672684ed16e7d416efaae83fc1bf2a8d972

Download Submit
memory/452-63-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/452-50-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/452-49-0x0000021918B80000-0x0000021918B81000-memory.dmp

Filesize
4KB

Download
memory/452-48-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/4224-57-0x0000000003680000-0x0000000003949000-memory.dmp

Filesize
2.8MB

Download
memory/4224-56-0x00000000035C0000-0x000000000367E000-memory.dmp

Filesize
760KB

Download
memory/4224-43-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4224-44-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4224-42-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4612-13-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-11-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-7-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-6-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-5-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-4-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-19-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4612-9-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-10-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-8-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-12-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-3-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-14-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-15-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-16-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4612-18-0x000000000040F000-0x0000000000410000-memory.dmp

Filesize
4KB

Download
memory/4612-17-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads