trickbot | 417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe
Size

516KB
MD5

f22d9f8596255510028586249bfafc44
SHA1

e5af9bfccd9bde5bc7f06115e4142e2e0c67c45e
SHA256

417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7
SHA512

662cf8913e80781a9d0d18ca2f387b85267804d63b4db7f614d0089be6fa0264838db7af895f4bf6dff9a23734fd67d80908a98b6c16503b678faf8c0dd3d9e3
SSDEEP

12288:cbVMh0tRyr3W3S1niM+uwkMx8nXoTT0WJZmo:WMh0tRyF3lY8X2xJZmo

Score

10^/10

trickbot tot153 banker discovery trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

tot153

179.42.137.102:443

191.36.152.198:443

179.42.137.104:443

179.42.137.106:443

179.42.137.108:443

202.183.12.124:443

194.190.18.122:443

103.56.207.230:443

171.103.187.218:449

171.103.189.118:449

18.139.111.104:443

179.42.137.105:443

186.4.193.75:443

171.101.229.2:449

179.42.137.107:443

103.56.43.209:449

179.42.137.110:443

45.181.207.156:443

197.44.54.162:449

179.42.137.109:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Trickbot family
trickbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
348	1648	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	wermgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe
1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 4796	1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe	84
PID 1648 wrote to memory of 4796	1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe	84
PID 1648 wrote to memory of 2872	1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe	85
PID 1648 wrote to memory of 2872	1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe	85
PID 1648 wrote to memory of 4796	1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe	84
PID 1648 wrote to memory of 4796	1648	JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_417432fbbbc70793c5fc8ebf49fe1b242fd2c52d621325f07236f86298c196e7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\wermgr.exe
  C:\Windows\system32\wermgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 592
  2⤵
  - Program crash
  PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 1648
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/1648-4-0x0000000002240000-0x000000000227C000-memory.dmp

Filesize
240KB

Download
memory/1648-5-0x00000000026B0000-0x00000000026EB000-memory.dmp

Filesize
236KB

Download
memory/1648-6-0x00000000026B0000-0x00000000026EB000-memory.dmp

Filesize
236KB

Download
memory/1648-8-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1648-7-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1648-11-0x0000000002220000-0x0000000002233000-memory.dmp

Filesize
76KB

Download
memory/1648-12-0x00000000026B0000-0x00000000026EB000-memory.dmp

Filesize
236KB

Download
memory/4796-10-0x0000016776B80000-0x0000016776BA9000-memory.dmp

Filesize
164KB

Download
memory/4796-9-0x0000016776CF0000-0x0000016776CF1000-memory.dmp

Filesize
4KB

Download