Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 11:04
General
- Target jaffacakes118_Trojan.Win32.Yakes.wfby.exe
- Size 928KB
- Sample261012-m6abdacc66
- SHA256 098dedd2bc438068491a8a47a6fc2c786bd77ed4acafcbc7dca57b5c246430dc
Malware Config
Signatures
- Family: Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Trickbot x86 loader 11 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
- Windows security bypass 2 TTPs 2 IoCs
- Executes dropped EXE 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 31 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Yakes.wfby.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Yakes.wfby.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NetDefender\jaffacaket119_Tsojan.Win32.Yakes.wfby.exeC:\Users\Admin\AppData\Roaming\NetDefender\jaffacaket119_Tsojan.Win32.Yakes.wfby.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Windows security bypass
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\NetDefender\jaffacaket119_Tsojan.Win32.Yakes.wfby.exeC:\Users\Admin\AppData\Roaming\NetDefender\jaffacaket119_Tsojan.Win32.Yakes.wfby.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Windows security bypass
-
-
C:\Users\Admin\AppData\Roaming\NetDefender\jaffacaket119_Tsojan.Win32.Yakes.wfby.exe"C:\Users\Admin\AppData\Roaming\NetDefender\jaffacaket119_Tsojan.Win32.Yakes.wfby.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
jaffacaket119_Tsojan.Win32.Yakes.wfby.exe
memory/2388-44-0x0000000002800000-0x0000000002BA1000-memory.dmp
memory/2388-43-0x00000000022D0000-0x0000000002397000-memory.dmp
memory/2388-42-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/2388-31-0x0000000010000000-0x0000000010007000-memory.dmp
memory/2388-30-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/4200-0-0x0000000000452000-0x0000000000455000-memory.dmp
memory/4200-1-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/4200-2-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/4200-3-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/4200-6-0x0000000000452000-0x0000000000455000-memory.dmp
memory/4200-5-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/4956-18-0x00000197D1040000-0x00000197D1041000-memory.dmp
memory/4956-15-0x0000000140000000-0x000000014001F000-memory.dmp
memory/6120-28-0x0000000002980000-0x0000000002D21000-memory.dmp
memory/6120-27-0x00000000022F0000-0x00000000023B7000-memory.dmp
memory/6120-26-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/6120-17-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/6120-16-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/6120-11-0x0000000010000000-0x0000000010007000-memory.dmp
memory/6120-10-0x0000000010000000-0x0000000010007000-memory.dmp
memory/6120-19-0x0000000002280000-0x0000000002281000-memory.dmp
memory/6120-9-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/6120-7-0x0000000000400000-0x00000000004EF000-memory.dmp
memory/6120-8-0x0000000000400000-0x00000000004EF000-memory.dmp