Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 19:22
Static task
static1
Behavioral task
behavioral1
Sample
Form_1099_5715537.xls
Resource
win7
General
-
Target
Form_1099_5715537.xls
-
Size
90KB
-
MD5
d1bda4049e740009dff39fe1698cb00a
-
SHA1
efc17b6d5cdd51832d90a71b7cfdea7248473d44
-
SHA256
2e0487c6cbecd68c83166ebf8742f9784be52dba4d77d37a359bacb33790cb76
-
SHA512
af682858aea2df8b9a94f97d630a4702c4c3fdb0e688f438b6495408efea3a352b6fc01427d27d17a0fe9f85c028f8ae6fa2a3653c63670c18f0ef865838db54
Malware Config
Extracted
trickbot
1000512
chil61
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
-
autorunName:pwgrab
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3556 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exedescription pid process target process PID 3848 wrote to memory of 3496 3848 EXCEL.EXE rundll32.exe PID 3848 wrote to memory of 3496 3848 EXCEL.EXE rundll32.exe PID 3496 wrote to memory of 3556 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 3556 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 3556 3496 rundll32.exe rundll32.exe PID 3556 wrote to memory of 3036 3556 rundll32.exe wermgr.exe PID 3556 wrote to memory of 3036 3556 rundll32.exe wermgr.exe PID 3556 wrote to memory of 3036 3556 rundll32.exe wermgr.exe PID 3556 wrote to memory of 3036 3556 rundll32.exe wermgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 3036 wermgr.exe Token: SeDebugPrivilege 3036 wermgr.exe Token: SeDebugPrivilege 3036 wermgr.exe -
Templ.dll packer 2 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral2/memory/3556-4-0x0000000004C10000-0x0000000004C3E000-memory.dmp templ_dll behavioral2/memory/3556-5-0x0000000010000000-0x000000001002D000-memory.dmp templ_dll -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE 3848 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3848 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3496 3848 rundll32.exe EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Form_1099_5715537.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\CMgthTu\RQrZqdh\RCjlGin.dll,DllRegisterServer2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\CMgthTu\RQrZqdh\RCjlGin.dll,DllRegisterServer3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\CMgthTu\RQrZqdh\RCjlGin.dll
-
\CMgthTu\RQrZqdh\RCjlGin.dll
-
memory/3036-6-0x0000000000000000-mapping.dmp
-
memory/3496-0-0x0000000000000000-mapping.dmp
-
memory/3556-2-0x0000000000000000-mapping.dmp
-
memory/3556-4-0x0000000004C10000-0x0000000004C3E000-memory.dmpFilesize
184KB
-
memory/3556-5-0x0000000010000000-0x000000001002D000-memory.dmpFilesize
180KB