Overview

overview

10

Static

static

8

Notificati...20.doc

windows7_x64

10

Notificati...20.doc

windows10_x64

10

Analysis

  • max time kernel
    130s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    26-08-2020 13:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Notification082520.doc

  • Size

    285KB

  • MD5

    f9cac6a43d460d5afc7428a1014a59af

  • SHA1

    e7ae3fe9226a646711c7b31593e05368b4395d2a

  • SHA256

    49a193afe2b75716f99338d1653dd321db5b0b4af3be050691605a861471be2e

  • SHA512

    c12f18c7e4fee24fdcaf145178967295c5d11d6565590cc3f3db8fbf7d30432185651151156873142e52137ac50787d8d6f9d992ec4a149cbdf3a5926b59746d

Score
10/10
trojanbankertrickbot

Malware Config

Extracted

Family

trickbot

Version

1000513

Botnet

chil103

C2

51.89.177.20:443

194.5.249.174:443

107.174.196.242:443

185.205.209.241:443

82.146.46.220:443

5.34.178.126:443

212.22.70.65:443

195.123.241.90:443

185.164.32.214:443

198.46.198.139:443

195.123.241.187:443

86.104.194.116:443

195.123.240.252:443

185.164.32.215:443

45.148.120.195:443

45.138.158.32:443

5.149.253.99:443

92.62.65.163:449

88.247.212.56:449

180.211.170.214:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Templ.dll packer 4 IoCs

    Detects Templ.dll packer which usually loads Trickbot.

  • Blacklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Notification082520.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1088
  • C:\Windows\system32\rundll32.exe
    rundll32.exe zipfldr.dll,RouteTheCall c:\syslogs\fa.vbs
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\syslogs\fa.vbs"
      2⤵
      • Blacklisted process makes network request
      PID:768
  • C:\Windows\system32\REGSVR32.exe
    REGSVR32 -s c:\syslogs\w_monitor.dll
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\SysWOW64\regsvr32.exe
      -s c:\syslogs\w_monitor.dll
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/768-5-0x0000000002670000-0x0000000002674000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1760-9-0x0000000000200000-0x000000000022E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/1760-10-0x0000000000230000-0x000000000025C000-memory.dmp

    Filesize

    176KB

    Download