trickbot | 0301ceff4ae136d0e349a096fdbb77617ac2d15e318a5846ccf52e91ecbaa2bc

General

Target
quicktime242777.doc
Size 761KB
Sample201023-hflamh7vqx
SHA256 0301ceff4ae136d0e349a096fdbb77617ac2d15e318a5846ccf52e91ecbaa2bc
MD5 e256c24841bf35e3eca2a914d3c5c2ea
SHA1 f21c03fcf766455d820a67cfec35821d0ff4db18
SHA512 0e2aafeb78fa551bd18238c2d20356278cda894da21cc29d0b18d509b68cf580c4ce958b10c2a64e42471b4cda23b821df717a29acf00212364203c7ac2ddfda
MD5 SHA1 SHA512

Score

10^/10

trojan banker trickbot

Malware Config

Extracted

Family

trickbot

Version

2000014

Botnet

ono92

C2

103.127.165.250:449
103.109.78.174:449
199.38.120.89:449
103.206.128.121:449
199.38.120.91:443
199.38.121.150:443
199.38.123.58:443
208.86.162.215:443
208.86.161.113:443
208.86.162.241:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3920	1568	explorer.exe	65

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Loads dropped DLL 1 IoCs

pid	Process
1428	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	ipinfo.io

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1568	WINWORD.EXE
1568	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	wermgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE
1568	WINWORD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 3920	1568	WINWORD.EXE	75
PID 1568 wrote to memory of 3920	1568	WINWORD.EXE	75
PID 216 wrote to memory of 3304	216	explorer.exe	77
PID 216 wrote to memory of 3304	216	explorer.exe	77
PID 3304 wrote to memory of 3784	3304	WScript.exe	81
PID 3304 wrote to memory of 3784	3304	WScript.exe	81
PID 3784 wrote to memory of 1428	3784	Rundll32.exe	82
PID 3784 wrote to memory of 1428	3784	Rundll32.exe	82
PID 3784 wrote to memory of 1428	3784	Rundll32.exe	82
PID 1428 wrote to memory of 2180	1428	rundll32.exe	83
PID 1428 wrote to memory of 2180	1428	rundll32.exe	83
PID 1428 wrote to memory of 2180	1428	rundll32.exe	83
PID 1428 wrote to memory of 2180	1428	rundll32.exe	83

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\quicktime242777.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\explorer.exe
  explorer c:\Earth\ConvertShort.vbe
  2⤵
  - Process spawned unexpected child process
  PID:3920

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Earth\ConvertShort.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\System32\Rundll32.exe
    Rundll32.exe C:\Earth\ContactManager.dll,DllRegisterServer
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\SysWOW64\rundll32.exe
      Rundll32.exe C:\Earth\ContactManager.dll,DllRegisterServer
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\Windows\system32\wermgr.exe
        
        C:\Windows\system32\wermgr.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-14-0x0000000004A30000-0x0000000004A67000-memory.dmp

Download

memory/1428-15-0x0000000004A70000-0x0000000004AA6000-memory.dmp

Download

memory/1568-0-0x00007FFD22960000-0x00007FFD23026000-memory.dmp

Download

memory/1568-3-0x00000299F0218000-0x00000299F0282000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads