Overview

overview

10

Static

static

10

Default

windows10_x64

10

Resubmissions

27-11-2020 08:23

201127-pt38vhxcwe 10

27-11-2020 03:11

201127-zasa4pkxvs 10

Analysis

  • max time kernel
    300s
  • max time network
    296s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    27-11-2020 03:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1_4_3.xls

  • Size

    270KB

  • MD5

    890522e2846bc9ae0ee808db164ccdb5

  • SHA1

    36b93a892a6f57abec6c40268ff9101ac45a0ca8

  • SHA256

    a612370e45b7c1121a2ab805c05e67722070d4a9d553d4f1dfb1ddb6f1073567

  • SHA512

    0d1241bf55d42513d11fdbff65a427c47a85db18185dcee3bbb9a1b9abf6c9cb4763d92812550cd59817e62744fd0ec955067a4a15925f0293ad36176d6c385d

Score
10/10
trickbotyas31bankerdavespywaretrojan

Malware Config

Extracted

Family

trickbot

Version

1000508

Botnet

yas31

C2

164.132.255.19:443

188.119.113.114:443

176.119.159.147:443

51.254.164.243:443

178.156.202.251:443

185.234.72.24:443

194.5.250.52:443

217.12.209.244:443

185.99.2.123:443

185.198.57.75:443

93.189.42.81:443

148.251.185.186:443

79.137.101.2:443

51.89.115.121:443

91.200.100.84:443

194.5.250.69:443

185.14.30.45:443

185.99.2.142:443

107.175.133.162:443

5.196.247.14:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Dave packer 1 IoCs

    Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

    dave
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1_4_3.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\ProgramData\zvkFulz.exe
      "C:\ProgramData\zvkFulz.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3616
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\zvkFulz.exe
    MD5

    77a77a822913d06e366eceac8fb3a036

    SHA1

    9a33cfc1d1be4bf40e1f7e47e55e28c43ea737fd

    SHA256

    c9c1eeaaee5a2d6f0f1d7771b2c0fe2520a363d9942b56d85503485adcf8cb00

    SHA512

    5d88306fd526829db38d4a606c7132848d719e494034c5df7a56280f89175903ef794fbcc07a2a6be0c7fb5ef36720ac53f7a5d4bc76f793e2ff2936fe9cd856

    Download Submit
  • C:\ProgramData\zvkFulz.exe
    MD5

    77a77a822913d06e366eceac8fb3a036

    SHA1

    9a33cfc1d1be4bf40e1f7e47e55e28c43ea737fd

    SHA256

    c9c1eeaaee5a2d6f0f1d7771b2c0fe2520a363d9942b56d85503485adcf8cb00

    SHA512

    5d88306fd526829db38d4a606c7132848d719e494034c5df7a56280f89175903ef794fbcc07a2a6be0c7fb5ef36720ac53f7a5d4bc76f793e2ff2936fe9cd856

    Download Submit
  • memory/1192-2-0x00007FFC68C40000-0x00007FFC69277000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/3616-3-0x0000000000000000-mapping.dmp
    Download
  • memory/3616-6-0x00000000005A0000-0x00000000005D2000-memory.dmp
    Filesize

    200KB

    Download
  • memory/3616-7-0x0000000000720000-0x000000000074F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/3768-8-0x0000000000000000-mapping.dmp
    Download