Overview

overview

10

Static

static

8

4135b0a92b...03.xls

windows7_x64

10

4135b0a92b...03.xls

windows10_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-12-2020 20:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4135b0a92b446582588230a68d2bafe64196e41284a19c04de27be091513fe03.xls

  • Size

    62KB

  • MD5

    39eb52a7ff92ab88d45f9645f12c42e7

  • SHA1

    fa9c3ef6c474b90c67149a3be4bf6916fd48fb31

  • SHA256

    4135b0a92b446582588230a68d2bafe64196e41284a19c04de27be091513fe03

  • SHA512

    ed752b7f74863a962bd52753a6b4fc3d9f5887690a0ffeb05c5c76e10fb0433374ba43e084863cefaf52bc39ea0e71e2ebb4bd669bab9d764c996313f091fa47

Score
10/10
trickbotrob12bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100004

Botnet

rob12

C2

103.250.70.163:443

181.196.24.6:443

103.87.25.220:443

2.179.73.140:443

118.69.133.4:443

202.62.47.109:443

14.102.109.190:443

103.78.81.5:443

116.0.54.227:443

36.94.193.167:443

194.5.179.82:443

213.235.183.78:443

103.52.47.20:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4135b0a92b446582588230a68d2bafe64196e41284a19c04de27be091513fe03.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 C:\LotWin\LotWin2\Horsew.dll,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32 C:\LotWin\LotWin2\Horsew.dll,DllRegisterServer
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Windows\system32\wermgr.exe
          C:\Windows\system32\wermgr.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\LotWin\LotWin2\Horsew.dll
    MD5

    6ba50bda02b9365981bccea9125e395a

    SHA1

    d636d8c87aa5fcd68b2cddaac5838a68812287f8

    SHA256

    6c8666b3b262f09600f20d751bd418f0e0d3a232e49b6c0cec75abb6f7174854

    SHA512

    af72b882a79476d008c912838f94ad5de2026235107f6baf842c86a88f8dd07ee67ccd475707090e556c2460f71cb172d7728babb41b1a048536a0716b485da0

    Download Submit
  • \LotWin\LotWin2\Horsew.dll
    MD5

    6ba50bda02b9365981bccea9125e395a

    SHA1

    d636d8c87aa5fcd68b2cddaac5838a68812287f8

    SHA256

    6c8666b3b262f09600f20d751bd418f0e0d3a232e49b6c0cec75abb6f7174854

    SHA512

    af72b882a79476d008c912838f94ad5de2026235107f6baf842c86a88f8dd07ee67ccd475707090e556c2460f71cb172d7728babb41b1a048536a0716b485da0

    Download Submit
  • memory/756-2-0x00007FFFD2340000-0x00007FFFD2977000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1764-9-0x0000000000000000-mapping.dmp
    Download
  • memory/2792-3-0x0000000000000000-mapping.dmp
    Download
  • memory/4020-5-0x0000000000000000-mapping.dmp
    Download
  • memory/4020-7-0x0000000001270000-0x00000000012A9000-memory.dmp
    Filesize

    228KB

    Download
  • memory/4020-8-0x00000000012B0000-0x00000000012E8000-memory.dmp
    Filesize

    224KB

    Download