trickbot | a612370e45b7c1121a2ab805c05e67722070d4a9d553d4f1dfb1ddb6f1073567

General

Target

1_4_3.xls
Size

270KB
MD5

890522e2846bc9ae0ee808db164ccdb5
SHA1

36b93a892a6f57abec6c40268ff9101ac45a0ca8
SHA256

a612370e45b7c1121a2ab805c05e67722070d4a9d553d4f1dfb1ddb6f1073567
SHA512

0d1241bf55d42513d11fdbff65a427c47a85db18185dcee3bbb9a1b9abf6c9cb4763d92812550cd59817e62744fd0ec955067a4a15925f0293ad36176d6c385d

Score

10^/10

trickbot yas31 banker dave trojan

Malware Config

Extracted

Family

trickbot

Version

1000508

Botnet

yas31

C2

164.132.255.19:443

188.119.113.114:443

176.119.159.147:443

51.254.164.243:443

178.156.202.251:443

185.234.72.24:443

194.5.250.52:443

217.12.209.244:443

185.99.2.123:443

185.198.57.75:443

93.189.42.81:443

148.251.185.186:443

79.137.101.2:443

51.89.115.121:443

91.200.100.84:443

194.5.250.69:443

185.14.30.45:443

185.99.2.142:443

107.175.133.162:443

5.196.247.14:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Dave packer 1 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

dave

Processes:

resource	yara_rule
behavioral1/memory/584-6-0x0000000000350000-0x0000000000382000-memory.dmp	dave

Executes dropped EXE 1 IoCs

Processes:

zvkFulz.exe

pid process

584 zvkFulz.exe
Loads dropped DLL 1 IoCs

Processes:

EXCEL.EXE

pid process

1972 EXCEL.EXE
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
584	zvkFulz.exe

pid	process
1972	EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1972 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

zvkFulz.exe

pid process

584 zvkFulz.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 920 wermgr.exe
Token: SeDebugPrivilege 920 wermgr.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1972 EXCEL.EXE
1972 EXCEL.EXE
1972 EXCEL.EXE

pid	process
1972	EXCEL.EXE

pid	process
584	zvkFulz.exe

description	pid	process
Token: SeDebugPrivilege	920	wermgr.exe
Token: SeDebugPrivilege	920	wermgr.exe

pid	process
1972	EXCEL.EXE
1972	EXCEL.EXE
1972	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

EXCEL.EXEzvkFulz.exe

description	pid	process	target process
PID 1972 wrote to memory of 584	1972	EXCEL.EXE	zvkFulz.exe
PID 1972 wrote to memory of 584	1972	EXCEL.EXE	zvkFulz.exe
PID 1972 wrote to memory of 584	1972	EXCEL.EXE	zvkFulz.exe
PID 1972 wrote to memory of 584	1972	EXCEL.EXE	zvkFulz.exe
PID 584 wrote to memory of 920	584	zvkFulz.exe	wermgr.exe
PID 584 wrote to memory of 920	584	zvkFulz.exe	wermgr.exe
PID 584 wrote to memory of 920	584	zvkFulz.exe	wermgr.exe
PID 584 wrote to memory of 920	584	zvkFulz.exe	wermgr.exe
PID 584 wrote to memory of 920	584	zvkFulz.exe	wermgr.exe
PID 584 wrote to memory of 920	584	zvkFulz.exe	wermgr.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\1_4_3.xls
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\ProgramData\zvkFulz.exe
"C:\ProgramData\zvkFulz.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\zvkFulz.exe
MD5
2849523aac862a70bf47efbe15a8ab24

SHA1
75e7493c0c4a4066cf8ffbc0d92a96d83b931d2f

SHA256
4d64628eed702959333373de23ee160e7f3439fd1a9924ddbba1e05d59686cfe

SHA512
e016b3b00bfe2e56866001a0c99ef4dd9a12ff7c951c51a7ecbe8c7e9d8b136594a0910298c851c62c3d482fd506da27bf13440d2697b2bacc2655fa791ff0c5

Download Submit
C:\ProgramData\zvkFulz.exe
MD5
2849523aac862a70bf47efbe15a8ab24

SHA1
75e7493c0c4a4066cf8ffbc0d92a96d83b931d2f

SHA256
4d64628eed702959333373de23ee160e7f3439fd1a9924ddbba1e05d59686cfe

SHA512
e016b3b00bfe2e56866001a0c99ef4dd9a12ff7c951c51a7ecbe8c7e9d8b136594a0910298c851c62c3d482fd506da27bf13440d2697b2bacc2655fa791ff0c5

Download Submit
\ProgramData\zvkFulz.exe
MD5
2849523aac862a70bf47efbe15a8ab24

SHA1
75e7493c0c4a4066cf8ffbc0d92a96d83b931d2f

SHA256
4d64628eed702959333373de23ee160e7f3439fd1a9924ddbba1e05d59686cfe

SHA512
e016b3b00bfe2e56866001a0c99ef4dd9a12ff7c951c51a7ecbe8c7e9d8b136594a0910298c851c62c3d482fd506da27bf13440d2697b2bacc2655fa791ff0c5

Download Submit
memory/584-4-0x0000000000000000-mapping.dmp

Download
memory/584-6-0x0000000000350000-0x0000000000382000-memory.dmp

Filesize
200KB

Download
memory/584-7-0x00000000003C0000-0x00000000003EF000-memory.dmp

Filesize
188KB

Download
memory/920-8-0x0000000000000000-mapping.dmp

Download
memory/1944-2-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads