Analysis
-
max time kernel
139s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-12-2020 20:52
Behavioral task
behavioral1
Sample
1_4_3.xls
Resource
win7v20201028
General
-
Target
1_4_3.xls
-
Size
270KB
-
MD5
890522e2846bc9ae0ee808db164ccdb5
-
SHA1
36b93a892a6f57abec6c40268ff9101ac45a0ca8
-
SHA256
a612370e45b7c1121a2ab805c05e67722070d4a9d553d4f1dfb1ddb6f1073567
-
SHA512
0d1241bf55d42513d11fdbff65a427c47a85db18185dcee3bbb9a1b9abf6c9cb4763d92812550cd59817e62744fd0ec955067a4a15925f0293ad36176d6c385d
Malware Config
Extracted
trickbot
1000508
yas31
164.132.255.19:443
188.119.113.114:443
176.119.159.147:443
51.254.164.243:443
178.156.202.251:443
185.234.72.24:443
194.5.250.52:443
217.12.209.244:443
185.99.2.123:443
185.198.57.75:443
93.189.42.81:443
148.251.185.186:443
79.137.101.2:443
51.89.115.121:443
91.200.100.84:443
194.5.250.69:443
185.14.30.45:443
185.99.2.142:443
107.175.133.162:443
5.196.247.14:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449
-
autorunName:pwgrab
Signatures
-
Dave packer 1 IoCs
Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.
Processes:
resource yara_rule behavioral2/memory/4060-6-0x00000000005E0000-0x0000000000612000-memory.dmp dave -
Executes dropped EXE 1 IoCs
Processes:
zvkFulz.exepid process 4060 zvkFulz.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3992 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
zvkFulz.exepid process 4060 zvkFulz.exe 4060 zvkFulz.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1564 wermgr.exe Token: SeDebugPrivilege 1564 wermgr.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEzvkFulz.exedescription pid process target process PID 3992 wrote to memory of 4060 3992 EXCEL.EXE zvkFulz.exe PID 3992 wrote to memory of 4060 3992 EXCEL.EXE zvkFulz.exe PID 3992 wrote to memory of 4060 3992 EXCEL.EXE zvkFulz.exe PID 4060 wrote to memory of 1564 4060 zvkFulz.exe wermgr.exe PID 4060 wrote to memory of 1564 4060 zvkFulz.exe wermgr.exe PID 4060 wrote to memory of 1564 4060 zvkFulz.exe wermgr.exe PID 4060 wrote to memory of 1564 4060 zvkFulz.exe wermgr.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1_4_3.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\zvkFulz.exe"C:\ProgramData\zvkFulz.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\zvkFulz.exeMD5
bb26e8f3b11e530bd1312aa63fa7e629
SHA176997a0c737d54b68ecc8695d788b4324acd79f4
SHA2561e067d89007672c1ed1ed2a88519393ef3a6c8b3405205d520d93374c1d73dd4
SHA512160be1ad3b24b49a39326de28b0983233ca139a17a3bea7263787e1b90c24e227a99b6890b98d8037542430621a6e786f81c71864c75a3aad25d09fcc85192d8
-
C:\ProgramData\zvkFulz.exeMD5
bb26e8f3b11e530bd1312aa63fa7e629
SHA176997a0c737d54b68ecc8695d788b4324acd79f4
SHA2561e067d89007672c1ed1ed2a88519393ef3a6c8b3405205d520d93374c1d73dd4
SHA512160be1ad3b24b49a39326de28b0983233ca139a17a3bea7263787e1b90c24e227a99b6890b98d8037542430621a6e786f81c71864c75a3aad25d09fcc85192d8
-
memory/1564-8-0x0000000000000000-mapping.dmp
-
memory/3992-2-0x00007FFC33A00000-0x00007FFC34037000-memory.dmpFilesize
6.2MB
-
memory/4060-3-0x0000000000000000-mapping.dmp
-
memory/4060-6-0x00000000005E0000-0x0000000000612000-memory.dmpFilesize
200KB
-
memory/4060-7-0x0000000000780000-0x00000000007AF000-memory.dmpFilesize
188KB