Analysis
-
max time kernel
136s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-02-2021 06:30
Behavioral task
behavioral1
Sample
Attach_589256204_214472970.xls
Resource
win7v20201028
General
-
Target
Attach_589256204_214472970.xls
-
Size
141KB
-
MD5
fa7354227422a339d34d662839e0aee2
-
SHA1
09c5bb8db08c53f00745262ba414fa093d6dd7f9
-
SHA256
d70803dc31e45825416b5391969ab9042baa17c01e080382a4340cef54090c84
-
SHA512
48db1f5701e12f2e2cebc6aa852673d1a93598ed77c93dc6251270824fb11ac958315c8f3443edf2329c096b0149cdce48d94c30556113d9606df8856f5e8c43
Malware Config
Extracted
trickbot
2000026
rob16
154.79.252.132:449
179.191.108.58:449
200.6.169.124:443
103.76.20.226:443
80.78.77.116:449
80.78.75.246:443
45.234.248.66:449
187.190.116.59:443
185.234.72.84:443
36.94.202.131:443
103.91.244.102:449
168.232.188.88:449
103.73.101.98:449
173.81.4.147:449
202.142.151.190:449
118.67.216.238:449
108.170.20.72:443
85.159.214.61:443
36.92.93.5:449
79.122.166.236:449
201.184.190.59:449
111.235.66.83:443
187.19.200.154:449
186.195.199.238:449
103.84.164.87:443
117.212.193.62:449
190.152.71.230:443
37.235.230.123:449
103.119.117.42:443
177.47.88.62:443
103.146.2.152:449
102.164.211.138:449
182.48.66.106:443
178.54.230.164:443
221.176.88.201:449
167.179.194.205:443
179.60.243.52:443
-
autorunName:pwgrab
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2092 4772 rundll32.exe EXCEL.EXE -
Templ.dll packer 1 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral2/memory/2068-11-0x0000000002E00000-0x0000000002E37000-memory.dmp templ_dll -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2068 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4772 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1728 wermgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4772 EXCEL.EXE 4772 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE 4772 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exedescription pid process target process PID 4772 wrote to memory of 2092 4772 EXCEL.EXE rundll32.exe PID 4772 wrote to memory of 2092 4772 EXCEL.EXE rundll32.exe PID 2092 wrote to memory of 2068 2092 rundll32.exe rundll32.exe PID 2092 wrote to memory of 2068 2092 rundll32.exe rundll32.exe PID 2092 wrote to memory of 2068 2092 rundll32.exe rundll32.exe PID 2068 wrote to memory of 1728 2068 rundll32.exe wermgr.exe PID 2068 wrote to memory of 1728 2068 rundll32.exe wermgr.exe PID 2068 wrote to memory of 1728 2068 rundll32.exe wermgr.exe PID 2068 wrote to memory of 1728 2068 rundll32.exe wermgr.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Attach_589256204_214472970.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\TDCS.OKDFR,DllRegisterServer12⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\TDCS.OKDFR,DllRegisterServer13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\TDCS.OKDFRMD5
884dab96c679194fc5140322d5ce9e9d
SHA1e7277a259a6f05bb74c14324f97b9513c8d4d9e5
SHA2565b6661b43c17ad12172c4327aa4b79be8bcf1c421cb08d6bff19f7e26282e9d8
SHA512b3c18425d6c6712f7e7c31909af128628aa95af55f1de7632399276b630e8be9448fb10d5c29e77ac83522bf130e34cd1a3a7ad5875876a60e5a3069e7340b30
-
\Users\Admin\TDCS.OKDFRMD5
884dab96c679194fc5140322d5ce9e9d
SHA1e7277a259a6f05bb74c14324f97b9513c8d4d9e5
SHA2565b6661b43c17ad12172c4327aa4b79be8bcf1c421cb08d6bff19f7e26282e9d8
SHA512b3c18425d6c6712f7e7c31909af128628aa95af55f1de7632399276b630e8be9448fb10d5c29e77ac83522bf130e34cd1a3a7ad5875876a60e5a3069e7340b30
-
memory/1728-16-0x0000013A1D2D0000-0x0000013A1D2F8000-memory.dmpFilesize
160KB
-
memory/1728-17-0x0000013A1D3E0000-0x0000013A1D3E1000-memory.dmpFilesize
4KB
-
memory/1728-12-0x0000000000000000-mapping.dmp
-
memory/2068-13-0x00000000030D0000-0x0000000003111000-memory.dmpFilesize
260KB
-
memory/2068-9-0x0000000000000000-mapping.dmp
-
memory/2068-11-0x0000000002E00000-0x0000000002E37000-memory.dmpFilesize
220KB
-
memory/2068-14-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/2068-15-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/2092-7-0x0000000000000000-mapping.dmp
-
memory/4772-6-0x00007FFF21F30000-0x00007FFF21F40000-memory.dmpFilesize
64KB
-
memory/4772-5-0x00007FFF46210000-0x00007FFF46847000-memory.dmpFilesize
6.2MB
-
memory/4772-2-0x00007FFF21F30000-0x00007FFF21F40000-memory.dmpFilesize
64KB
-
memory/4772-4-0x00007FFF21F30000-0x00007FFF21F40000-memory.dmpFilesize
64KB
-
memory/4772-3-0x00007FFF21F30000-0x00007FFF21F40000-memory.dmpFilesize
64KB