trickbot | 394860f08ba108fbf31adeb687c911f381dced87d1fe78607546397cb78cdfb0

General

Target

March.xlsb
Size

156KB
MD5

aee94cb5bce75ff1d2e9bb2ca41b40e7
SHA1

fa7239382fb2a406efde23ab0e9ef58ef649c5d2
SHA256

394860f08ba108fbf31adeb687c911f381dced87d1fe78607546397cb78cdfb0
SHA512

f748cfb700318762bda70bb4847ddfd1dc6c6681d801d52537cf8b7f76292f92110d1f04a571f2bccf8eac608d90aa707aa18af4cdd52c743e47d8f554dba31c

Score

10^/10

trickbot mon102 banker trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://195.123.219.72/haurf/n3/n3

Extracted

Family

trickbot

Version

100013

Botnet

mon102

C2

103.225.138.94:449

122.2.28.70:449

123.200.26.246:449

131.255.106.152:449

142.112.79.223:449

154.126.176.30:449

180.92.238.186:449

187.20.217.129:449

201.20.118.122:449

202.91.41.138:449

95.210.118.90:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1728	1340	rundll32.exe	EXCEL.EXE

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Templ.dll packer 3 IoCs

Detects Templ.dll packer which usually loads Trickbot.

Processes:

resource	yara_rule
behavioral1/memory/1728-14-0x0000000000870000-0x00000000008A7000-memory.dmp	templ_dll
behavioral1/memory/1728-13-0x0000000000310000-0x0000000000349000-memory.dmp	templ_dll
behavioral1/memory/1728-16-0x00000000002D0000-0x0000000000306000-memory.dmp	templ_dll

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1728 rundll32.exe
1728 rundll32.exe
1728 rundll32.exe
1728 rundll32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
1728	rundll32.exe
1728	rundll32.exe
1728	rundll32.exe
1728	rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1340 EXCEL.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1692 wermgr.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

1340 EXCEL.EXE
1340 EXCEL.EXE
1340 EXCEL.EXE
1340 EXCEL.EXE
1340 EXCEL.EXE

pid	process
1340	EXCEL.EXE

description	pid	process
Token: SeDebugPrivilege	1692	wermgr.exe

pid	process
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

EXCEL.EXErundll32.exe

description	pid	process	target process
PID 1340 wrote to memory of 1728	1340	EXCEL.EXE	rundll32.exe
PID 1340 wrote to memory of 1728	1340	EXCEL.EXE	rundll32.exe
PID 1340 wrote to memory of 1728	1340	EXCEL.EXE	rundll32.exe
PID 1340 wrote to memory of 1728	1340	EXCEL.EXE	rundll32.exe
PID 1340 wrote to memory of 1728	1340	EXCEL.EXE	rundll32.exe
PID 1340 wrote to memory of 1728	1340	EXCEL.EXE	rundll32.exe
PID 1340 wrote to memory of 1728	1340	EXCEL.EXE	rundll32.exe
PID 1728 wrote to memory of 1040	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1040	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1040	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1040	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1692	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1692	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1692	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1692	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1692	1728	rundll32.exe	wermgr.exe
PID 1728 wrote to memory of 1692	1728	rundll32.exe	wermgr.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\March.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\ProgramData\uveoq\69.dll,DllRegisterServer1
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:1040
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\uveoq\69.dll

MD5
75378e60ba4f150d6adb5468edef655b

SHA1
51b17236d40ef2c354916d6f758191b3128bf58d

SHA256
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db

SHA512
c101fc303c3c88a982ac10324941d6b67f5b7880b3c98e4eb5a3aa1717688516e25ed70823cdacc02081ab06cc5890588aab396e4970f4c008699ce0289f1683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
aa39c2cc449d85b4cdc1570fda91e840

SHA1
8591448e069801f3afd63702a5a1021fd46ee371

SHA256
c1d8efe7c3f865dd582e58ba0b1034104dfe90758aeb8c41517201388d429cf9

SHA512
39016617261d180b662c5b68607961c2f027799f6d7c51bdf3e053c2140247a92aa3fb76dcd50494d275a67fe636ebedecc2193ddf772924cbaca5b3dd973b25

Download Submit
\ProgramData\uveoq\69.dll

MD5
75378e60ba4f150d6adb5468edef655b

SHA1
51b17236d40ef2c354916d6f758191b3128bf58d

SHA256
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db

SHA512
c101fc303c3c88a982ac10324941d6b67f5b7880b3c98e4eb5a3aa1717688516e25ed70823cdacc02081ab06cc5890588aab396e4970f4c008699ce0289f1683

Download Submit
\ProgramData\uveoq\69.dll

MD5
75378e60ba4f150d6adb5468edef655b

SHA1
51b17236d40ef2c354916d6f758191b3128bf58d

SHA256
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db

SHA512
c101fc303c3c88a982ac10324941d6b67f5b7880b3c98e4eb5a3aa1717688516e25ed70823cdacc02081ab06cc5890588aab396e4970f4c008699ce0289f1683

Download Submit
\ProgramData\uveoq\69.dll

MD5
75378e60ba4f150d6adb5468edef655b

SHA1
51b17236d40ef2c354916d6f758191b3128bf58d

SHA256
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db

SHA512
c101fc303c3c88a982ac10324941d6b67f5b7880b3c98e4eb5a3aa1717688516e25ed70823cdacc02081ab06cc5890588aab396e4970f4c008699ce0289f1683

Download Submit
\ProgramData\uveoq\69.dll

MD5
75378e60ba4f150d6adb5468edef655b

SHA1
51b17236d40ef2c354916d6f758191b3128bf58d

SHA256
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db

SHA512
c101fc303c3c88a982ac10324941d6b67f5b7880b3c98e4eb5a3aa1717688516e25ed70823cdacc02081ab06cc5890588aab396e4970f4c008699ce0289f1683

Download Submit
memory/1340-24-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1340-2-0x000000002F771000-0x000000002F774000-memory.dmp

Filesize
12KB

Download
memory/1340-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1340-3-0x00000000718D1000-0x00000000718D3000-memory.dmp

Filesize
8KB

Download
memory/1524-5-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmp

Filesize
2.5MB

Download
memory/1692-20-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/1692-21-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1692-15-0x0000000000000000-mapping.dmp

Download
memory/1728-7-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1728-18-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1728-19-0x00000000008C1000-0x00000000008C3000-memory.dmp

Filesize
8KB

Download
memory/1728-16-0x00000000002D0000-0x0000000000306000-memory.dmp

Filesize
216KB

Download
memory/1728-17-0x0000000000CC0000-0x0000000000D03000-memory.dmp

Filesize
268KB

Download
memory/1728-13-0x0000000000310000-0x0000000000349000-memory.dmp

Filesize
228KB

Download
memory/1728-22-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1728-14-0x0000000000870000-0x00000000008A7000-memory.dmp

Filesize
220KB

Download
memory/1728-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads