Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-03-2021 18:23
Behavioral task
behavioral1
Sample
case_142297110_1765967889.xlsm
Resource
win7v20201028
General
-
Target
case_142297110_1765967889.xlsm
-
Size
149KB
-
MD5
cb9f4477fbf6f33c8de41d3a2febcf0f
-
SHA1
97d398eed15462aeeaff7a7b9ef93a61fdf6370d
-
SHA256
438fc9f6931a33ae2ac94848f8b2c3876b3ddf4e4d58c5ed403ca49da3366a34
-
SHA512
b6517693a5a17270ca180c6ec0e6edea0629dbed28a69499247f0dbd2993344417d1f868afbbd8b9fdee21b6321a5ba57a31c95f5d1fc06ff13c1302f53d6969
Malware Config
Extracted
trickbot
100013
rob77
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
-
autorunName:pwgrab
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4160 4644 rundll32.exe EXCEL.EXE -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4164 rundll32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 47 ipinfo.io -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4644 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 3932 wermgr.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE 4644 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exedescription pid process target process PID 4644 wrote to memory of 4160 4644 EXCEL.EXE rundll32.exe PID 4644 wrote to memory of 4160 4644 EXCEL.EXE rundll32.exe PID 4160 wrote to memory of 4164 4160 rundll32.exe rundll32.exe PID 4160 wrote to memory of 4164 4160 rundll32.exe rundll32.exe PID 4160 wrote to memory of 4164 4160 rundll32.exe rundll32.exe PID 4164 wrote to memory of 4084 4164 rundll32.exe cmd.exe PID 4164 wrote to memory of 4084 4164 rundll32.exe cmd.exe PID 4164 wrote to memory of 4084 4164 rundll32.exe cmd.exe PID 4164 wrote to memory of 3932 4164 rundll32.exe wermgr.exe PID 4164 wrote to memory of 3932 4164 rundll32.exe wermgr.exe PID 4164 wrote to memory of 3932 4164 rundll32.exe wermgr.exe PID 4164 wrote to memory of 3932 4164 rundll32.exe wermgr.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\case_142297110_1765967889.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Krock.KOD,StartW2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\Krock.KOD,StartW3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe4⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Krock.KODMD5
8c035dd8f10db30c83018d3e874358c7
SHA17ac9fcd5225fe70fdb342584cff6728277c53379
SHA2567dce28062f5bccd0b1de6035eeb9a332d925f1f4348846b6ad17e91e4d458ec7
SHA512afe80eb15a570d8700e896b6c632e9a93548cc66315d171603eca4e4fd898fd14e834e278c150fbba29140cb6adde3676dcb3d3911d9b54b5936e25aca7a2656
-
\Users\Admin\Krock.KODMD5
8c035dd8f10db30c83018d3e874358c7
SHA17ac9fcd5225fe70fdb342584cff6728277c53379
SHA2567dce28062f5bccd0b1de6035eeb9a332d925f1f4348846b6ad17e91e4d458ec7
SHA512afe80eb15a570d8700e896b6c632e9a93548cc66315d171603eca4e4fd898fd14e834e278c150fbba29140cb6adde3676dcb3d3911d9b54b5936e25aca7a2656
-
memory/3932-15-0x000001F4B62B0000-0x000001F4B62D8000-memory.dmpFilesize
160KB
-
memory/3932-16-0x000001F4B63C0000-0x000001F4B63C1000-memory.dmpFilesize
4KB
-
memory/3932-12-0x0000000000000000-mapping.dmp
-
memory/4160-7-0x0000000000000000-mapping.dmp
-
memory/4164-11-0x0000000000790000-0x00000000007C4000-memory.dmpFilesize
208KB
-
memory/4164-9-0x0000000000000000-mapping.dmp
-
memory/4164-14-0x0000000010001000-0x0000000010003000-memory.dmpFilesize
8KB
-
memory/4164-13-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/4644-6-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB
-
memory/4644-2-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB
-
memory/4644-5-0x00007FF9C90D0000-0x00007FF9C9707000-memory.dmpFilesize
6.2MB
-
memory/4644-4-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB
-
memory/4644-3-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB