Overview

overview

10

Static

static

8

Private do...66.xls

windows7_x64

10

Private do...66.xls

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    12-05-2021 15:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Private document 866.xls

  • Size

    277KB

  • MD5

    c527325d4d0b51734637b5344a3df760

  • SHA1

    f71b0baa85537ec1709701f39e8e9fd95f9b3d62

  • SHA256

    468cd4b5d89425cd29bb028696804ed339eb2c0c37b010b62442fbb5a8f778ba

  • SHA512

    074cfe3ecc88e982a704e979a3d63a7c286a30c8656dc71cf528336c7862090cdd134ebf641d336b0b7b6092838b007649bead23fe4cc1039a0a5611dc61f18c

Score
10/10
trickbotnet15bankertrojan

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://koneckotechnology.com/netmons.dll

Extracted

Family

trickbot

Version

2000029

Botnet

net15

C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443
Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Templ.dll packer 3 IoCs

    Detects Templ.dll packer which usually loads Trickbot.

  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Private document 866.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 ..\hsdksksk.iem,StartW
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:948
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
      PID:1328
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:1008

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\hsdksksk.iem
        MD5

        3bb9fe6b7e6b4d9c3a3c83de6aacd952

        SHA1

        57c343ae5e95fe702b759737522e85fe9e97fe5e

        SHA256

        697dea4b154178e8de096c66167b539aa4465155d294b11765f1a1886eb7c56d

        SHA512

        1e98417c6c48e0bf405ae5feda4193c91a3b385f387f33d79fba3dc6f7aa7571444885e6628b7ca6075887bfbec3bd17e0782c11a1c45a7d4b1a139849ca4df0

        Download Submit
      • \Users\Admin\hsdksksk.iem
        MD5

        3bb9fe6b7e6b4d9c3a3c83de6aacd952

        SHA1

        57c343ae5e95fe702b759737522e85fe9e97fe5e

        SHA256

        697dea4b154178e8de096c66167b539aa4465155d294b11765f1a1886eb7c56d

        SHA512

        1e98417c6c48e0bf405ae5feda4193c91a3b385f387f33d79fba3dc6f7aa7571444885e6628b7ca6075887bfbec3bd17e0782c11a1c45a7d4b1a139849ca4df0

        Download Submit
      • memory/540-70-0x00000000003C0000-0x00000000003F7000-memory.dmp
        Filesize

        220KB

        Download
      • memory/540-76-0x0000000000251000-0x0000000000253000-memory.dmp
        Filesize

        8KB

        Download
      • memory/540-64-0x0000000075971000-0x0000000075973000-memory.dmp
        Filesize

        8KB

        Download
      • memory/540-75-0x0000000000400000-0x0000000000411000-memory.dmp
        Filesize

        68KB

        Download
      • memory/540-63-0x0000000000000000-mapping.dmp
        Download
      • memory/540-67-0x0000000000380000-0x00000000003B9000-memory.dmp
        Filesize

        228KB

        Download
      • memory/540-73-0x0000000002090000-0x00000000020D3000-memory.dmp
        Filesize

        268KB

        Download
      • memory/540-72-0x0000000000210000-0x0000000000246000-memory.dmp
        Filesize

        216KB

        Download
      • memory/948-74-0x0000000000000000-mapping.dmp
        Download
      • memory/948-77-0x00000000000E0000-0x0000000000108000-memory.dmp
        Filesize

        160KB

        Download
      • memory/948-78-0x0000000000190000-0x0000000000191000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1676-60-0x000000002FAC1000-0x000000002FAC4000-memory.dmp
        Filesize

        12KB

        Download
      • memory/1676-61-0x00000000716F1000-0x00000000716F3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1676-62-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1676-79-0x0000000005510000-0x000000000615A000-memory.dmp
        Filesize

        12.3MB

        Download