Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 20:12
Behavioral task
behavioral1
Sample
Invoice 717.xlsb
Resource
win7v20210410
General
-
Target
Invoice 717.xlsb
-
Size
97KB
-
MD5
aae44c3735592848cee672f1b4806026
-
SHA1
52cd5e0535d6562193a84005cf0f20ed1da7f54e
-
SHA256
587ab4f5569b3d5064b93f4d8e12ff8ab7399a03a0c3304c8865db2b187b2272
-
SHA512
7f9d3aa31499086fd52c9f351d2f216f061268e2ca4dd9a4722bce8245cebc8122018a7ec221fb4e10400e04c32a6e6731e0c4e9e620a742aa6d2ce44a431e7a
Malware Config
Extracted
https://mastercarebath.com/wp-netmon.dll
Extracted
trickbot
2000029
net16
103.66.72.217:443
117.252.68.211:443
103.124.173.35:443
115.73.211.230:443
117.54.250.246:443
131.0.112.122:443
102.176.221.78:443
181.176.161.143:443
154.79.251.172:443
103.111.199.76:443
103.54.41.193:443
154.79.244.182:443
154.79.245.158:443
139.255.116.42:443
178.254.161.250:443
178.134.47.166:443
158.181.179.229:443
103.90.197.33:443
109.207.165.40:443
178.72.192.20:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 640 308 rundll32.exe EXCEL.EXE -
Templ.dll packer 3 IoCs
Detects Templ.dll packer which usually loads Trickbot.
Processes:
resource yara_rule behavioral1/memory/640-67-0x0000000000330000-0x0000000000369000-memory.dmp templ_dll behavioral1/memory/640-70-0x0000000000720000-0x0000000000757000-memory.dmp templ_dll behavioral1/memory/640-72-0x0000000000190000-0x00000000001C6000-memory.dmp templ_dll -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 640 rundll32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 308 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 632 wermgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 308 EXCEL.EXE 308 EXCEL.EXE 308 EXCEL.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
EXCEL.EXErundll32.exedescription pid process target process PID 308 wrote to memory of 640 308 EXCEL.EXE rundll32.exe PID 308 wrote to memory of 640 308 EXCEL.EXE rundll32.exe PID 308 wrote to memory of 640 308 EXCEL.EXE rundll32.exe PID 308 wrote to memory of 640 308 EXCEL.EXE rundll32.exe PID 308 wrote to memory of 640 308 EXCEL.EXE rundll32.exe PID 308 wrote to memory of 640 308 EXCEL.EXE rundll32.exe PID 308 wrote to memory of 640 308 EXCEL.EXE rundll32.exe PID 640 wrote to memory of 632 640 rundll32.exe wermgr.exe PID 640 wrote to memory of 632 640 rundll32.exe wermgr.exe PID 640 wrote to memory of 632 640 rundll32.exe wermgr.exe PID 640 wrote to memory of 632 640 rundll32.exe wermgr.exe PID 640 wrote to memory of 632 640 rundll32.exe wermgr.exe PID 640 wrote to memory of 632 640 rundll32.exe wermgr.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Invoice 717.xlsb"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\ndfbsjskdg.idn,StartW2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\ndfbsjskdg.idnMD5
0248aa78d8a4d231273d6589edb0a423
SHA1276bdc086442cd91c5aed2db9edc95e2ea53e172
SHA256a8f0fe4419ee163d9230feca6a00693c5f61948159fe869ead51ec3398b7038d
SHA512ec571c0883101537b1da7b02bc14eb1b2cee26937aa58995c868fb893e4ba18b445664647f8118a862ee2a1d11b54cacfad013d21523661116e3ae598acef309
-
\Users\Admin\ndfbsjskdg.idnMD5
0248aa78d8a4d231273d6589edb0a423
SHA1276bdc086442cd91c5aed2db9edc95e2ea53e172
SHA256a8f0fe4419ee163d9230feca6a00693c5f61948159fe869ead51ec3398b7038d
SHA512ec571c0883101537b1da7b02bc14eb1b2cee26937aa58995c868fb893e4ba18b445664647f8118a862ee2a1d11b54cacfad013d21523661116e3ae598acef309
-
memory/308-61-0x0000000071CC1000-0x0000000071CC3000-memory.dmpFilesize
8KB
-
memory/308-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/308-79-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/308-60-0x000000002F5D1000-0x000000002F5D4000-memory.dmpFilesize
12KB
-
memory/632-73-0x0000000000000000-mapping.dmp
-
memory/632-78-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/632-77-0x0000000000060000-0x0000000000088000-memory.dmpFilesize
160KB
-
memory/640-64-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/640-72-0x0000000000190000-0x00000000001C6000-memory.dmpFilesize
216KB
-
memory/640-74-0x0000000000B90000-0x0000000000BD3000-memory.dmpFilesize
268KB
-
memory/640-70-0x0000000000720000-0x0000000000757000-memory.dmpFilesize
220KB
-
memory/640-76-0x00000000001D1000-0x00000000001D3000-memory.dmpFilesize
8KB
-
memory/640-75-0x00000000002C0000-0x00000000002D1000-memory.dmpFilesize
68KB
-
memory/640-67-0x0000000000330000-0x0000000000369000-memory.dmpFilesize
228KB
-
memory/640-63-0x0000000000000000-mapping.dmp