trickbot | 27af92b73c22902d7e65731e6e3542d3e1effdad815df018f65cca6440f4d16d

General

Target

intelligence_07.27.2021.doc
Size

72KB
MD5

84b78d80895fe5083e2ff0ffe168552f
SHA1

3baa771fb2fcee216745d52fd770c7def5772ebd
SHA256

daaa7914f4ef2d951bd89f50803160bba1ac86e6ae3d66798c35e262f20587d9
SHA512

995b08b4a9013ce7e2fb5baa91582b37b1ae960b572c8f30b80fd8464116405bcb18c7e80de766d290b8f7644ddbe562c03e9e4605c593b9db7b978c9f6315b1

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev4

C2

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1608	308	cmd.exe	WINWORD.EXE

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

6 396 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

764 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
6	396	mshta.exe

pid	process
764	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

308 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 564 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

308 WINWORD.EXE
308 WINWORD.EXE

pid	process
308	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	564	wermgr.exe

pid	process
308	WINWORD.EXE
308	WINWORD.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

WINWORD.EXEcmd.exemshta.exeregsvr32.exe

description	pid	process	target process
PID 308 wrote to memory of 1608	308	WINWORD.EXE	cmd.exe
PID 308 wrote to memory of 1608	308	WINWORD.EXE	cmd.exe
PID 308 wrote to memory of 1608	308	WINWORD.EXE	cmd.exe
PID 308 wrote to memory of 1608	308	WINWORD.EXE	cmd.exe
PID 1608 wrote to memory of 396	1608	cmd.exe	mshta.exe
PID 1608 wrote to memory of 396	1608	cmd.exe	mshta.exe
PID 1608 wrote to memory of 396	1608	cmd.exe	mshta.exe
PID 1608 wrote to memory of 396	1608	cmd.exe	mshta.exe
PID 396 wrote to memory of 764	396	mshta.exe	regsvr32.exe
PID 396 wrote to memory of 764	396	mshta.exe	regsvr32.exe
PID 396 wrote to memory of 764	396	mshta.exe	regsvr32.exe
PID 396 wrote to memory of 764	396	mshta.exe	regsvr32.exe
PID 396 wrote to memory of 764	396	mshta.exe	regsvr32.exe
PID 396 wrote to memory of 764	396	mshta.exe	regsvr32.exe
PID 396 wrote to memory of 764	396	mshta.exe	regsvr32.exe
PID 764 wrote to memory of 564	764	regsvr32.exe	wermgr.exe
PID 764 wrote to memory of 564	764	regsvr32.exe	wermgr.exe
PID 764 wrote to memory of 564	764	regsvr32.exe	wermgr.exe
PID 764 wrote to memory of 564	764	regsvr32.exe	wermgr.exe
PID 308 wrote to memory of 792	308	WINWORD.EXE	splwow64.exe
PID 308 wrote to memory of 792	308	WINWORD.EXE	splwow64.exe
PID 308 wrote to memory of 792	308	WINWORD.EXE	splwow64.exe
PID 308 wrote to memory of 792	308	WINWORD.EXE	splwow64.exe
PID 764 wrote to memory of 564	764	regsvr32.exe	wermgr.exe
PID 764 wrote to memory of 564	764	regsvr32.exe	wermgr.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\intelligence_07.27.2021.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\programdata\htmlCoreCode.hta
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\programdata\htmlCoreCode.hta"
3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\htmlCoreCode.jpg
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\programdata\htmlCoreCode.hta
MD5
731a2fa48b5afb2a83011c9362d5aeb8

SHA1
4cc03587f43f8c3381b6715effda841bffba5f73

SHA256
b2d4c83861333f33b0ea498137a8135cf28561fbf7dbf2fb4f8bd6beaab38c9b

SHA512
7fd27fe39a77964092c81b7f1e77741c2413019856acd88b74b6e0dbf84294de15f8dfe1f228eb309034da7d272b5008008589099d2cc7f0bb8f4e35ea2939fe

Download Submit
\??\c:\users\public\htmlCoreCode.jpg
MD5
4dc8a9701c9f61abe5de7c9f9112aef7

SHA1
b692df07f8d4b89aa7e2d8fe9e37476bee3b94fe

SHA256
3705479cede8f2248027de6228cdb292d77f601ef7a4363a46012fe95c94e71f

SHA512
db38e667a187e64cbcd137974d97ced04951d9d4a35d7b22dc05e76111f76ca7fb10e9a51f9fdd66261e8d8485fdd4526fdf7805b0046b6d24b32bb1c20b4bd1

Download Submit
\Users\Public\htmlCoreCode.jpg
MD5
4dc8a9701c9f61abe5de7c9f9112aef7

SHA1
b692df07f8d4b89aa7e2d8fe9e37476bee3b94fe

SHA256
3705479cede8f2248027de6228cdb292d77f601ef7a4363a46012fe95c94e71f

SHA512
db38e667a187e64cbcd137974d97ced04951d9d4a35d7b22dc05e76111f76ca7fb10e9a51f9fdd66261e8d8485fdd4526fdf7805b0046b6d24b32bb1c20b4bd1

Download Submit
memory/308-63-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/308-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/308-61-0x0000000070A41000-0x0000000070A43000-memory.dmp

Filesize
8KB

Download
memory/308-60-0x0000000072FC1000-0x0000000072FC4000-memory.dmp

Filesize
12KB

Download
memory/396-67-0x0000000000000000-mapping.dmp

Download
memory/564-80-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/564-78-0x0000000000000000-mapping.dmp

Download
memory/564-79-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/764-69-0x0000000000000000-mapping.dmp

Download
memory/764-73-0x00000000002A0000-0x00000000002DF000-memory.dmp

Filesize
252KB

Download
memory/764-77-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/764-76-0x00000000001F0000-0x0000000000201000-memory.dmp

Filesize
68KB

Download
memory/792-75-0x000007FEFC661000-0x000007FEFC663000-memory.dmp

Filesize
8KB

Download
memory/792-74-0x0000000000000000-mapping.dmp

Download
memory/1608-64-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads