trickbot | 5f977be3728f4430755cc34c8be0fad95d9b5882c5397f30f82243ec6085beac

General

Target

tell,07.27.21.doc
Size

74KB
MD5

d19eb38aa7f7b4523fc5500421a28fd6
SHA1

64accb8248012c61c317f7be8d8d5c53121fd1e1
SHA256

5f977be3728f4430755cc34c8be0fad95d9b5882c5397f30f82243ec6085beac
SHA512

6506bd287f582db22a232d6276e18d82d4449fb899c7c4fe2816b0bf5b79344ef6e13fdadd0ae24bd2a72668bafb67ca58813d7c786d92f19a6ee010a253a6e5

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000031

Botnet

zev4

C2

14.232.161.45:443

118.173.233.64:443

41.57.156.203:443

45.239.234.2:443

45.201.136.3:443

177.10.90.29:443

185.17.105.236:443

91.237.161.87:443

185.189.55.207:443

186.225.119.170:443

143.0.208.20:443

222.124.16.74:443

220.82.64.198:443

200.236.218.62:443

178.216.28.59:443

45.239.233.131:443

196.216.59.174:443

119.202.8.249:443

82.159.149.37:443

49.248.217.170:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1708	1808	cmd.exe	WINWORD.EXE

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

7 1500 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

904 regsvr32.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ident.me
13 ident.me
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
7	1500	mshta.exe

pid	process
904	regsvr32.exe

flow	ioc
12	ident.me
13	ident.me

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXEmshta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1808 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 980 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1808 WINWORD.EXE
1808 WINWORD.EXE

pid	process
1808	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	980	wermgr.exe

pid	process
1808	WINWORD.EXE
1808	WINWORD.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

WINWORD.EXEcmd.exemshta.exeregsvr32.exe

description	pid	process	target process
PID 1808 wrote to memory of 1708	1808	WINWORD.EXE	cmd.exe
PID 1808 wrote to memory of 1708	1808	WINWORD.EXE	cmd.exe
PID 1808 wrote to memory of 1708	1808	WINWORD.EXE	cmd.exe
PID 1808 wrote to memory of 1708	1808	WINWORD.EXE	cmd.exe
PID 1708 wrote to memory of 1500	1708	cmd.exe	mshta.exe
PID 1708 wrote to memory of 1500	1708	cmd.exe	mshta.exe
PID 1708 wrote to memory of 1500	1708	cmd.exe	mshta.exe
PID 1708 wrote to memory of 1500	1708	cmd.exe	mshta.exe
PID 1500 wrote to memory of 904	1500	mshta.exe	regsvr32.exe
PID 1500 wrote to memory of 904	1500	mshta.exe	regsvr32.exe
PID 1500 wrote to memory of 904	1500	mshta.exe	regsvr32.exe
PID 1500 wrote to memory of 904	1500	mshta.exe	regsvr32.exe
PID 1500 wrote to memory of 904	1500	mshta.exe	regsvr32.exe
PID 1500 wrote to memory of 904	1500	mshta.exe	regsvr32.exe
PID 1500 wrote to memory of 904	1500	mshta.exe	regsvr32.exe
PID 904 wrote to memory of 980	904	regsvr32.exe	wermgr.exe
PID 904 wrote to memory of 980	904	regsvr32.exe	wermgr.exe
PID 904 wrote to memory of 980	904	regsvr32.exe	wermgr.exe
PID 904 wrote to memory of 980	904	regsvr32.exe	wermgr.exe
PID 1808 wrote to memory of 984	1808	WINWORD.EXE	splwow64.exe
PID 1808 wrote to memory of 984	1808	WINWORD.EXE	splwow64.exe
PID 1808 wrote to memory of 984	1808	WINWORD.EXE	splwow64.exe
PID 1808 wrote to memory of 984	1808	WINWORD.EXE	splwow64.exe
PID 904 wrote to memory of 980	904	regsvr32.exe	wermgr.exe
PID 904 wrote to memory of 980	904	regsvr32.exe	wermgr.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\tell,07.27.21.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\programdata\variableProcProc.hta
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\programdata\variableProcProc.hta"
3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\variableProcProc.jpg
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\programdata\variableProcProc.hta
MD5
c3bbf2b8611fa3dc96c7103cf08a47ce

SHA1
be8d2925e19e70efb808f10a9e76c257f975fb86

SHA256
0e934cb850a20bae825bd22d3d1050323944f6253e942953b5df777eeae0e4c4

SHA512
d6dbec60a2eb20a7453036adbc26f9c5b0c9b6ca0ebcf6d982c947063fa383dde8aecf773b88ffe492322b3db01f55c1ade00ebc910ea001eae214fabed0427a

Download Submit
\??\c:\users\public\variableProcProc.jpg
MD5
347134a0abde789a76239b1ae82df2e7

SHA1
56663b53bd32b12a6c4ed244f30dece6877f20cf

SHA256
d9507158555ccbef8c0e1ea32786fa831678954876e5d54e7454243b65d168de

SHA512
4ce9b8bf120ad7ec65a7f88e7dddb00d48c95a35c4c91d54b7bd6636de27e1bcbaa917fcaa7aef27669cb2ff109eb12c3778e4009ae47086375020dd309c6f56

Download Submit
\Users\Public\variableProcProc.jpg
MD5
347134a0abde789a76239b1ae82df2e7

SHA1
56663b53bd32b12a6c4ed244f30dece6877f20cf

SHA256
d9507158555ccbef8c0e1ea32786fa831678954876e5d54e7454243b65d168de

SHA512
4ce9b8bf120ad7ec65a7f88e7dddb00d48c95a35c4c91d54b7bd6636de27e1bcbaa917fcaa7aef27669cb2ff109eb12c3778e4009ae47086375020dd309c6f56

Download Submit
memory/904-72-0x00000000020B0000-0x000000000230D000-memory.dmp

Filesize
2.4MB

Download
memory/904-73-0x0000000000270000-0x00000000002B0000-memory.dmp

Filesize
256KB

Download
memory/904-75-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/904-74-0x00000000004D0000-0x00000000004E1000-memory.dmp

Filesize
68KB

Download
memory/904-68-0x0000000000000000-mapping.dmp

Download
memory/980-78-0x0000000000000000-mapping.dmp

Download
memory/980-79-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/980-80-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/984-76-0x0000000000000000-mapping.dmp

Download
memory/984-77-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1500-67-0x0000000000000000-mapping.dmp

Download
memory/1708-64-0x0000000000000000-mapping.dmp

Download
memory/1808-61-0x0000000070141000-0x0000000070143000-memory.dmp

Filesize
8KB

Download
memory/1808-60-0x00000000726C1000-0x00000000726C4000-memory.dmp

Filesize
12KB

Download
memory/1808-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1808-63-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1808-81-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads