trickbot | 9daf33d2d3b122f8caccbca555164e11046957ed0af5afbb2b243a292d6f2de2

General

Target

deed contract,09.21.doc
Size

69KB
MD5

f609155a19b0b0ab6cbe75bc3cee1496
SHA1

b45528f88e07f7db0954d427d43832237c29dee5
SHA256

9daf33d2d3b122f8caccbca555164e11046957ed0af5afbb2b243a292d6f2de2
SHA512

e735d121b854d761104c5987c35e64e4033dc47834a81f139f511345fcb04e2b8cc14343c33f369c6093b3540ca934569dde7e96040f9ceeb3dddef73f15a2f8

Score

10^/10

trickbot zem1 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

zem1

C2

179.42.137.102:443

191.36.152.198:443

179.42.137.104:443

179.42.137.106:443

179.42.137.108:443

202.183.12.124:443

194.190.18.122:443

103.56.207.230:443

171.103.187.218:449

171.103.189.118:449

18.139.111.104:443

179.42.137.105:443

186.4.193.75:443

171.101.229.2:449

179.42.137.107:443

103.56.43.209:449

179.42.137.110:443

45.181.207.156:443

197.44.54.162:449

179.42.137.109:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1992	1188	explorer.exe	WINWORD.EXE

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

5 1592 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1700 regsvr32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 myexternalip.com
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
5	1592	mshta.exe

pid	process
1700	regsvr32.exe

flow	ioc
12	myexternalip.com

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXEmshta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1188 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 1088 wermgr.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1188 WINWORD.EXE
1188 WINWORD.EXE

pid	process
1188	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	1088	wermgr.exe

pid	process
1188	WINWORD.EXE
1188	WINWORD.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

WINWORD.EXEexplorer.exemshta.exeregsvr32.exe

description	pid	process	target process
PID 1188 wrote to memory of 1980	1188	WINWORD.EXE	splwow64.exe
PID 1188 wrote to memory of 1980	1188	WINWORD.EXE	splwow64.exe
PID 1188 wrote to memory of 1980	1188	WINWORD.EXE	splwow64.exe
PID 1188 wrote to memory of 1980	1188	WINWORD.EXE	splwow64.exe
PID 1188 wrote to memory of 1992	1188	WINWORD.EXE	explorer.exe
PID 1188 wrote to memory of 1992	1188	WINWORD.EXE	explorer.exe
PID 1188 wrote to memory of 1992	1188	WINWORD.EXE	explorer.exe
PID 1188 wrote to memory of 1992	1188	WINWORD.EXE	explorer.exe
PID 1636 wrote to memory of 1592	1636	explorer.exe	mshta.exe
PID 1636 wrote to memory of 1592	1636	explorer.exe	mshta.exe
PID 1636 wrote to memory of 1592	1636	explorer.exe	mshta.exe
PID 1636 wrote to memory of 1592	1636	explorer.exe	mshta.exe
PID 1592 wrote to memory of 1700	1592	mshta.exe	regsvr32.exe
PID 1592 wrote to memory of 1700	1592	mshta.exe	regsvr32.exe
PID 1592 wrote to memory of 1700	1592	mshta.exe	regsvr32.exe
PID 1592 wrote to memory of 1700	1592	mshta.exe	regsvr32.exe
PID 1592 wrote to memory of 1700	1592	mshta.exe	regsvr32.exe
PID 1592 wrote to memory of 1700	1592	mshta.exe	regsvr32.exe
PID 1592 wrote to memory of 1700	1592	mshta.exe	regsvr32.exe
PID 1700 wrote to memory of 1088	1700	regsvr32.exe	wermgr.exe
PID 1700 wrote to memory of 1088	1700	regsvr32.exe	wermgr.exe
PID 1700 wrote to memory of 1088	1700	regsvr32.exe	wermgr.exe
PID 1700 wrote to memory of 1088	1700	regsvr32.exe	wermgr.exe
PID 1700 wrote to memory of 1088	1700	regsvr32.exe	wermgr.exe
PID 1700 wrote to memory of 1088	1700	regsvr32.exe	wermgr.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\deed contract,09.21.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1980

C:\Windows\SysWOW64\explorer.exe
explorer currCurrPl.hta
2⤵
- Process spawned unexpected child process
PID:1992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\currCurrPl.hta"
2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\currCurrPl.jpg
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\currCurrPl.hta
MD5
29218d420ce0c0f84c301c035801f6ff

SHA1
e61258fb5fc9ce9b814b276298885fee5e16083d

SHA256
d869fccdb3807528fb62cabc388d4ad9da641fc3354c4432ce2a93ce99e43d3c

SHA512
591ee976ab70304faf1283dedea6101cd0b592560984dd60d70e5aabd0e20bb1e24e8f281414a51f7eff842802bd1901b118170431b50720cfad80e4e0c29ea3

Download Submit
\??\c:\users\public\currCurrPl.jpg
MD5
f51c0420fbe17cc41e85c0b97cc4a6d2

SHA1
725c9421582b513f94bc1b2fb988ca0134130274

SHA256
07dad96ba45747a7131f5b860bc80d6b2d8cfc7f211d1d7eb6d8f9b541f5ba14

SHA512
c87045b3304e4d9d6dd37fe31439a07d80d96fde4c734704dd1637d3f743ac3146dae01171f31e3d41c16657e571f1635398953ce389c8c2c705e03a852f3162

Download Submit
\Users\Public\currCurrPl.jpg
MD5
f51c0420fbe17cc41e85c0b97cc4a6d2

SHA1
725c9421582b513f94bc1b2fb988ca0134130274

SHA256
07dad96ba45747a7131f5b860bc80d6b2d8cfc7f211d1d7eb6d8f9b541f5ba14

SHA512
c87045b3304e4d9d6dd37fe31439a07d80d96fde4c734704dd1637d3f743ac3146dae01171f31e3d41c16657e571f1635398953ce389c8c2c705e03a852f3162

Download Submit
memory/1088-79-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1088-78-0x0000000000060000-0x0000000000089000-memory.dmp

Filesize
164KB

Download
memory/1088-77-0x0000000000000000-mapping.dmp

Download
memory/1188-54-0x00000000703D1000-0x00000000703D3000-memory.dmp

Filesize
8KB

Download
memory/1188-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1188-56-0x00000000762A1000-0x00000000762A3000-memory.dmp

Filesize
8KB

Download
memory/1188-53-0x0000000072951000-0x0000000072954000-memory.dmp

Filesize
12KB

Download
memory/1592-64-0x0000000000000000-mapping.dmp

Download
memory/1700-74-0x0000000000270000-0x00000000002B5000-memory.dmp

Filesize
276KB

Download
memory/1700-65-0x0000000000000000-mapping.dmp

Download
memory/1700-69-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/1700-71-0x0000000000190000-0x00000000001C8000-memory.dmp

Filesize
224KB

Download
memory/1700-75-0x00000000001D0000-0x00000000001E1000-memory.dmp

Filesize
68KB

Download
memory/1700-76-0x0000000000171000-0x0000000000173000-memory.dmp

Filesize
8KB

Download
memory/1980-58-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Filesize
8KB

Download
memory/1980-57-0x0000000000000000-mapping.dmp

Download
memory/1992-61-0x000000006B701000-0x000000006B703000-memory.dmp

Filesize
8KB

Download
memory/1992-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads