Analysis
- max time kernel
111s - max time network
148s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/10/2021, 15:49
General
- Target figures_010.21.doc
- Size 76KB
- Sample211005-s9chssaaf2
- SHA256 71a5ee88580fb5ab41db8fe42ba2197cfaeed46ff40b4d8942ced0d5eda9d2b3
Malware Config
Extracted
-
trickbot
-
2000035
-
zvs1
-
36.91.117.231:443
-
36.89.228.201:443
-
103.75.32.173:443
-
45.115.172.105:443
-
36.95.23.89:443
-
103.123.86.104:443
-
202.65.119.162:443
-
202.9.121.143:443
-
139.255.65.170:443
-
110.172.137.20:443
-
103.146.232.154:443
-
36.91.88.164:443
-
103.47.170.131:443
-
122.117.90.133:443
-
103.9.188.78:443
-
210.2.149.202:443
-
118.91.190.42:443
-
117.222.61.115:443
-
117.222.57.92:443
-
136.228.128.21:443
- autorun
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\figures_010.21.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\wordRap.....hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" c:\users\public\microsoftExcelEarth.jpg3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/376-312-0x00000295091F0000-0x0000029509219000-memory.dmp
memory/376-313-0x0000029509300000-0x0000029509301000-memory.dmp
memory/664-122-0x00007FFACAAE0000-0x00007FFACBBCE000-memory.dmp
memory/664-115-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-389-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-114-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-388-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-119-0x00007FFACEBF0000-0x00007FFAD1713000-memory.dmp
memory/664-118-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-387-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-386-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-123-0x00007FFAC6B20000-0x00007FFAC8A15000-memory.dmp
memory/664-116-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/664-117-0x00007FFAAC630000-0x00007FFAAC640000-memory.dmp
memory/2868-309-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/2868-310-0x00000000009A0000-0x0000000000AEA000-memory.dmp
memory/2868-308-0x00000000044D0000-0x0000000004515000-memory.dmp
memory/2868-307-0x00000000008E0000-0x000000000098E000-memory.dmp
memory/2868-305-0x0000000004490000-0x00000000044C8000-memory.dmp
memory/2868-303-0x0000000004450000-0x0000000004489000-memory.dmp
memory/2868-300-0x0000000000C40000-0x0000000000C7B000-memory.dmp